[PATCH for-9.2 0/6] arm: xlnx: fix minor memory leaks

[PATCH for-9.2 0/6] arm: xlnx: fix minor memory leaks

[Peter Maydell]

This patchset fixes a collection of minor memory leaks in
various xlnx devices, all detected by clang LeakSanitizer
when running 'make check'. Since these are longstanding
and not very important leaks, this is 9.2 material.

thanks
-- PMM

Peter Maydell (6):
  hw/misc/xlnx-versal-cfu: destroy fifo in finalize
  hw/misc/xlnx-versal-trng: Free s->prng in finalize, not unrealize
  hw/nvram/xlnx-bbram: Call register_finalize_block
  hw/nvram/xlnx-zynqmp-efuse: Call register_finalize_block
  hw/misc/xlnx-versal-trng: Call register_finalize_block
  hm/nvram/xlnx-versal-efuse-ctrl: Call register_finalize_block

 include/hw/misc/xlnx-versal-trng.h   |  1 +
 include/hw/nvram/xlnx-bbram.h        |  1 +
 include/hw/nvram/xlnx-versal-efuse.h |  1 +
 include/hw/nvram/xlnx-zynqmp-efuse.h |  1 +
 hw/misc/xlnx-versal-cfu.c            |  8 ++++++++
 hw/misc/xlnx-versal-trng.c           | 12 ++++++------
 hw/nvram/xlnx-bbram.c                | 13 ++++++++++---
 hw/nvram/xlnx-versal-efuse-ctrl.c    |  6 +++---
 hw/nvram/xlnx-zynqmp-efuse.c         | 13 ++++++++++---
 9 files changed, 41 insertions(+), 15 deletions(-)

-- 
2.34.1

[PATCH for-9.2 1/6] hw/misc/xlnx-versal-cfu: destroy fifo in finalize

[Peter Maydell]

Since the TYPE_XNLX_VERSAL_CFU_FDRO device creates a FIFO in its
instance_init method, we must destroy the FIFO in instance_finalize
to avoid a memory leak for the QOM introspection
"instantiate-examine-finalize" cycle:

Direct leak of 8192 byte(s) in 1 object(s) allocated from:
    #0 0x55ec89eae7ee in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294d7ee) (BuildId: 6d508874816cc47d17c8dd775e8f809ae520e8cb)
    #1 0x7f697018f738 in g_malloc debian/build/deb/../../../glib/gmem.c:128:13
    #2 0x55ec8d98d98d in fifo8_create util/fifo8.c:27:18
    #3 0x55ec8aa2a624 in fifo32_create /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/include/qemu/fifo32.h:35:5
    #4 0x55ec8aa2a33c in cfu_fdro_init hw/misc/xlnx-versal-cfu.c:397:5
    #5 0x55ec8ce75da1 in object_init_with_type qom/object.c:420:9
    #6 0x55ec8ce5d07b in object_initialize_with_type qom/object.c:562:5
    #7 0x55ec8ce5e91d in object_new_with_type qom/object.c:782:5
    #8 0x55ec8ce5e9f1 in object_new qom/object.c:797:12
    #9 0x55ec8d65c81d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/xlnx-versal-cfu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/misc/xlnx-versal-cfu.c b/hw/misc/xlnx-versal-cfu.c
index 6bb82e51c15..2284b407eab 100644
--- a/hw/misc/xlnx-versal-cfu.c
+++ b/hw/misc/xlnx-versal-cfu.c
@@ -397,6 +397,13 @@ static void cfu_fdro_init(Object *obj)
     fifo32_create(&s->fdro_data, 8 * KiB / sizeof(uint32_t));
 }
 
+static void cfu_fdro_finalize(Object *obj)
+{
+    XlnxVersalCFUFDRO *s = XLNX_VERSAL_CFU_FDRO(obj);
+
+    fifo32_destroy(&s->fdro_data);
+}
+
 static void cfu_fdro_reset_enter(Object *obj, ResetType type)
 {
     XlnxVersalCFUFDRO *s = XLNX_VERSAL_CFU_FDRO(obj);
@@ -539,6 +546,7 @@ static const TypeInfo cfu_fdro_info = {
     .instance_size = sizeof(XlnxVersalCFUFDRO),
     .class_init    = cfu_fdro_class_init,
     .instance_init = cfu_fdro_init,
+    .instance_finalize = cfu_fdro_finalize,
     .interfaces = (InterfaceInfo[]) {
         { TYPE_XLNX_CFI_IF },
         { }
-- 
2.34.1

[PATCH for-9.2 2/6] hw/misc/xlnx-versal-trng: Free s->prng in finalize, not unrealize

[Peter Maydell]

The TYPE_XLNX_VERSAL_TRNG device creates s->prng with g_rand_new()
in its init method, but it frees it in its unrealize method. This
results in a leak in the QOM introspection "initialize-inspect-finalize"
lifecycle:

Direct leak of 2500 byte(s) in 1 object(s) allocated from:
    #0 0x55ec89eae9d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294d9d8) (BuildId: 6d5
08874816cc47d17c8dd775e8f809ae520e8cb)
    #1 0x7f697018fc50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
    #2 0x7f6970197738 in g_rand_new_with_seed_array debian/build/deb/../../../glib/grand.c:202:17
    #3 0x7f6970197816 in g_rand_new debian/build/deb/../../../glib/grand.c:286:10
    #4 0x55ec8aa3656a in trng_init hw/misc/xlnx-versal-trng.c:624:15
    #5 0x55ec8ce75da1 in object_init_with_type qom/object.c:420:9
    #6 0x55ec8ce5d07b in object_initialize_with_type qom/object.c:562:5
    #7 0x55ec8ce5e91d in object_new_with_type qom/object.c:782:5
    #8 0x55ec8ce5e9f1 in object_new qom/object.c:797:12
    #9 0x55ec8d65c81d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11

Move the free to finalize so it matches where we are initing
s->prng. Since that's the only thing our unrealize method was
doing, this essentially switches the whole function to be
a finalize implementation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/xlnx-versal-trng.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/misc/xlnx-versal-trng.c b/hw/misc/xlnx-versal-trng.c
index 51eb7600414..c0d1dde8708 100644
--- a/hw/misc/xlnx-versal-trng.c
+++ b/hw/misc/xlnx-versal-trng.c
@@ -624,9 +624,9 @@ static void trng_init(Object *obj)
     s->prng = g_rand_new();
 }
 
-static void trng_unrealize(DeviceState *dev)
+static void trng_finalize(Object *obj)
 {
-    XlnxVersalTRng *s = XLNX_VERSAL_TRNG(dev);
+    XlnxVersalTRng *s = XLNX_VERSAL_TRNG(obj);
 
     g_rand_free(s->prng);
     s->prng = NULL;
@@ -689,7 +689,6 @@ static void trng_class_init(ObjectClass *klass, void *data)
     ResettableClass *rc = RESETTABLE_CLASS(klass);
 
     dc->vmsd = &vmstate_trng;
-    dc->unrealize = trng_unrealize;
     rc->phases.hold = trng_reset_hold;
 
     /* Clone uint64 property with set allowed after realized */
@@ -706,6 +705,7 @@ static const TypeInfo trng_info = {
     .instance_size = sizeof(XlnxVersalTRng),
     .class_init    = trng_class_init,
     .instance_init = trng_init,
+    .instance_finalize = trng_finalize,
 };
 
 static void trng_register_types(void)
-- 
2.34.1

[PATCH for-9.2 3/6] hw/nvram/xlnx-bbram: Call register_finalize_block

[Peter Maydell]

The TYPE_XLNX_BBRAM device creates a register block with
register_init_block32() in its instance_init method; we must
therefore destroy it in our instance_finalize method to avoid a leak
in the QOM introspection "init-inspect-finalize" lifecycle:

Direct leak of 304 byte(s) in 1 object(s) allocated from:
    #0 0x5641518ca9d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294d9d8) (BuildId: 4a6
18cb63d57d5a19ed45cfc262b08da47eaafe5)
    #1 0x7ff1aab31c50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
    #2 0x564151cffc5d in register_init_block hw/core/register.c:248:34
    #3 0x564151d006be in register_init_block32 hw/core/register.c:299:12
    #4 0x56415293df75 in bbram_ctrl_init hw/nvram/xlnx-bbram.c:462:9
    #5 0x564154891dc1 in object_init_with_type qom/object.c:420:9
    #6 0x56415487909b in object_initialize_with_type qom/object.c:562:5
    #7 0x56415487a93d in object_new_with_type qom/object.c:782:5
    #8 0x56415487aa11 in object_new qom/object.c:797:12
    #9 0x56415507883d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/nvram/xlnx-bbram.h |  1 +
 hw/nvram/xlnx-bbram.c         | 13 ++++++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/include/hw/nvram/xlnx-bbram.h b/include/hw/nvram/xlnx-bbram.h
index 6fc13f8cc17..bce8e89d905 100644
--- a/include/hw/nvram/xlnx-bbram.h
+++ b/include/hw/nvram/xlnx-bbram.h
@@ -47,6 +47,7 @@ struct XlnxBBRam {
     bool bbram8_wo;
     bool blk_ro;
 
