A random mix of items here, nothing very major.

Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170206' into staging (2017-02-07 15:29:26 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170207

for you to fetch changes up to 7727b832886fafbdec7299eb7773dc9071bf4cdd:

stellaris: Use the 'unimplemented' device for parts we don't implement (2017-02-07 18:30:00 +0000)

target-arm:

* new "unimplemented" device for stubbing out devices in a

system model so accesses can be logged

* stellaris: document the SoC memory map

* arm: create instruction syndromes for AArch32 data aborts

* arm: Correctly handle watchpoints for BE32 CPUs

* Fix Thumb-1 BE32 execution and disassembly

* arm: Add cfgend parameter for ARM CPU selection

* sd: sdhci: check data length during dma_memory_read

* aspeed: add a watchdog controller

* integratorcp: adding vmstate for save/restore

Cédric Le Goater (2):

wdt: Add Aspeed watchdog device model

aspeed: add a watchdog controller

Julian Brown (4):

hw/arm/integratorcp: Support specifying features via -cpu

target/arm: Add cfgend parameter for ARM CPU selection.

Fix Thumb-1 BE32 execution and disassembly.

arm: Correctly handle watchpoints for BE32 CPUs

Pavel Dovgalyuk (1):

integratorcp: adding vmstate for save/restore

Peter Maydell (5):

target/arm: Abstract out pbit/wbit tests in ARM ldr/str decode

target/arm: A32, T32: Create Instruction Syndromes for Data Aborts

stellaris: Document memory map and which SoC devices are unimplemented

hw/misc: New "unimplemented" sysbus device

stellaris: Use the 'unimplemented' device for parts we don't implement

Prasad J Pandit (1):

sd: sdhci: check data length during dma_memory_read

hw/misc/Makefile.objs | 2 +

hw/watchdog/Makefile.objs | 1 +

include/disas/bfd.h | 7 ++

include/hw/arm/aspeed_soc.h | 2 +

include/hw/misc/unimp.h | 39 +++++++

include/hw/watchdog/wdt_aspeed.h | 32 ++++++

include/qom/cpu.h | 3 +

target/arm/arm_ldst.h | 10 +-

target/arm/cpu.h | 7 ++

target/arm/internals.h | 5 +

target/arm/translate.h | 14 +++

disas.c | 1 +

exec.c | 1 +

hw/arm/aspeed_soc.c | 13 +++

hw/arm/integratorcp.c | 78 +++++++++++++-

hw/arm/stellaris.c | 48 +++++++++

hw/misc/unimp.c | 107 +++++++++++++++++++

hw/sd/sdhci.c | 2 +-

hw/watchdog/wdt_aspeed.c | 225 +++++++++++++++++++++++++++++++++++++++

qom/cpu.c | 6 ++

target/arm/cpu.c | 39 +++++++

target/arm/op_helper.c | 22 ++++

target/arm/translate-a64.c | 14 ---

target/arm/translate.c | 193 ++++++++++++++++++++++++---------

24 files changed, 801 insertions(+), 70 deletions(-)

create mode 100644 include/hw/misc/unimp.h

create mode 100644 include/hw/watchdog/wdt_aspeed.h

create mode 100644 hw/misc/unimp.c

create mode 100644 hw/watchdog/wdt_aspeed.c

From: Prasad J Pandit <pjp@fedoraproject.org>

While doing multi block SDMA transfer in routine

'sdhci_sdma_transfer_multi_blocks', the 's->fifo_buffer' starting

index 'begin' and data length 's->data_count' could end up to be same.

This could lead to an OOB access issue. Correct transfer data length

to avoid it.

