ARM queue for 2.10 soft freeze...

The following changes since commit 6632f6ff96f0537fc34cdc00c760656fc62e23c5:

Merge remote-tracking branch 'remotes/famz/tags/block-and-testing-pull-request' into staging (2017-07-17 11:46:36 +0100)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170717

for you to fetch changes up to e5a6a6e64e82a132cebef023d867085b0a2993d7:

MAINTAINERS: Add entries for MPS2 board (2017-07-17 13:36:09 +0100)

* new model of the ARM MPS2/MPS2+ FPGA based development board

* clean up DISAS_* exit conditions and fix various regressions

since commits e75449a346 8a6b28c7b5 (in particular including

ones which broke OP-TEE guests)

* make Cortex-M3 and M4 correctly default to 8 PMSA regions

Alex Bennée (6):

include/exec/exec-all: document common exit conditions

target/arm/translate: make DISAS_UPDATE match declared semantics

target/arm/translate.h: expand comment on DISAS_EXIT

target/arm/translate: ensure gen_goto_tb sets exit flags

target/arm: use gen_goto_tb for ISB handling

target/arm: use DISAS_EXIT for eret handling

qdev-properties.h: Explicitly set the default value for arraylen properties

qdev: support properties which don't set a default value

target/arm: Make Cortex-M3 and M4 default to 8 PMSA regions

hw/arm/mps2: Implement skeleton mps2-an385 and mps2-an511 board models

hw/char/cmsdk-apb-uart.c: Implement CMSDK APB UART

hw/arm/mps2: Add UARTs

hw/char/cmsdk-apb-timer: Implement CMSDK APB timer device

hw/arm/mps2: Add timers

hw/misc/mps2_scc: Implement MPS2 Serial Communication Controller

hw/arm/mps2: Add SCC

hw/arm/mps2: Add ethernet

MAINTAINERS: Add entries for MPS2 board

hw/arm/Makefile.objs | 1 +

hw/char/Makefile.objs | 1 +

hw/misc/Makefile.objs | 1 +

hw/timer/Makefile.objs | 1 +

include/exec/exec-all.h | 29 ++-

include/hw/char/cmsdk-apb-uart.h | 78 +++++++

include/hw/misc/mps2-scc.h | 43 ++++

include/hw/qdev-core.h | 10 +

include/hw/qdev-properties.h | 21 ++

include/hw/timer/cmsdk-apb-timer.h | 59 ++++++

target/arm/translate.h | 5 +-

hw/arm/mps2.c | 385 +++++++++++++++++++++++++++++++++++

hw/char/cmsdk-apb-uart.c | 403 +++++++++++++++++++++++++++++++++++++

hw/core/qdev.c | 2 +-

hw/misc/mps2-scc.c | 310 ++++++++++++++++++++++++++++

hw/timer/cmsdk-apb-timer.c | 253 +++++++++++++++++++++++

target/arm/cpu.c | 12 +-

target/arm/translate-a64.c | 19 +-

target/arm/translate.c | 22 +-

MAINTAINERS | 14 +-

default-configs/arm-softmmu.mak | 6 +

hw/char/trace-events | 9 +

hw/misc/trace-events | 8 +

hw/timer/trace-events | 5 +

24 files changed, 1673 insertions(+), 24 deletions(-)

create mode 100644 include/hw/char/cmsdk-apb-uart.h

create mode 100644 include/hw/misc/mps2-scc.h

create mode 100644 include/hw/timer/cmsdk-apb-timer.h

create mode 100644 hw/arm/mps2.c

create mode 100644 hw/char/cmsdk-apb-uart.c

create mode 100644 hw/misc/mps2-scc.c

create mode 100644 hw/timer/cmsdk-apb-timer.c

In DEFINE_PROP_ARRAY, because we use a PropertyInfo (qdev_prop_arraylen)

which has a .set_default_value member we will set the field to a default

value. That default value will be zero, by the C rule that struct

initialization sets unmentioned members to zero if at least one member

is initialized. However it's clearer to state it explicitly.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Message-id: 1499788408-10096-2-git-send-email-peter.maydell@linaro.org

include/hw/qdev-properties.h | 1 +

1 file changed, 1 insertion(+)

diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h

--- a/include/hw/qdev-properties.h

+++ b/include/hw/qdev-properties.h

@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_link;

_arrayfield, _arrayprop, _arraytype) { \

.name = (PROP_ARRAY_LEN_PREFIX _name), \

.info = &(qdev_prop_arraylen), \

+ .defval.u = 0, \

.offset = offsetof(_state, _field) \

+ type_check(uint32_t, typeof_field(_state, _field)), \

.arrayinfo = &(_arrayprop), \

In some situations it's useful to have a qdev property which doesn't

automatically set its default value when qdev_property_add_static is

called (for instance when the default value is not constant).