+    RegisterInfoArray *reg_array;
     uint32_t regs[RMAX_XLNX_BBRAM];
     RegisterInfo regs_info[RMAX_XLNX_BBRAM];
 };
diff --git a/hw/nvram/xlnx-bbram.c b/hw/nvram/xlnx-bbram.c
index 09575a77d77..1bc58e90ad0 100644
--- a/hw/nvram/xlnx-bbram.c
+++ b/hw/nvram/xlnx-bbram.c
@@ -456,9 +456,8 @@ static void bbram_ctrl_init(Object *obj)
 {
     XlnxBBRam *s = XLNX_BBRAM(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    RegisterInfoArray *reg_array;
 
-    reg_array =
+    s->reg_array =
         register_init_block32(DEVICE(obj), bbram_ctrl_regs_info,
                               ARRAY_SIZE(bbram_ctrl_regs_info),
                               s->regs_info, s->regs,
@@ -466,10 +465,17 @@ static void bbram_ctrl_init(Object *obj)
                               XLNX_BBRAM_ERR_DEBUG,
                               R_MAX * 4);
 
-    sysbus_init_mmio(sbd, &reg_array->mem);
+    sysbus_init_mmio(sbd, &s->reg_array->mem);
     sysbus_init_irq(sbd, &s->irq_bbram);
 }
 
+static void bbram_ctrl_finalize(Object *obj)
+{
+    XlnxBBRam *s = XLNX_BBRAM(obj);
+
+    register_finalize_block(s->reg_array);
+}
+
 static void bbram_prop_set_drive(Object *obj, Visitor *v, const char *name,
                                  void *opaque, Error **errp)
 {
@@ -537,6 +543,7 @@ static const TypeInfo bbram_ctrl_info = {
     .instance_size = sizeof(XlnxBBRam),
     .class_init    = bbram_ctrl_class_init,
     .instance_init = bbram_ctrl_init,
+    .instance_finalize = bbram_ctrl_finalize,
 };
 
 static void bbram_ctrl_register_types(void)
-- 
2.34.1

[PATCH for-9.2 4/6] hw/nvram/xlnx-zynqmp-efuse: Call register_finalize_block

[Peter Maydell]

The TYPE_XLNX_ZYNQMP_EFUSE device creates a register block with
register_init_block32() in its instance_init method; we must
therefore destroy it in our instance_finalize method to avoid a leak
in the QOM introspection "init-inspect-finalize" lifecycle:

Direct leak of 304 byte(s) in 1 object(s) allocated from:
    #0 0x55f3ff5839d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294d9d8) (BuildId: 23cf931c66865a71b6cc4da95156d03bc106fa72)
    #1 0x7f3f31c6bc50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
    #2 0x55f3ff9b8c5d in register_init_block hw/core/register.c:248:34
    #3 0x55f3ff9b96be in register_init_block32 hw/core/register.c:299:12
    #4 0x55f4005e5b25 in efuse_ctrl_init hw/nvram/xlnx-versal-efuse-ctrl.c:718:9
    #5 0x55f40254afb1 in object_init_with_type qom/object.c:420:9
    #6 0x55f40253228b in object_initialize_with_type qom/object.c:562:5
    #7 0x55f402533b2d in object_new_with_type qom/object.c:782:5
    #8 0x55f402533c01 in object_new qom/object.c:797:12
    #9 0x55f402d31a2d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/nvram/xlnx-zynqmp-efuse.h |  1 +
 hw/nvram/xlnx-zynqmp-efuse.c         | 13 ++++++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/include/hw/nvram/xlnx-zynqmp-efuse.h b/include/hw/nvram/xlnx-zynqmp-efuse.h
index f5beacc2e6a..7fb12df3fbb 100644
--- a/include/hw/nvram/xlnx-zynqmp-efuse.h
+++ b/include/hw/nvram/xlnx-zynqmp-efuse.h
@@ -37,6 +37,7 @@ struct XlnxZynqMPEFuse {
     qemu_irq irq;
 
     XlnxEFuse *efuse;
+    RegisterInfoArray *reg_array;
     uint32_t regs[XLNX_ZYNQMP_EFUSE_R_MAX];
     RegisterInfo regs_info[XLNX_ZYNQMP_EFUSE_R_MAX];
 };
diff --git a/hw/nvram/xlnx-zynqmp-efuse.c b/hw/nvram/xlnx-zynqmp-efuse.c
index 2d465f0fc6a..4e2d1b9d1e7 100644
--- a/hw/nvram/xlnx-zynqmp-efuse.c
+++ b/hw/nvram/xlnx-zynqmp-efuse.c
@@ -803,9 +803,8 @@ static void zynqmp_efuse_init(Object *obj)
 {
     XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    RegisterInfoArray *reg_array;
 
-    reg_array =
+    s->reg_array =
         register_init_block32(DEVICE(obj), zynqmp_efuse_regs_info,
                               ARRAY_SIZE(zynqmp_efuse_regs_info),
                               s->regs_info, s->regs,
@@ -813,10 +812,17 @@ static void zynqmp_efuse_init(Object *obj)
                               ZYNQMP_EFUSE_ERR_DEBUG,
                               R_MAX * 4);
 
-    sysbus_init_mmio(sbd, &reg_array->mem);
+    sysbus_init_mmio(sbd, &s->reg_array->mem);
     sysbus_init_irq(sbd, &s->irq);
 }
 
+static void zynqmp_efuse_finalize(Object *obj)
+{
+    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
+
+    register_finalize_block(s->reg_array);
+}
+
 static const VMStateDescription vmstate_efuse = {
     .name = TYPE_XLNX_ZYNQMP_EFUSE,
     .version_id = 1,
@@ -853,6 +859,7 @@ static const TypeInfo efuse_info = {
     .instance_size = sizeof(XlnxZynqMPEFuse),
     .class_init    = zynqmp_efuse_class_init,
     .instance_init = zynqmp_efuse_init,
+    .instance_finalize = zynqmp_efuse_finalize,
 };
 
 static void efuse_register_types(void)
-- 
2.34.1

[PATCH for-9.2 5/6] hw/misc/xlnx-versal-trng: Call register_finalize_block

[Peter Maydell]

The TYPE_XLNX_VERSAL_TRNG device creates a register block with
register_init_block32() in its instance_init method; we must
therefore destroy it in our instance_finalize method to avoid a leak
in the QOM introspection "init-inspect-finalize" lifecycle:

Direct leak of 304 byte(s) in 1 object(s) allocated from:
    #0 0x55842ec799d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294e9d8) (BuildId: 47496e53f3e779f1c7e9b82cbea07407152b498b)
    #1 0x7fe793c75c50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
    #2 0x55842f0aec5d in register_init_block hw/core/register.c:248:34
    #3 0x55842f0af6be in register_init_block32 hw/core/register.c:299:12
    #4 0x55842f801588 in trng_init hw/misc/xlnx-versal-trng.c:614:9
    #5 0x558431c411a1 in object_init_with_type qom/object.c:420:9
    #6 0x558431c2847b in object_initialize_with_type qom/object.c:562:5
    #7 0x558431c29d1d in object_new_with_type qom/object.c:782:5
    #8 0x558431c29df1 in object_new qom/object.c:797:12
    #9 0x558432427c1d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/xlnx-versal-trng.h | 1 +
 hw/misc/xlnx-versal-trng.c         | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/include/hw/misc/xlnx-versal-trng.h b/include/hw/misc/xlnx-versal-trng.h
index 0bcef8a6132..d96f8f9eff3 100644
--- a/include/hw/misc/xlnx-versal-trng.h
+++ b/include/hw/misc/xlnx-versal-trng.h
@@ -50,6 +50,7 @@ typedef struct XlnxVersalTRng {
     uint64_t forced_prng_count;
     uint64_t tst_seed[2];
 
+    RegisterInfoArray *reg_array;
     uint32_t regs[RMAX_XLNX_VERSAL_TRNG];
     RegisterInfo regs_info[RMAX_XLNX_VERSAL_TRNG];
 } XlnxVersalTRng;
diff --git a/hw/misc/xlnx-versal-trng.c b/hw/misc/xlnx-versal-trng.c
index c0d1dde8708..86905479b8f 100644
--- a/hw/misc/xlnx-versal-trng.c
+++ b/hw/misc/xlnx-versal-trng.c
@@ -608,9 +608,8 @@ static void trng_init(Object *obj)
 {
     XlnxVersalTRng *s = XLNX_VERSAL_TRNG(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    RegisterInfoArray *reg_array;
 