Reported-by: Jiang Xin <jiangxin1@huawei.com>

Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>

hw/sd/sdhci.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c

--- a/hw/sd/sdhci.c

+++ b/hw/sd/sdhci.c

@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)

boundary_count -= block_size - begin;

}

dma_memory_read(&address_space_memory, s->sdmasysad,

- &s->fifo_buffer[begin], s->data_count);

+ &s->fifo_buffer[begin], s->data_count - begin);

s->sdmasysad += s->data_count - begin;

if (s->data_count == block_size) {

for (n = 0; n < block_size; n++) {

2.7.4

From: Julian Brown <julian@codesourcery.com>

Thumb-1 code has some issues in BE32 mode (as currently implemented). In

short, since bytes are swapped within words at load time for BE32

executables, this also swaps pairs of adjacent Thumb-1 instructions.

This patch un-swaps those pairs of instructions again, both for execution,

and for disassembly. (The previous version of the patch always read four

bytes in arm_read_memory_func and then extracted the proper two bytes,

in a probably misguided attempt to match the behaviour of actual hardware

as described by e.g. the ARM9TDMI TRM, section 3.3 "Endian effects for

instruction fetches". It's less complicated to just read the correct

two bytes though.)

Signed-off-by: Julian Brown <julian@codesourcery.com>

Message-id: ca20462a044848000370318a8bd41dd0a4ed273f.1484929304.git.julian@codesourcery.com

include/disas/bfd.h | 7 +++++++

target/arm/arm_ldst.h | 10 +++++++++-

disas.c | 1 +

target/arm/cpu.c | 23 +++++++++++++++++++++++

4 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/include/disas/bfd.h b/include/disas/bfd.h

--- a/include/disas/bfd.h

+++ b/include/disas/bfd.h

@@ -XXX,XX +XXX,XX @@ typedef struct disassemble_info {

The bottom 16 bits are for the internal use of the disassembler. */

unsigned long flags;

#define INSN_HAS_RELOC    0x80000000

+#define INSN_ARM_BE32    0x00010000

PTR private_data;

/* Function used to get bytes to disassemble. MEMADDR is the

@@ -XXX,XX +XXX,XX @@ typedef struct disassemble_info {

(bfd_vma memaddr, bfd_byte *myaddr, int length,

     struct disassemble_info *info);

+ /* A place to stash the real read_memory_func if read_memory_func wants to

+ do some funky address arithmetic or similar (e.g. for ARM BE32 mode). */

+ int (*read_memory_inner_func)

+ (bfd_vma memaddr, bfd_byte *myaddr, int length,

+ struct disassemble_info *info);

+

/* Function which should be called if we get an error that we can't

recover from. STATUS is the errno value from read_memory_func and

MEMADDR is the address that we were trying to read. INFO is a

diff --git a/target/arm/arm_ldst.h b/target/arm/arm_ldst.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/arm_ldst.h

+++ b/target/arm/arm_ldst.h

@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_ldl_code(CPUARMState *env, target_ulong addr,

static inline uint16_t arm_lduw_code(CPUARMState *env, target_ulong addr,

bool sctlr_b)

{

- uint16_t insn = cpu_lduw_code(env, addr);

+ uint16_t insn;

+#ifndef CONFIG_USER_ONLY

+ /* In big-endian (BE32) mode, adjacent Thumb instructions have been swapped

+ within each word. Undo that now. */

+ if (sctlr_b) {

+ addr ^= 2;

+ }

+#endif

+ insn = cpu_lduw_code(env, addr);

if (bswap_code(sctlr_b)) {

return bswap16(insn);

}

diff --git a/disas.c b/disas.c

index XXXXXXX..XXXXXXX 100644

--- a/disas.c

+++ b/disas.c

@@ -XXX,XX +XXX,XX @@ void target_disas(FILE *out, CPUState *cpu, target_ulong code,

s.cpu = cpu;

s.info.read_memory_func = target_read_memory;

+ s.info.read_memory_inner_func = NULL;

s.info.buffer_vma = code;

s.info.buffer_length = size;

s.info.print_address_func = generic_print_address;

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ print_insn_thumb1(bfd_vma pc, disassemble_info *info)

return print_insn_arm(pc | 1, info);

}

+static int arm_read_memory_func(bfd_vma memaddr, bfd_byte *b,

+ int length, struct disassemble_info *info)

+{

+ assert(info->read_memory_inner_func);

+ assert((info->flags & INSN_ARM_BE32) == 0 || length == 2 || length == 4);

+

+ if ((info->flags & INSN_ARM_BE32) != 0 && length == 2) {

+ assert(info->endian == BFD_ENDIAN_LITTLE);

+ return info->read_memory_inner_func(memaddr ^ 2, (bfd_byte *)b, 2,

+ info);

+ } else {

+ return info->read_memory_inner_func(memaddr, b, length, info);

+ }

+}

+

static void arm_disas_set_info(CPUState *cpu, disassemble_info *info)

{

ARMCPU *ac = ARM_CPU(cpu);

@@ -XXX,XX +XXX,XX @@ static void arm_disas_set_info(CPUState *cpu, disassemble_info *info)

info->endian = BFD_ENDIAN_BIG;

#endif

}

+ if (info->read_memory_inner_func == NULL) {

+ info->read_memory_inner_func = info->read_memory_func;

+ info->read_memory_func = arm_read_memory_func;

+ }

+ info->flags &= ~INSN_ARM_BE32;

+ if (arm_sctlr_b(env)) {

+ info->flags |= INSN_ARM_BE32;

+ }

}

static void arm_cpu_initfn(Object *obj)

2.7.4

From: Julian Brown <julian@codesourcery.com>

Since the integratorcp board creates the CPU object directly

rather than via cpu_arm_init(), we have to call the CPU

class parse_features() method ourselves if we want to

support the user passing features via the -cpu command

line argument as well as just the cpu name. Do so.

Signed-off-by: Julian Brown <julian@codesourcery.com>

[PMM: split out into its own patch]

hw/arm/integratorcp.c | 19 +++++++++++++++++--

1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c

--- a/hw/arm/integratorcp.c

+++ b/hw/arm/integratorcp.c

@@ -XXX,XX +XXX,XX @@ static void integratorcp_init(MachineState *machine)

const char *kernel_filename = machine->kernel_filename;

const char *kernel_cmdline = machine->kernel_cmdline;

const char *initrd_filename = machine->initrd_filename;

+ char **cpustr;

ObjectClass *cpu_oc;

+ CPUClass *cc;

Object *cpuobj;

ARMCPU *cpu;

+ const char *typename;

MemoryRegion *address_space_mem = get_system_memory();

MemoryRegion *ram = g_new(MemoryRegion, 1);

MemoryRegion *ram_alias = g_new(MemoryRegion, 1);

qemu_irq pic[32];

DeviceState *dev, *sic, *icp;

int i;

+ Error *err = NULL;

if (!cpu_model) {

cpu_model = "arm926";

- cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, cpu_model);

+ cpustr = g_strsplit(cpu_model, ",", 2);

+

+ cpu_oc = cpu_class_by_name(TYPE_ARM_CPU, cpustr[0]);

if (!cpu_oc) {

fprintf(stderr, "Unable to find CPU definition\n");

exit(1);

}

+ typename = object_class_get_name(cpu_oc);

+

+ cc = CPU_CLASS(cpu_oc);

+ cc->parse_features(typename, cpustr[1], &err);

+ g_strfreev(cpustr);

+ if (err) {

+ error_report_err(err);

+ exit(1);

+ }

- cpuobj = object_new(object_class_get_name(cpu_oc));

+ cpuobj = object_new(typename);

/* By default ARM1176 CPUs have EL3 enabled. This board does not

* currently support EL3 so the CPU EL3 property is disabled before

2.7.4

From: Cédric Le Goater <clg@kaod.org>

The Aspeed SoC includes a set of watchdog timers using 32-bit

decrement counters, which can be based either on the APB clock or

a 1 MHz clock.