-    reg_array =
+    s->reg_array =
         register_init_block32(DEVICE(obj), trng_regs_info,
                               ARRAY_SIZE(trng_regs_info),
                               s->regs_info, s->regs,
@@ -618,7 +617,7 @@ static void trng_init(Object *obj)
                               XLNX_VERSAL_TRNG_ERR_DEBUG,
                               R_MAX * 4);
 
-    sysbus_init_mmio(sbd, &reg_array->mem);
+    sysbus_init_mmio(sbd, &s->reg_array->mem);
     sysbus_init_irq(sbd, &s->irq);
 
     s->prng = g_rand_new();
@@ -628,6 +627,7 @@ static void trng_finalize(Object *obj)
 {
     XlnxVersalTRng *s = XLNX_VERSAL_TRNG(obj);
 
+    register_finalize_block(s->reg_array);
     g_rand_free(s->prng);
     s->prng = NULL;
 }
-- 
2.34.1

[PATCH for-9.2 6/6] hm/nvram/xlnx-versal-efuse-ctrl: Call register_finalize_block

[Peter Maydell]

The TYPE_XLNX_VERSAL_EFUSE_CTRL device creates a register block with
register_init_block32() in its instance_init method; we must
therefore destroy it in our instance_finalize method to avoid a leak
in the QOM introspection "init-inspect-finalize" lifecycle:

Direct leak of 304 byte(s) in 1 object(s) allocated from:
    #0 0x55f222b5b9d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294e9d8) (BuildId: 420
43d49e1139e3f3071b1f22fac1e3e7249c9a6)
    #1 0x7fbb10669c50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
    #2 0x55f222f90c5d in register_init_block hw/core/register.c:248:34
    #3 0x55f222f916be in register_init_block32 hw/core/register.c:299:12
    #4 0x55f223bbdd15 in efuse_ctrl_init hw/nvram/xlnx-versal-efuse-ctrl.c:718:9
    #5 0x55f225b23391 in object_init_with_type qom/object.c:420:9
    #6 0x55f225b0a66b in object_initialize_with_type qom/object.c:562:5
    #7 0x55f225b0bf0d in object_new_with_type qom/object.c:782:5
    #8 0x55f225b0bfe1 in object_new qom/object.c:797:12
    #9 0x55f226309e0d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/nvram/xlnx-versal-efuse.h | 1 +
 hw/nvram/xlnx-versal-efuse-ctrl.c    | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/include/hw/nvram/xlnx-versal-efuse.h b/include/hw/nvram/xlnx-versal-efuse.h
index 86e2261b9a3..afa4f4f9960 100644
--- a/include/hw/nvram/xlnx-versal-efuse.h
+++ b/include/hw/nvram/xlnx-versal-efuse.h
@@ -44,6 +44,7 @@ struct XlnxVersalEFuseCtrl {
     void *extra_pg0_lock_spec;      /* Opaque property */
     uint32_t extra_pg0_lock_n16;
 
+    RegisterInfoArray *reg_array;
     uint32_t regs[XLNX_VERSAL_EFUSE_CTRL_R_MAX];
     RegisterInfo regs_info[XLNX_VERSAL_EFUSE_CTRL_R_MAX];
 };
diff --git a/hw/nvram/xlnx-versal-efuse-ctrl.c b/hw/nvram/xlnx-versal-efuse-ctrl.c
index def6fe3302b..8252a5cabe0 100644
--- a/hw/nvram/xlnx-versal-efuse-ctrl.c
+++ b/hw/nvram/xlnx-versal-efuse-ctrl.c
@@ -712,9 +712,8 @@ static void efuse_ctrl_init(Object *obj)
 {
     XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    RegisterInfoArray *reg_array;
 
-    reg_array =
+    s->reg_array =
         register_init_block32(DEVICE(obj), efuse_ctrl_regs_info,
                               ARRAY_SIZE(efuse_ctrl_regs_info),
                               s->regs_info, s->regs,
@@ -722,7 +721,7 @@ static void efuse_ctrl_init(Object *obj)
                               XLNX_VERSAL_EFUSE_CTRL_ERR_DEBUG,
                               R_MAX * 4);
 
-    sysbus_init_mmio(sbd, &reg_array->mem);
+    sysbus_init_mmio(sbd, &s->reg_array->mem);
     sysbus_init_irq(sbd, &s->irq_efuse_imr);
 }
 
@@ -730,6 +729,7 @@ static void efuse_ctrl_finalize(Object *obj)
 {
     XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
 
+    register_finalize_block(s->reg_array);
     g_free(s->extra_pg0_lock_spec);
 }
 
-- 
2.34.1

Re: [PATCH for-9.2 0/6] arm: xlnx: fix minor memory leaks

[Edgar E. Iglesias]

[-- Attachment #1: Type: text/plain, Size: 1397 bytes --]

On Thu, Aug 22, 2024 at 6:21 PM Peter Maydell <peter.maydell@linaro.org>
wrote:

> This patchset fixes a collection of minor memory leaks in
> various xlnx devices, all detected by clang LeakSanitizer
> when running 'make check'. Since these are longstanding
> and not very important leaks, this is 9.2 material.
>
>
All of it looks good to me:
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>



> thanks
> -- PMM
>
> Peter Maydell (6):
>   hw/misc/xlnx-versal-cfu: destroy fifo in finalize
>   hw/misc/xlnx-versal-trng: Free s->prng in finalize, not unrealize
>   hw/nvram/xlnx-bbram: Call register_finalize_block
>   hw/nvram/xlnx-zynqmp-efuse: Call register_finalize_block
>   hw/misc/xlnx-versal-trng: Call register_finalize_block
>   hm/nvram/xlnx-versal-efuse-ctrl: Call register_finalize_block
>
>  include/hw/misc/xlnx-versal-trng.h   |  1 +
>  include/hw/nvram/xlnx-bbram.h        |  1 +
>  include/hw/nvram/xlnx-versal-efuse.h |  1 +
>  include/hw/nvram/xlnx-zynqmp-efuse.h |  1 +
>  hw/misc/xlnx-versal-cfu.c            |  8 ++++++++
>  hw/misc/xlnx-versal-trng.c           | 12 ++++++------
>  hw/nvram/xlnx-bbram.c                | 13 ++++++++++---
>  hw/nvram/xlnx-versal-efuse-ctrl.c    |  6 +++---
>  hw/nvram/xlnx-zynqmp-efuse.c         | 13 ++++++++++---
>  9 files changed, 41 insertions(+), 15 deletions(-)
>
> --
> 2.34.1
>
>

[-- Attachment #2: Type: text/html, Size: 2026 bytes --]

Re: [PATCH for-9.2 1/6] hw/misc/xlnx-versal-cfu: destroy fifo in finalize

[Francisco Iglesias]

On Thu, Aug 22, 2024 at 05:21:22PM +0100, Peter Maydell wrote:
> Since the TYPE_XNLX_VERSAL_CFU_FDRO device creates a FIFO in its
> instance_init method, we must destroy the FIFO in instance_finalize
> to avoid a memory leak for the QOM introspection
> "instantiate-examine-finalize" cycle:
> 
> Direct leak of 8192 byte(s) in 1 object(s) allocated from:
>     #0 0x55ec89eae7ee in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294d7ee) (BuildId: 6d508874816cc47d17c8dd775e8f809ae520e8cb)
>     #1 0x7f697018f738 in g_malloc debian/build/deb/../../../glib/gmem.c:128:13
>     #2 0x55ec8d98d98d in fifo8_create util/fifo8.c:27:18
>     #3 0x55ec8aa2a624 in fifo32_create /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/include/qemu/fifo32.h:35:5
>     #4 0x55ec8aa2a33c in cfu_fdro_init hw/misc/xlnx-versal-cfu.c:397:5
>     #5 0x55ec8ce75da1 in object_init_with_type qom/object.c:420:9
>     #6 0x55ec8ce5d07b in object_initialize_with_type qom/object.c:562:5
>     #7 0x55ec8ce5e91d in object_new_with_type qom/object.c:782:5
>     #8 0x55ec8ce5e9f1 in object_new qom/object.c:797:12
>     #9 0x55ec8d65c81d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>