The watchdog timer is designed to prevent system deadlock and, in

general, it should be restarted before timeout. When a timeout occurs,

different types of signals can be generated, ARM reset, SOC reset,

System reset, CPU Interrupt, external signal or boot from alternate

block. The current model only performs the system reset function as

this is used by U-Boot and Linux.

Signed-off-by: Joel Stanley <joel@jms.id.au>

Message-id: 1485452251-1593-2-git-send-email-clg@kaod.org

[clg: - fixed compile breakage

- fixed io region size

- added watchdog_perform_action() on timer expiry

- wrote a commit log

- merged fixes from Andrew Jeffery to scale the reload value ]

Signed-off-by: Cédric Le Goater <clg@kaod.org>

hw/watchdog/Makefile.objs | 1 +

include/hw/watchdog/wdt_aspeed.h | 32 ++++++

hw/watchdog/wdt_aspeed.c | 225 +++++++++++++++++++++++++++++++++++++++

3 files changed, 258 insertions(+)

create mode 100644 include/hw/watchdog/wdt_aspeed.h

create mode 100644 hw/watchdog/wdt_aspeed.c

diff --git a/hw/watchdog/Makefile.objs b/hw/watchdog/Makefile.objs

--- a/hw/watchdog/Makefile.objs

+++ b/hw/watchdog/Makefile.objs

@@ -XXX,XX +XXX,XX @@ common-obj-y += watchdog.o

common-obj-$(CONFIG_WDT_IB6300ESB) += wdt_i6300esb.o

common-obj-$(CONFIG_WDT_IB700) += wdt_ib700.o

common-obj-$(CONFIG_WDT_DIAG288) += wdt_diag288.o

+common-obj-$(CONFIG_ASPEED_SOC) += wdt_aspeed.o

diff --git a/include/hw/watchdog/wdt_aspeed.h b/include/hw/watchdog/wdt_aspeed.h

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/include/hw/watchdog/wdt_aspeed.h

@@ -XXX,XX +XXX,XX @@

+/*

+ * ASPEED Watchdog Controller

+ *

+ * Copyright (C) 2016-2017 IBM Corp.

+ *

+ * This code is licensed under the GPL version 2 or later. See the

+ * COPYING file in the top-level directory.

+ */

+#ifndef ASPEED_WDT_H

+#define ASPEED_WDT_H

+

+#include "hw/sysbus.h"

+

+#define TYPE_ASPEED_WDT "aspeed.wdt"

+#define ASPEED_WDT(obj) \

+ OBJECT_CHECK(AspeedWDTState, (obj), TYPE_ASPEED_WDT)

+

+#define ASPEED_WDT_REGS_MAX (0x20 / 4)

+

+typedef struct AspeedWDTState {

+ /*< private >*/

+ SysBusDevice parent_obj;

+ QEMUTimer *timer;

+

+ /*< public >*/

+ MemoryRegion iomem;

+ uint32_t regs[ASPEED_WDT_REGS_MAX];

+

+ uint32_t pclk_freq;

+} AspeedWDTState;

+

+#endif /* ASPEED_WDT_H */

diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/hw/watchdog/wdt_aspeed.c

@@ -XXX,XX +XXX,XX @@

+/*

+ * ASPEED Watchdog Controller

+ *

+ * Copyright (C) 2016-2017 IBM Corp.

+ *

+ * This code is licensed under the GPL version 2 or later. See the

+ * COPYING file in the top-level directory.

+ */

+

+#include "qemu/osdep.h"

+#include "qemu/log.h"

+#include "sysemu/watchdog.h"

+#include "hw/sysbus.h"

+#include "qemu/timer.h"

+#include "hw/watchdog/wdt_aspeed.h"

+

+#define WDT_STATUS (0x00 / 4)

+#define WDT_RELOAD_VALUE (0x04 / 4)

+#define WDT_RESTART (0x08 / 4)

+#define WDT_CTRL (0x0C / 4)

+#define WDT_CTRL_RESET_MODE_SOC (0x00 << 5)

+#define WDT_CTRL_RESET_MODE_FULL_CHIP (0x01 << 5)

+#define WDT_CTRL_1MHZ_CLK BIT(4)

+#define WDT_CTRL_WDT_EXT BIT(3)

+#define WDT_CTRL_WDT_INTR BIT(2)

+#define WDT_CTRL_RESET_SYSTEM BIT(1)

+#define WDT_CTRL_ENABLE BIT(0)

+

+#define WDT_TIMEOUT_STATUS (0x10 / 4)

+#define WDT_TIMEOUT_CLEAR (0x14 / 4)

+#define WDT_RESET_WDITH (0x18 / 4)

+

+#define WDT_RESTART_MAGIC 0x4755

+

+static bool aspeed_wdt_is_enabled(const AspeedWDTState *s)

+{

+ return s->regs[WDT_CTRL] & WDT_CTRL_ENABLE;

+}

+

+static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)

+{

+ AspeedWDTState *s = ASPEED_WDT(opaque);

+

+ offset >>= 2;

+

+ switch (offset) {

+ case WDT_STATUS:

+ return s->regs[WDT_STATUS];

+ case WDT_RELOAD_VALUE:

+ return s->regs[WDT_RELOAD_VALUE];

+ case WDT_RESTART:

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: read from write-only reg at offset 0x%"

+ HWADDR_PRIx "\n", __func__, offset);

+ return 0;

+ case WDT_CTRL:

+ return s->regs[WDT_CTRL];

+ case WDT_TIMEOUT_STATUS:

+ case WDT_TIMEOUT_CLEAR:

+ case WDT_RESET_WDITH:

+ qemu_log_mask(LOG_UNIMP,

+ "%s: uninmplemented read at offset 0x%" HWADDR_PRIx "\n",

+ __func__, offset);

+ return 0;

+ default:

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",

+ __func__, offset);

+ return 0;

+ }

+

+}

+

+static void aspeed_wdt_reload(AspeedWDTState *s, bool pclk)

+{

+ uint32_t reload;

+

+ if (pclk) {

+ reload = muldiv64(s->regs[WDT_RELOAD_VALUE], NANOSECONDS_PER_SECOND,

+ s->pclk_freq);

+ } else {

+ reload = s->regs[WDT_RELOAD_VALUE] * 1000;

+ }

+

+ if (aspeed_wdt_is_enabled(s)) {

+ timer_mod(s->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + reload);

+ }

+}

+

+static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,

+ unsigned size)

+{

+ AspeedWDTState *s = ASPEED_WDT(opaque);

+ bool enable = data & WDT_CTRL_ENABLE;

+

+ offset >>= 2;

+

+ switch (offset) {

+ case WDT_STATUS:

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: write to read-only reg at offset 0x%"

+ HWADDR_PRIx "\n", __func__, offset);

+ break;

+ case WDT_RELOAD_VALUE:

+ s->regs[WDT_RELOAD_VALUE] = data;

+ break;

+ case WDT_RESTART:

+ if ((data & 0xFFFF) == WDT_RESTART_MAGIC) {

+ s->regs[WDT_STATUS] = s->regs[WDT_RELOAD_VALUE];

+ aspeed_wdt_reload(s, !(data & WDT_CTRL_1MHZ_CLK));

+ }

+ break;

+ case WDT_CTRL:

+ if (enable && !aspeed_wdt_is_enabled(s)) {

+ s->regs[WDT_CTRL] = data;

+ aspeed_wdt_reload(s, !(data & WDT_CTRL_1MHZ_CLK));

+ } else if (!enable && aspeed_wdt_is_enabled(s)) {

+ s->regs[WDT_CTRL] = data;

+ timer_del(s->timer);