> ---
>  hw/misc/xlnx-versal-cfu.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/hw/misc/xlnx-versal-cfu.c b/hw/misc/xlnx-versal-cfu.c
> index 6bb82e51c15..2284b407eab 100644
> --- a/hw/misc/xlnx-versal-cfu.c
> +++ b/hw/misc/xlnx-versal-cfu.c
> @@ -397,6 +397,13 @@ static void cfu_fdro_init(Object *obj)
>      fifo32_create(&s->fdro_data, 8 * KiB / sizeof(uint32_t));
>  }
>  
> +static void cfu_fdro_finalize(Object *obj)
> +{
> +    XlnxVersalCFUFDRO *s = XLNX_VERSAL_CFU_FDRO(obj);
> +
> +    fifo32_destroy(&s->fdro_data);
> +}
> +
>  static void cfu_fdro_reset_enter(Object *obj, ResetType type)
>  {
>      XlnxVersalCFUFDRO *s = XLNX_VERSAL_CFU_FDRO(obj);
> @@ -539,6 +546,7 @@ static const TypeInfo cfu_fdro_info = {
>      .instance_size = sizeof(XlnxVersalCFUFDRO),
>      .class_init    = cfu_fdro_class_init,
>      .instance_init = cfu_fdro_init,
> +    .instance_finalize = cfu_fdro_finalize,
>      .interfaces = (InterfaceInfo[]) {
>          { TYPE_XLNX_CFI_IF },
>          { }
> -- 
> 2.34.1
> 

Re: [PATCH for-9.2 6/6] hm/nvram/xlnx-versal-efuse-ctrl: Call register_finalize_block

[Francisco Iglesias]

On Thu, Aug 22, 2024 at 05:21:27PM +0100, Peter Maydell wrote:
> The TYPE_XLNX_VERSAL_EFUSE_CTRL device creates a register block with
> register_init_block32() in its instance_init method; we must
> therefore destroy it in our instance_finalize method to avoid a leak
> in the QOM introspection "init-inspect-finalize" lifecycle:
> 
> Direct leak of 304 byte(s) in 1 object(s) allocated from:
>     #0 0x55f222b5b9d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294e9d8) (BuildId: 420
> 43d49e1139e3f3071b1f22fac1e3e7249c9a6)
>     #1 0x7fbb10669c50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
>     #2 0x55f222f90c5d in register_init_block hw/core/register.c:248:34
>     #3 0x55f222f916be in register_init_block32 hw/core/register.c:299:12
>     #4 0x55f223bbdd15 in efuse_ctrl_init hw/nvram/xlnx-versal-efuse-ctrl.c:718:9
>     #5 0x55f225b23391 in object_init_with_type qom/object.c:420:9
>     #6 0x55f225b0a66b in object_initialize_with_type qom/object.c:562:5
>     #7 0x55f225b0bf0d in object_new_with_type qom/object.c:782:5
>     #8 0x55f225b0bfe1 in object_new qom/object.c:797:12
>     #9 0x55f226309e0d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>



> ---
>  include/hw/nvram/xlnx-versal-efuse.h | 1 +
>  hw/nvram/xlnx-versal-efuse-ctrl.c    | 6 +++---
>  2 files changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/include/hw/nvram/xlnx-versal-efuse.h b/include/hw/nvram/xlnx-versal-efuse.h
> index 86e2261b9a3..afa4f4f9960 100644
> --- a/include/hw/nvram/xlnx-versal-efuse.h
> +++ b/include/hw/nvram/xlnx-versal-efuse.h
> @@ -44,6 +44,7 @@ struct XlnxVersalEFuseCtrl {
>      void *extra_pg0_lock_spec;      /* Opaque property */
>      uint32_t extra_pg0_lock_n16;
>  
> +    RegisterInfoArray *reg_array;
>      uint32_t regs[XLNX_VERSAL_EFUSE_CTRL_R_MAX];
>      RegisterInfo regs_info[XLNX_VERSAL_EFUSE_CTRL_R_MAX];
>  };
> diff --git a/hw/nvram/xlnx-versal-efuse-ctrl.c b/hw/nvram/xlnx-versal-efuse-ctrl.c
> index def6fe3302b..8252a5cabe0 100644
> --- a/hw/nvram/xlnx-versal-efuse-ctrl.c
> +++ b/hw/nvram/xlnx-versal-efuse-ctrl.c
> @@ -712,9 +712,8 @@ static void efuse_ctrl_init(Object *obj)
>  {
>      XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
>      SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
> -    RegisterInfoArray *reg_array;
>  
> -    reg_array =
> +    s->reg_array =
>          register_init_block32(DEVICE(obj), efuse_ctrl_regs_info,
>                                ARRAY_SIZE(efuse_ctrl_regs_info),
>                                s->regs_info, s->regs,
> @@ -722,7 +721,7 @@ static void efuse_ctrl_init(Object *obj)
>                                XLNX_VERSAL_EFUSE_CTRL_ERR_DEBUG,
>                                R_MAX * 4);
>  
> -    sysbus_init_mmio(sbd, &reg_array->mem);
> +    sysbus_init_mmio(sbd, &s->reg_array->mem);
>      sysbus_init_irq(sbd, &s->irq_efuse_imr);
>  }
>  
> @@ -730,6 +729,7 @@ static void efuse_ctrl_finalize(Object *obj)
>  {
>      XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
>  
> +    register_finalize_block(s->reg_array);
>      g_free(s->extra_pg0_lock_spec);
>  }
>  
> -- 
> 2.34.1
> 

Re: [PATCH for-9.2 3/6] hw/nvram/xlnx-bbram: Call register_finalize_block

[Francisco Iglesias]

On Thu, Aug 22, 2024 at 05:21:24PM +0100, Peter Maydell wrote:
> The TYPE_XLNX_BBRAM device creates a register block with
> register_init_block32() in its instance_init method; we must
> therefore destroy it in our instance_finalize method to avoid a leak
> in the QOM introspection "init-inspect-finalize" lifecycle:
> 
> Direct leak of 304 byte(s) in 1 object(s) allocated from:
>     #0 0x5641518ca9d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294d9d8) (BuildId: 4a6
> 18cb63d57d5a19ed45cfc262b08da47eaafe5)
>     #1 0x7ff1aab31c50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
>     #2 0x564151cffc5d in register_init_block hw/core/register.c:248:34
>     #3 0x564151d006be in register_init_block32 hw/core/register.c:299:12
>     #4 0x56415293df75 in bbram_ctrl_init hw/nvram/xlnx-bbram.c:462:9
>     #5 0x564154891dc1 in object_init_with_type qom/object.c:420:9
>     #6 0x56415487909b in object_initialize_with_type qom/object.c:562:5
>     #7 0x56415487a93d in object_new_with_type qom/object.c:782:5
>     #8 0x56415487aa11 in object_new qom/object.c:797:12
>     #9 0x56415507883d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>


> ---
>  include/hw/nvram/xlnx-bbram.h |  1 +
>  hw/nvram/xlnx-bbram.c         | 13 ++++++++++---
>  2 files changed, 11 insertions(+), 3 deletions(-)
> 
> diff --git a/include/hw/nvram/xlnx-bbram.h b/include/hw/nvram/xlnx-bbram.h
> index 6fc13f8cc17..bce8e89d905 100644
> --- a/include/hw/nvram/xlnx-bbram.h
> +++ b/include/hw/nvram/xlnx-bbram.h
> @@ -47,6 +47,7 @@ struct XlnxBBRam {
>      bool bbram8_wo;
>      bool blk_ro;
>  
> +    RegisterInfoArray *reg_array;
>      uint32_t regs[RMAX_XLNX_BBRAM];
>      RegisterInfo regs_info[RMAX_XLNX_BBRAM];
>  };
> diff --git a/hw/nvram/xlnx-bbram.c b/hw/nvram/xlnx-bbram.c
> index 09575a77d77..1bc58e90ad0 100644
> --- a/hw/nvram/xlnx-bbram.c
> +++ b/hw/nvram/xlnx-bbram.c
> @@ -456,9 +456,8 @@ static void bbram_ctrl_init(Object *obj)
>  {
>      XlnxBBRam *s = XLNX_BBRAM(obj);
>      SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
> -    RegisterInfoArray *reg_array;
>  
> -    reg_array =
> +    s->reg_array =
>          register_init_block32(DEVICE(obj), bbram_ctrl_regs_info,
>                                ARRAY_SIZE(bbram_ctrl_regs_info),
>                                s->regs_info, s->regs,
> @@ -466,10 +465,17 @@ static void bbram_ctrl_init(Object *obj)
>                                XLNX_BBRAM_ERR_DEBUG,
>                                R_MAX * 4);
>  
> -    sysbus_init_mmio(sbd, &reg_array->mem);
> +    sysbus_init_mmio(sbd, &s->reg_array->mem);
>      sysbus_init_irq(sbd, &s->irq_bbram);
>  }
>  
> +static void bbram_ctrl_finalize(Object *obj)
> +{
> +    XlnxBBRam *s = XLNX_BBRAM(obj);
> +
> +    register_finalize_block(s->reg_array);
> +}
> +
>  static void bbram_prop_set_drive(Object *obj, Visitor *v, const char *name,
>                                   void *opaque, Error **errp)
>  {
> @@ -537,6 +543,7 @@ static const TypeInfo bbram_ctrl_info = {
>      .instance_size = sizeof(XlnxBBRam),
>      .class_init    = bbram_ctrl_class_init,
>      .instance_init = bbram_ctrl_init,
> +    .instance_finalize = bbram_ctrl_finalize,
>  };
>  
>  static void bbram_ctrl_register_types(void)
> -- 
> 2.34.1
> 

Re: [PATCH for-9.2 4/6] hw/nvram/xlnx-zynqmp-efuse: Call register_finalize_block

[Francisco Iglesias]

On Thu, Aug 22, 2024 at 05:21:25PM +0100, Peter Maydell wrote:
> The TYPE_XLNX_ZYNQMP_EFUSE device creates a register block with
> register_init_block32() in its instance_init method; we must
> therefore destroy it in our instance_finalize method to avoid a leak
> in the QOM introspection "init-inspect-finalize" lifecycle:
> 
> Direct leak of 304 byte(s) in 1 object(s) allocated from:
>     #0 0x55f3ff5839d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294d9d8) (BuildId: 23cf931c66865a71b6cc4da95156d03bc106fa72)
>     #1 0x7f3f31c6bc50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
>     #2 0x55f3ff9b8c5d in register_init_block hw/core/register.c:248:34
>     #3 0x55f3ff9b96be in register_init_block32 hw/core/register.c:299:12
>     #4 0x55f4005e5b25 in efuse_ctrl_init hw/nvram/xlnx-versal-efuse-ctrl.c:718:9
>     #5 0x55f40254afb1 in object_init_with_type qom/object.c:420:9
>     #6 0x55f40253228b in object_initialize_with_type qom/object.c:562:5
>     #7 0x55f402533b2d in object_new_with_type qom/object.c:782:5
>     #8 0x55f402533c01 in object_new qom/object.c:797:12
>     #9 0x55f402d31a2d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>


> ---
>  include/hw/nvram/xlnx-zynqmp-efuse.h |  1 +
>  hw/nvram/xlnx-zynqmp-efuse.c         | 13 ++++++++++---
>  2 files changed, 11 insertions(+), 3 deletions(-)
> 
> diff --git a/include/hw/nvram/xlnx-zynqmp-efuse.h b/include/hw/nvram/xlnx-zynqmp-efuse.h
> index f5beacc2e6a..7fb12df3fbb 100644
> --- a/include/hw/nvram/xlnx-zynqmp-efuse.h
> +++ b/include/hw/nvram/xlnx-zynqmp-efuse.h
> @@ -37,6 +37,7 @@ struct XlnxZynqMPEFuse {
>      qemu_irq irq;
>  
>      XlnxEFuse *efuse;
> +    RegisterInfoArray *reg_array;
>      uint32_t regs[XLNX_ZYNQMP_EFUSE_R_MAX];
>      RegisterInfo regs_info[XLNX_ZYNQMP_EFUSE_R_MAX];
>  };
> diff --git a/hw/nvram/xlnx-zynqmp-efuse.c b/hw/nvram/xlnx-zynqmp-efuse.c
> index 2d465f0fc6a..4e2d1b9d1e7 100644
> --- a/hw/nvram/xlnx-zynqmp-efuse.c
> +++ b/hw/nvram/xlnx-zynqmp-efuse.c
> @@ -803,9 +803,8 @@ static void zynqmp_efuse_init(Object *obj)
>  {
>      XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
>      SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
> -    RegisterInfoArray *reg_array;
>  
> -    reg_array =
> +    s->reg_array =
>          register_init_block32(DEVICE(obj), zynqmp_efuse_regs_info,
>                                ARRAY_SIZE(zynqmp_efuse_regs_info),
>                                s->regs_info, s->regs,
> @@ -813,10 +812,17 @@ static void zynqmp_efuse_init(Object *obj)
>                                ZYNQMP_EFUSE_ERR_DEBUG,
>                                R_MAX * 4);
>  
> -    sysbus_init_mmio(sbd, &reg_array->mem);
> +    sysbus_init_mmio(sbd, &s->reg_array->mem);
>      sysbus_init_irq(sbd, &s->irq);
>  }
>  
> +static void zynqmp_efuse_finalize(Object *obj)
> +{
> +    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
> +
> +    register_finalize_block(s->reg_array);
> +}
> +
>  static const VMStateDescription vmstate_efuse = {
>      .name = TYPE_XLNX_ZYNQMP_EFUSE,
>      .version_id = 1,
> @@ -853,6 +859,7 @@ static const TypeInfo efuse_info = {
>      .instance_size = sizeof(XlnxZynqMPEFuse),
>      .class_init    = zynqmp_efuse_class_init,
>      .instance_init = zynqmp_efuse_init,
> +    .instance_finalize = zynqmp_efuse_finalize,
>  };
>  
>  static void efuse_register_types(void)
> -- 
> 2.34.1
> 

Re: [PATCH for-9.2 5/6] hw/misc/xlnx-versal-trng: Call register_finalize_block

[Francisco Iglesias]

On Thu, Aug 22, 2024 at 05:21:26PM +0100, Peter Maydell wrote:
> The TYPE_XLNX_VERSAL_TRNG device creates a register block with
> register_init_block32() in its instance_init method; we must
> therefore destroy it in our instance_finalize method to avoid a leak
> in the QOM introspection "init-inspect-finalize" lifecycle:
> 
> Direct leak of 304 byte(s) in 1 object(s) allocated from:
>     #0 0x55842ec799d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294e9d8) (BuildId: 47496e53f3e779f1c7e9b82cbea07407152b498b)
>     #1 0x7fe793c75c50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
>     #2 0x55842f0aec5d in register_init_block hw/core/register.c:248:34
>     #3 0x55842f0af6be in register_init_block32 hw/core/register.c:299:12
>     #4 0x55842f801588 in trng_init hw/misc/xlnx-versal-trng.c:614:9
>     #5 0x558431c411a1 in object_init_with_type qom/object.c:420:9
>     #6 0x558431c2847b in object_initialize_with_type qom/object.c:562:5
>     #7 0x558431c29d1d in object_new_with_type qom/object.c:782:5
>     #8 0x558431c29df1 in object_new qom/object.c:797:12
>     #9 0x558432427c1d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>


> ---
>  include/hw/misc/xlnx-versal-trng.h | 1 +
>  hw/misc/xlnx-versal-trng.c         | 6 +++---
>  2 files changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/include/hw/misc/xlnx-versal-trng.h b/include/hw/misc/xlnx-versal-trng.h
> index 0bcef8a6132..d96f8f9eff3 100644
> --- a/include/hw/misc/xlnx-versal-trng.h
> +++ b/include/hw/misc/xlnx-versal-trng.h
> @@ -50,6 +50,7 @@ typedef struct XlnxVersalTRng {
>      uint64_t forced_prng_count;
>      uint64_t tst_seed[2];
>  
> +    RegisterInfoArray *reg_array;
>      uint32_t regs[RMAX_XLNX_VERSAL_TRNG];
>      RegisterInfo regs_info[RMAX_XLNX_VERSAL_TRNG];
>  } XlnxVersalTRng;
> diff --git a/hw/misc/xlnx-versal-trng.c b/hw/misc/xlnx-versal-trng.c
> index c0d1dde8708..86905479b8f 100644
> --- a/hw/misc/xlnx-versal-trng.c
> +++ b/hw/misc/xlnx-versal-trng.c
> @@ -608,9 +608,8 @@ static void trng_init(Object *obj)
>  {
>      XlnxVersalTRng *s = XLNX_VERSAL_TRNG(obj);
>      SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
> -    RegisterInfoArray *reg_array;
>  
> -    reg_array =
> +    s->reg_array =
>          register_init_block32(DEVICE(obj), trng_regs_info,
>                                ARRAY_SIZE(trng_regs_info),
>                                s->regs_info, s->regs,
> @@ -618,7 +617,7 @@ static void trng_init(Object *obj)
>                                XLNX_VERSAL_TRNG_ERR_DEBUG,
>                                R_MAX * 4);
>  
> -    sysbus_init_mmio(sbd, &reg_array->mem);
> +    sysbus_init_mmio(sbd, &s->reg_array->mem);
>      sysbus_init_irq(sbd, &s->irq);
>  
>      s->prng = g_rand_new();
> @@ -628,6 +627,7 @@ static void trng_finalize(Object *obj)
>  {
>      XlnxVersalTRng *s = XLNX_VERSAL_TRNG(obj);
>  
> +    register_finalize_block(s->reg_array);
>      g_rand_free(s->prng);
>      s->prng = NULL;
>  }
> -- 
> 2.34.1
> 

Re: [PATCH for-9.2 6/6] hm/nvram/xlnx-versal-efuse-ctrl: Call register_finalize_block

[Francisco Iglesias]