+ }

+ break;

+ case WDT_TIMEOUT_STATUS:

+ case WDT_TIMEOUT_CLEAR:

+ case WDT_RESET_WDITH:

+ qemu_log_mask(LOG_UNIMP,

+ "%s: uninmplemented write at offset 0x%" HWADDR_PRIx "\n",

+ __func__, offset);

+ break;

+ default:

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",

+ __func__, offset);

+ }

+ return;

+}

+

+static WatchdogTimerModel model = {

+ .wdt_name = TYPE_ASPEED_WDT,

+ .wdt_description = "Aspeed watchdog device",

+};

+

+static const VMStateDescription vmstate_aspeed_wdt = {

+ .name = "vmstate_aspeed_wdt",

+ .version_id = 0,

+ .minimum_version_id = 0,

+ .fields = (VMStateField[]) {

+ VMSTATE_TIMER_PTR(timer, AspeedWDTState),

+ VMSTATE_UINT32_ARRAY(regs, AspeedWDTState, ASPEED_WDT_REGS_MAX),

+ VMSTATE_END_OF_LIST()

+ }

+};

+

+static const MemoryRegionOps aspeed_wdt_ops = {

+ .read = aspeed_wdt_read,

+ .write = aspeed_wdt_write,

+ .endianness = DEVICE_LITTLE_ENDIAN,

+ .valid.min_access_size = 4,

+ .valid.max_access_size = 4,

+ .valid.unaligned = false,

+};

+

+static void aspeed_wdt_reset(DeviceState *dev)

+{

+ AspeedWDTState *s = ASPEED_WDT(dev);

+

+ s->regs[WDT_STATUS] = 0x3EF1480;

+ s->regs[WDT_RELOAD_VALUE] = 0x03EF1480;

+ s->regs[WDT_RESTART] = 0;

+ s->regs[WDT_CTRL] = 0;

+

+ timer_del(s->timer);

+}

+

+static void aspeed_wdt_timer_expired(void *dev)

+{

+ AspeedWDTState *s = ASPEED_WDT(dev);

+

+ qemu_log_mask(CPU_LOG_RESET, "Watchdog timer expired.\n");

+ watchdog_perform_action();

+ timer_del(s->timer);

+}

+

+#define PCLK_HZ 24000000

+

+static void aspeed_wdt_realize(DeviceState *dev, Error **errp)

+{

+ SysBusDevice *sbd = SYS_BUS_DEVICE(dev);

+ AspeedWDTState *s = ASPEED_WDT(dev);

+

+ s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, aspeed_wdt_timer_expired, dev);

+

+ /* FIXME: This setting should be derived from the SCU hw strapping

+ * register SCU70

+ */

+ s->pclk_freq = PCLK_HZ;

+

+ memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_wdt_ops, s,

+ TYPE_ASPEED_WDT, ASPEED_WDT_REGS_MAX * 4);

+ sysbus_init_mmio(sbd, &s->iomem);

+}

+

+static void aspeed_wdt_class_init(ObjectClass *klass, void *data)

+{

+ DeviceClass *dc = DEVICE_CLASS(klass);

+

+ dc->realize = aspeed_wdt_realize;

+ dc->reset = aspeed_wdt_reset;

+ set_bit(DEVICE_CATEGORY_MISC, dc->categories);

+ dc->vmsd = &vmstate_aspeed_wdt;

+}

+

+static const TypeInfo aspeed_wdt_info = {

+ .parent = TYPE_SYS_BUS_DEVICE,

+ .name = TYPE_ASPEED_WDT,

+ .instance_size = sizeof(AspeedWDTState),

+ .class_init = aspeed_wdt_class_init,

+};

+

+static void wdt_aspeed_register_types(void)

+{

+ watchdog_add_model(&model);

+ type_register_static(&aspeed_wdt_info);

+}

+

+type_init(wdt_aspeed_register_types)