On Thu, Aug 22, 2024 at 05:21:27PM +0100, Peter Maydell wrote:
> The TYPE_XLNX_VERSAL_EFUSE_CTRL device creates a register block with
> register_init_block32() in its instance_init method; we must
> therefore destroy it in our instance_finalize method to avoid a leak
> in the QOM introspection "init-inspect-finalize" lifecycle:
> 
> Direct leak of 304 byte(s) in 1 object(s) allocated from:
>     #0 0x55f222b5b9d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294e9d8) (BuildId: 420
> 43d49e1139e3f3071b1f22fac1e3e7249c9a6)
>     #1 0x7fbb10669c50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
>     #2 0x55f222f90c5d in register_init_block hw/core/register.c:248:34
>     #3 0x55f222f916be in register_init_block32 hw/core/register.c:299:12
>     #4 0x55f223bbdd15 in efuse_ctrl_init hw/nvram/xlnx-versal-efuse-ctrl.c:718:9
>     #5 0x55f225b23391 in object_init_with_type qom/object.c:420:9
>     #6 0x55f225b0a66b in object_initialize_with_type qom/object.c:562:5
>     #7 0x55f225b0bf0d in object_new_with_type qom/object.c:782:5
>     #8 0x55f225b0bfe1 in object_new qom/object.c:797:12
>     #9 0x55f226309e0d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>

> ---
>  include/hw/nvram/xlnx-versal-efuse.h | 1 +
>  hw/nvram/xlnx-versal-efuse-ctrl.c    | 6 +++---
>  2 files changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/include/hw/nvram/xlnx-versal-efuse.h b/include/hw/nvram/xlnx-versal-efuse.h
> index 86e2261b9a3..afa4f4f9960 100644
> --- a/include/hw/nvram/xlnx-versal-efuse.h
> +++ b/include/hw/nvram/xlnx-versal-efuse.h
> @@ -44,6 +44,7 @@ struct XlnxVersalEFuseCtrl {
>      void *extra_pg0_lock_spec;      /* Opaque property */
>      uint32_t extra_pg0_lock_n16;
>  
> +    RegisterInfoArray *reg_array;
>      uint32_t regs[XLNX_VERSAL_EFUSE_CTRL_R_MAX];
>      RegisterInfo regs_info[XLNX_VERSAL_EFUSE_CTRL_R_MAX];
>  };
> diff --git a/hw/nvram/xlnx-versal-efuse-ctrl.c b/hw/nvram/xlnx-versal-efuse-ctrl.c
> index def6fe3302b..8252a5cabe0 100644
> --- a/hw/nvram/xlnx-versal-efuse-ctrl.c
> +++ b/hw/nvram/xlnx-versal-efuse-ctrl.c
> @@ -712,9 +712,8 @@ static void efuse_ctrl_init(Object *obj)
>  {
>      XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
>      SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
> -    RegisterInfoArray *reg_array;
>  
> -    reg_array =
> +    s->reg_array =
>          register_init_block32(DEVICE(obj), efuse_ctrl_regs_info,
>                                ARRAY_SIZE(efuse_ctrl_regs_info),
>                                s->regs_info, s->regs,
> @@ -722,7 +721,7 @@ static void efuse_ctrl_init(Object *obj)
>                                XLNX_VERSAL_EFUSE_CTRL_ERR_DEBUG,
>                                R_MAX * 4);
>  
> -    sysbus_init_mmio(sbd, &reg_array->mem);
> +    sysbus_init_mmio(sbd, &s->reg_array->mem);
>      sysbus_init_irq(sbd, &s->irq_efuse_imr);
>  }
>  
> @@ -730,6 +729,7 @@ static void efuse_ctrl_finalize(Object *obj)
>  {
>      XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
>  
> +    register_finalize_block(s->reg_array);
>      g_free(s->extra_pg0_lock_spec);
>  }
>  
> -- 
> 2.34.1
> 

Re: [PATCH for-9.2 1/6] hw/misc/xlnx-versal-cfu: destroy fifo in finalize

[Alistair Francis]

On Fri, Aug 23, 2024 at 2:22 AM Peter Maydell <peter.maydell@linaro.org> wrote:
>
> Since the TYPE_XNLX_VERSAL_CFU_FDRO device creates a FIFO in its
> instance_init method, we must destroy the FIFO in instance_finalize
> to avoid a memory leak for the QOM introspection
> "instantiate-examine-finalize" cycle:
>
> Direct leak of 8192 byte(s) in 1 object(s) allocated from:
>     #0 0x55ec89eae7ee in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294d7ee) (BuildId: 6d508874816cc47d17c8dd775e8f809ae520e8cb)
>     #1 0x7f697018f738 in g_malloc debian/build/deb/../../../glib/gmem.c:128:13
>     #2 0x55ec8d98d98d in fifo8_create util/fifo8.c:27:18
>     #3 0x55ec8aa2a624 in fifo32_create /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/include/qemu/fifo32.h:35:5
>     #4 0x55ec8aa2a33c in cfu_fdro_init hw/misc/xlnx-versal-cfu.c:397:5
>     #5 0x55ec8ce75da1 in object_init_with_type qom/object.c:420:9
>     #6 0x55ec8ce5d07b in object_initialize_with_type qom/object.c:562:5
>     #7 0x55ec8ce5e91d in object_new_with_type qom/object.c:782:5
>     #8 0x55ec8ce5e9f1 in object_new qom/object.c:797:12
>     #9 0x55ec8d65c81d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  hw/misc/xlnx-versal-cfu.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/hw/misc/xlnx-versal-cfu.c b/hw/misc/xlnx-versal-cfu.c
> index 6bb82e51c15..2284b407eab 100644
> --- a/hw/misc/xlnx-versal-cfu.c
> +++ b/hw/misc/xlnx-versal-cfu.c
> @@ -397,6 +397,13 @@ static void cfu_fdro_init(Object *obj)
>      fifo32_create(&s->fdro_data, 8 * KiB / sizeof(uint32_t));
>  }
>
> +static void cfu_fdro_finalize(Object *obj)
> +{
> +    XlnxVersalCFUFDRO *s = XLNX_VERSAL_CFU_FDRO(obj);
> +
> +    fifo32_destroy(&s->fdro_data);
> +}
> +
>  static void cfu_fdro_reset_enter(Object *obj, ResetType type)
>  {
>      XlnxVersalCFUFDRO *s = XLNX_VERSAL_CFU_FDRO(obj);
> @@ -539,6 +546,7 @@ static const TypeInfo cfu_fdro_info = {
>      .instance_size = sizeof(XlnxVersalCFUFDRO),
>      .class_init    = cfu_fdro_class_init,
>      .instance_init = cfu_fdro_init,
> +    .instance_finalize = cfu_fdro_finalize,
>      .interfaces = (InterfaceInfo[]) {
>          { TYPE_XLNX_CFI_IF },
>          { }
> --
> 2.34.1
>
>

Re: [PATCH for-9.2 2/6] hw/misc/xlnx-versal-trng: Free s->prng in finalize, not unrealize

[Alistair Francis]

On Fri, Aug 23, 2024 at 2:22 AM Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The TYPE_XLNX_VERSAL_TRNG device creates s->prng with g_rand_new()
> in its init method, but it frees it in its unrealize method. This
> results in a leak in the QOM introspection "initialize-inspect-finalize"
> lifecycle:
>
> Direct leak of 2500 byte(s) in 1 object(s) allocated from:
>     #0 0x55ec89eae9d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294d9d8) (BuildId: 6d5
> 08874816cc47d17c8dd775e8f809ae520e8cb)
>     #1 0x7f697018fc50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
>     #2 0x7f6970197738 in g_rand_new_with_seed_array debian/build/deb/../../../glib/grand.c:202:17
>     #3 0x7f6970197816 in g_rand_new debian/build/deb/../../../glib/grand.c:286:10
>     #4 0x55ec8aa3656a in trng_init hw/misc/xlnx-versal-trng.c:624:15
>     #5 0x55ec8ce75da1 in object_init_with_type qom/object.c:420:9
>     #6 0x55ec8ce5d07b in object_initialize_with_type qom/object.c:562:5
>     #7 0x55ec8ce5e91d in object_new_with_type qom/object.c:782:5
>     #8 0x55ec8ce5e9f1 in object_new qom/object.c:797:12
>     #9 0x55ec8d65c81d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
>
> Move the free to finalize so it matches where we are initing
> s->prng. Since that's the only thing our unrealize method was
> doing, this essentially switches the whole function to be
> a finalize implementation.
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  hw/misc/xlnx-versal-trng.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/hw/misc/xlnx-versal-trng.c b/hw/misc/xlnx-versal-trng.c
> index 51eb7600414..c0d1dde8708 100644
> --- a/hw/misc/xlnx-versal-trng.c
> +++ b/hw/misc/xlnx-versal-trng.c
> @@ -624,9 +624,9 @@ static void trng_init(Object *obj)
>      s->prng = g_rand_new();
>  }
>
> -static void trng_unrealize(DeviceState *dev)
> +static void trng_finalize(Object *obj)
>  {
> -    XlnxVersalTRng *s = XLNX_VERSAL_TRNG(dev);
> +    XlnxVersalTRng *s = XLNX_VERSAL_TRNG(obj);
>
>      g_rand_free(s->prng);
>      s->prng = NULL;
> @@ -689,7 +689,6 @@ static void trng_class_init(ObjectClass *klass, void *data)
>      ResettableClass *rc = RESETTABLE_CLASS(klass);
>
>      dc->vmsd = &vmstate_trng;
> -    dc->unrealize = trng_unrealize;
>      rc->phases.hold = trng_reset_hold;
>
>      /* Clone uint64 property with set allowed after realized */
> @@ -706,6 +705,7 @@ static const TypeInfo trng_info = {
>      .instance_size = sizeof(XlnxVersalTRng),
>      .class_init    = trng_class_init,
>      .instance_init = trng_init,
> +    .instance_finalize = trng_finalize,
>  };
>
>  static void trng_register_types(void)
> --
> 2.34.1
>
>

Re: [PATCH for-9.2 3/6] hw/nvram/xlnx-bbram: Call register_finalize_block

[Alistair Francis]

On Fri, Aug 23, 2024 at 2:22 AM Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The TYPE_XLNX_BBRAM device creates a register block with
> register_init_block32() in its instance_init method; we must
> therefore destroy it in our instance_finalize method to avoid a leak
> in the QOM introspection "init-inspect-finalize" lifecycle:
>
> Direct leak of 304 byte(s) in 1 object(s) allocated from:
>     #0 0x5641518ca9d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294d9d8) (BuildId: 4a6
> 18cb63d57d5a19ed45cfc262b08da47eaafe5)
>     #1 0x7ff1aab31c50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
>     #2 0x564151cffc5d in register_init_block hw/core/register.c:248:34
>     #3 0x564151d006be in register_init_block32 hw/core/register.c:299:12
>     #4 0x56415293df75 in bbram_ctrl_init hw/nvram/xlnx-bbram.c:462:9
>     #5 0x564154891dc1 in object_init_with_type qom/object.c:420:9
>     #6 0x56415487909b in object_initialize_with_type qom/object.c:562:5
>     #7 0x56415487a93d in object_new_with_type qom/object.c:782:5
>     #8 0x56415487aa11 in object_new qom/object.c:797:12
>     #9 0x56415507883d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  include/hw/nvram/xlnx-bbram.h |  1 +
>  hw/nvram/xlnx-bbram.c         | 13 ++++++++++---
>  2 files changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/include/hw/nvram/xlnx-bbram.h b/include/hw/nvram/xlnx-bbram.h
> index 6fc13f8cc17..bce8e89d905 100644
> --- a/include/hw/nvram/xlnx-bbram.h
> +++ b/include/hw/nvram/xlnx-bbram.h
> @@ -47,6 +47,7 @@ struct XlnxBBRam {
>      bool bbram8_wo;
>      bool blk_ro;
>
> +    RegisterInfoArray *reg_array;
>      uint32_t regs[RMAX_XLNX_BBRAM];
>      RegisterInfo regs_info[RMAX_XLNX_BBRAM];
>  };
> diff --git a/hw/nvram/xlnx-bbram.c b/hw/nvram/xlnx-bbram.c
> index 09575a77d77..1bc58e90ad0 100644
> --- a/hw/nvram/xlnx-bbram.c
> +++ b/hw/nvram/xlnx-bbram.c
> @@ -456,9 +456,8 @@ static void bbram_ctrl_init(Object *obj)
>  {
>      XlnxBBRam *s = XLNX_BBRAM(obj);
>      SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
> -    RegisterInfoArray *reg_array;
>
> -    reg_array =
> +    s->reg_array =
>          register_init_block32(DEVICE(obj), bbram_ctrl_regs_info,
>                                ARRAY_SIZE(bbram_ctrl_regs_info),
>                                s->regs_info, s->regs,
> @@ -466,10 +465,17 @@ static void bbram_ctrl_init(Object *obj)
>                                XLNX_BBRAM_ERR_DEBUG,
>                                R_MAX * 4);
>
> -    sysbus_init_mmio(sbd, &reg_array->mem);
> +    sysbus_init_mmio(sbd, &s->reg_array->mem);
>      sysbus_init_irq(sbd, &s->irq_bbram);
>  }
>
> +static void bbram_ctrl_finalize(Object *obj)
> +{
> +    XlnxBBRam *s = XLNX_BBRAM(obj);
> +
> +    register_finalize_block(s->reg_array);
> +}
> +
>  static void bbram_prop_set_drive(Object *obj, Visitor *v, const char *name,
>                                   void *opaque, Error **errp)
>  {
> @@ -537,6 +543,7 @@ static const TypeInfo bbram_ctrl_info = {
>      .instance_size = sizeof(XlnxBBRam),
>      .class_init    = bbram_ctrl_class_init,
>      .instance_init = bbram_ctrl_init,
> +    .instance_finalize = bbram_ctrl_finalize,
>  };
>
>  static void bbram_ctrl_register_types(void)
> --
> 2.34.1
>
>

Re: [PATCH for-9.2 4/6] hw/nvram/xlnx-zynqmp-efuse: Call register_finalize_block

[Alistair Francis]

On Fri, Aug 23, 2024 at 2:23 AM Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The TYPE_XLNX_ZYNQMP_EFUSE device creates a register block with
> register_init_block32() in its instance_init method; we must
> therefore destroy it in our instance_finalize method to avoid a leak
> in the QOM introspection "init-inspect-finalize" lifecycle:
>
> Direct leak of 304 byte(s) in 1 object(s) allocated from:
>     #0 0x55f3ff5839d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294d9d8) (BuildId: 23cf931c66865a71b6cc4da95156d03bc106fa72)
>     #1 0x7f3f31c6bc50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
>     #2 0x55f3ff9b8c5d in register_init_block hw/core/register.c:248:34
>     #3 0x55f3ff9b96be in register_init_block32 hw/core/register.c:299:12
>     #4 0x55f4005e5b25 in efuse_ctrl_init hw/nvram/xlnx-versal-efuse-ctrl.c:718:9
>     #5 0x55f40254afb1 in object_init_with_type qom/object.c:420:9
>     #6 0x55f40253228b in object_initialize_with_type qom/object.c:562:5
>     #7 0x55f402533b2d in object_new_with_type qom/object.c:782:5
>     #8 0x55f402533c01 in object_new qom/object.c:797:12
>     #9 0x55f402d31a2d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  include/hw/nvram/xlnx-zynqmp-efuse.h |  1 +
>  hw/nvram/xlnx-zynqmp-efuse.c         | 13 ++++++++++---
>  2 files changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/include/hw/nvram/xlnx-zynqmp-efuse.h b/include/hw/nvram/xlnx-zynqmp-efuse.h
> index f5beacc2e6a..7fb12df3fbb 100644
> --- a/include/hw/nvram/xlnx-zynqmp-efuse.h
> +++ b/include/hw/nvram/xlnx-zynqmp-efuse.h
> @@ -37,6 +37,7 @@ struct XlnxZynqMPEFuse {
>      qemu_irq irq;
>
>      XlnxEFuse *efuse;
> +    RegisterInfoArray *reg_array;
>      uint32_t regs[XLNX_ZYNQMP_EFUSE_R_MAX];
>      RegisterInfo regs_info[XLNX_ZYNQMP_EFUSE_R_MAX];
>  };
> diff --git a/hw/nvram/xlnx-zynqmp-efuse.c b/hw/nvram/xlnx-zynqmp-efuse.c
> index 2d465f0fc6a..4e2d1b9d1e7 100644
> --- a/hw/nvram/xlnx-zynqmp-efuse.c
> +++ b/hw/nvram/xlnx-zynqmp-efuse.c
> @@ -803,9 +803,8 @@ static void zynqmp_efuse_init(Object *obj)
>  {
>      XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
>      SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
> -    RegisterInfoArray *reg_array;
>
> -    reg_array =
> +    s->reg_array =
>          register_init_block32(DEVICE(obj), zynqmp_efuse_regs_info,
>                                ARRAY_SIZE(zynqmp_efuse_regs_info),
>                                s->regs_info, s->regs,
> @@ -813,10 +812,17 @@ static void zynqmp_efuse_init(Object *obj)
>                                ZYNQMP_EFUSE_ERR_DEBUG,
>                                R_MAX * 4);
>
> -    sysbus_init_mmio(sbd, &reg_array->mem);
> +    sysbus_init_mmio(sbd, &s->reg_array->mem);
>      sysbus_init_irq(sbd, &s->irq);
>  }
>
> +static void zynqmp_efuse_finalize(Object *obj)
> +{
> +    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
> +
> +    register_finalize_block(s->reg_array);
> +}
> +
>  static const VMStateDescription vmstate_efuse = {
>      .name = TYPE_XLNX_ZYNQMP_EFUSE,
>      .version_id = 1,
> @@ -853,6 +859,7 @@ static const TypeInfo efuse_info = {
>      .instance_size = sizeof(XlnxZynqMPEFuse),
>      .class_init    = zynqmp_efuse_class_init,
>      .instance_init = zynqmp_efuse_init,
> +    .instance_finalize = zynqmp_efuse_finalize,
>  };
>
>  static void efuse_register_types(void)
> --
> 2.34.1
>
>

Re: [PATCH for-9.2 5/6] hw/misc/xlnx-versal-trng: Call register_finalize_block

[Alistair Francis]

On Fri, Aug 23, 2024 at 2:22 AM Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The TYPE_XLNX_VERSAL_TRNG device creates a register block with
> register_init_block32() in its instance_init method; we must
> therefore destroy it in our instance_finalize method to avoid a leak
> in the QOM introspection "init-inspect-finalize" lifecycle:
>
> Direct leak of 304 byte(s) in 1 object(s) allocated from:
>     #0 0x55842ec799d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294e9d8) (BuildId: 47496e53f3e779f1c7e9b82cbea07407152b498b)
>     #1 0x7fe793c75c50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
>     #2 0x55842f0aec5d in register_init_block hw/core/register.c:248:34
>     #3 0x55842f0af6be in register_init_block32 hw/core/register.c:299:12
>     #4 0x55842f801588 in trng_init hw/misc/xlnx-versal-trng.c:614:9
>     #5 0x558431c411a1 in object_init_with_type qom/object.c:420:9
>     #6 0x558431c2847b in object_initialize_with_type qom/object.c:562:5
>     #7 0x558431c29d1d in object_new_with_type qom/object.c:782:5
>     #8 0x558431c29df1 in object_new qom/object.c:797:12
>     #9 0x558432427c1d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  include/hw/misc/xlnx-versal-trng.h | 1 +
>  hw/misc/xlnx-versal-trng.c         | 6 +++---
>  2 files changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/include/hw/misc/xlnx-versal-trng.h b/include/hw/misc/xlnx-versal-trng.h
> index 0bcef8a6132..d96f8f9eff3 100644
> --- a/include/hw/misc/xlnx-versal-trng.h
> +++ b/include/hw/misc/xlnx-versal-trng.h
> @@ -50,6 +50,7 @@ typedef struct XlnxVersalTRng {
>      uint64_t forced_prng_count;
>      uint64_t tst_seed[2];
>
> +    RegisterInfoArray *reg_array;
>      uint32_t regs[RMAX_XLNX_VERSAL_TRNG];
>      RegisterInfo regs_info[RMAX_XLNX_VERSAL_TRNG];
>  } XlnxVersalTRng;
> diff --git a/hw/misc/xlnx-versal-trng.c b/hw/misc/xlnx-versal-trng.c
> index c0d1dde8708..86905479b8f 100644
> --- a/hw/misc/xlnx-versal-trng.c
> +++ b/hw/misc/xlnx-versal-trng.c
> @@ -608,9 +608,8 @@ static void trng_init(Object *obj)
>  {
>      XlnxVersalTRng *s = XLNX_VERSAL_TRNG(obj);
>      SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
> -    RegisterInfoArray *reg_array;
>
> -    reg_array =
> +    s->reg_array =
>          register_init_block32(DEVICE(obj), trng_regs_info,
>                                ARRAY_SIZE(trng_regs_info),
>                                s->regs_info, s->regs,
> @@ -618,7 +617,7 @@ static void trng_init(Object *obj)
>                                XLNX_VERSAL_TRNG_ERR_DEBUG,
>                                R_MAX * 4);
>
> -    sysbus_init_mmio(sbd, &reg_array->mem);
> +    sysbus_init_mmio(sbd, &s->reg_array->mem);
>      sysbus_init_irq(sbd, &s->irq);
>
>      s->prng = g_rand_new();
> @@ -628,6 +627,7 @@ static void trng_finalize(Object *obj)
>  {
>      XlnxVersalTRng *s = XLNX_VERSAL_TRNG(obj);
>
> +    register_finalize_block(s->reg_array);
>      g_rand_free(s->prng);
>      s->prng = NULL;
>  }
> --
> 2.34.1
>
>

Re: [PATCH for-9.2 6/6] hm/nvram/xlnx-versal-efuse-ctrl: Call register_finalize_block

[Alistair Francis]

On Fri, Aug 23, 2024 at 2:22 AM Peter Maydell <peter.maydell@linaro.org> wrote:
>
> The TYPE_XLNX_VERSAL_EFUSE_CTRL device creates a register block with
> register_init_block32() in its instance_init method; we must
> therefore destroy it in our instance_finalize method to avoid a leak
> in the QOM introspection "init-inspect-finalize" lifecycle:
>
> Direct leak of 304 byte(s) in 1 object(s) allocated from:
>     #0 0x55f222b5b9d8 in __interceptor_calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/qemu-system-aarch64+0x294e9d8) (BuildId: 420
> 43d49e1139e3f3071b1f22fac1e3e7249c9a6)
>     #1 0x7fbb10669c50 in g_malloc0 debian/build/deb/../../../glib/gmem.c:161:13
>     #2 0x55f222f90c5d in register_init_block hw/core/register.c:248:34
>     #3 0x55f222f916be in register_init_block32 hw/core/register.c:299:12
>     #4 0x55f223bbdd15 in efuse_ctrl_init hw/nvram/xlnx-versal-efuse-ctrl.c:718:9
>     #5 0x55f225b23391 in object_init_with_type qom/object.c:420:9
>     #6 0x55f225b0a66b in object_initialize_with_type qom/object.c:562:5
>     #7 0x55f225b0bf0d in object_new_with_type qom/object.c:782:5
>     #8 0x55f225b0bfe1 in object_new qom/object.c:797:12
>     #9 0x55f226309e0d in qmp_device_list_properties qom/qom-qmp-cmds.c:144:11
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  include/hw/nvram/xlnx-versal-efuse.h | 1 +
>  hw/nvram/xlnx-versal-efuse-ctrl.c    | 6 +++---
>  2 files changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/include/hw/nvram/xlnx-versal-efuse.h b/include/hw/nvram/xlnx-versal-efuse.h
> index 86e2261b9a3..afa4f4f9960 100644
> --- a/include/hw/nvram/xlnx-versal-efuse.h
> +++ b/include/hw/nvram/xlnx-versal-efuse.h
> @@ -44,6 +44,7 @@ struct XlnxVersalEFuseCtrl {
>      void *extra_pg0_lock_spec;      /* Opaque property */
>      uint32_t extra_pg0_lock_n16;
>
> +    RegisterInfoArray *reg_array;
>      uint32_t regs[XLNX_VERSAL_EFUSE_CTRL_R_MAX];
>      RegisterInfo regs_info[XLNX_VERSAL_EFUSE_CTRL_R_MAX];
>  };
> diff --git a/hw/nvram/xlnx-versal-efuse-ctrl.c b/hw/nvram/xlnx-versal-efuse-ctrl.c
> index def6fe3302b..8252a5cabe0 100644
> --- a/hw/nvram/xlnx-versal-efuse-ctrl.c
> +++ b/hw/nvram/xlnx-versal-efuse-ctrl.c
> @@ -712,9 +712,8 @@ static void efuse_ctrl_init(Object *obj)
>  {
>      XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
>      SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
> -    RegisterInfoArray *reg_array;
>
> -    reg_array =
> +    s->reg_array =
>          register_init_block32(DEVICE(obj), efuse_ctrl_regs_info,
>                                ARRAY_SIZE(efuse_ctrl_regs_info),
>                                s->regs_info, s->regs,
> @@ -722,7 +721,7 @@ static void efuse_ctrl_init(Object *obj)
>                                XLNX_VERSAL_EFUSE_CTRL_ERR_DEBUG,
>                                R_MAX * 4);
>
> -    sysbus_init_mmio(sbd, &reg_array->mem);
> +    sysbus_init_mmio(sbd, &s->reg_array->mem);
>      sysbus_init_irq(sbd, &s->irq_efuse_imr);
>  }
>
> @@ -730,6 +729,7 @@ static void efuse_ctrl_finalize(Object *obj)
>  {
>      XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
>
> +    register_finalize_block(s->reg_array);
>      g_free(s->extra_pg0_lock_spec);
>  }
>
> --
> 2.34.1
>
>