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Reviewed-by: Markus Armbruster <armbru@redhat.com>

Message-id: 1499788408-10096-3-git-send-email-peter.maydell@linaro.org

include/hw/qdev-core.h | 10 ++++++++++

include/hw/qdev-properties.h | 20 ++++++++++++++++++++

hw/core/qdev.c | 2 +-

3 files changed, 31 insertions(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ void qdev_property_add_static(DeviceState *dev, Property *prop,

prop->info->description,

&error_abort);

- if (prop->info->set_default_value) {

+ if (prop->set_default) {

prop->info->set_default_value(obj, prop);

}

The Cortex-M3 and M4 CPUs always have 8 PMSA MPU regions (this isn't

a configurable option for the hardware). Make the default value of

the pmsav7-dregion property be set per-cpu, so we don't need to have

every user of these CPUs set it manually. (The existing default of

16 is correct for the other PMSAv7 core, the Cortex-R5.)

This fixes a bug where we were creating the M3 and M4 with

too many regions; most guest software would not notice or

care, though, since it would just not use the registers

associated with the unexpected extra regions.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Message-id: 1499788408-10096-4-git-send-email-peter.maydell@linaro.org

target/arm/cpu.c | 12 +++++++++++-

1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_pmu_property =

static Property arm_cpu_has_mpu_property =

DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);

+/* This is like DEFINE_PROP_UINT32 but it doesn't set the default value,

+ * because the CPU initfn will have already set cpu->pmsav7_dregion to

+ * the right value for that particular CPU type, and we don't want

+ * to override that with an incorrect constant value.

+ */

static Property arm_cpu_pmsav7_dregion_property =

- DEFINE_PROP_UINT32("pmsav7-dregion", ARMCPU, pmsav7_dregion, 16);

+ DEFINE_PROP_UNSIGNED_NODEFAULT("pmsav7-dregion", ARMCPU,

+ pmsav7_dregion,

+ qdev_prop_uint32, uint32_t);

static void arm_cpu_post_init(Object *obj)

@@ -XXX,XX +XXX,XX @@ static void cortex_m3_initfn(Object *obj)

set_feature(&cpu->env, ARM_FEATURE_V7);

set_feature(&cpu->env, ARM_FEATURE_M);

cpu->midr = 0x410fc231;

+ cpu->pmsav7_dregion = 8;

static void cortex_m4_initfn(Object *obj)

@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)

set_feature(&cpu->env, ARM_FEATURE_M);

set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);

cpu->midr = 0x410fc240; /* r0p0 */

+ cpu->pmsav7_dregion = 8;

}

static void arm_v7m_class_init(ObjectClass *oc, void *data)

@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)

cpu->id_isar4 = 0x0010142;

cpu->id_isar5 = 0x0;

cpu->mp_is_up = true;

+ cpu->pmsav7_dregion = 16;

define_arm_cp_regs(cpu, cortexr5_cp_reginfo);

From: Alex Bennée <alex.bennee@linaro.org>

As a precursor to later patches attempt to come up with a more

concrete wording for what each of the common exit cases would be.

CC: Emilio G. Cota <cota@braap.org>

CC: Richard Henderson <rth@twiddle.net>

CC: Lluís Vilanova <vilanova@ac.upc.edu>

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Richard Henderson <rth@twiddle.net>

Message-id: 20170713141928.25419-2-alex.bennee@linaro.org

include/exec/exec-all.h | 29 ++++++++++++++++++++++++++---

1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h

--- a/include/exec/exec-all.h

+++ b/include/exec/exec-all.h

@@ -XXX,XX +XXX,XX @@ typedef abi_ulong tb_page_addr_t;

typedef ram_addr_t tb_page_addr_t;

#endif

-/* is_jmp field values */

+/* DisasContext is_jmp field values

+ *

+ * is_jmp starts as DISAS_NEXT. The translator will keep processing

+ * instructions until an exit condition is reached. If we reach the

+ * exit condition and is_jmp is still DISAS_NEXT (because of some

+ * other condition) we simply "jump" to the next address.

+ * The remaining exit cases are:

+ *

+ * DISAS_JUMP - Only the PC was modified dynamically (e.g computed)

+ * DISAS_TB_JUMP - Only the PC was modified statically (e.g. branch)

+ *

+ * In these cases as long as the PC is updated we can chain to the

+ * next TB either by exiting the loop or looking up the next TB via

+ * the loookup helper.

+ *

+ * DISAS_UPDATE - CPU State was modified dynamically

+ *

+ * This covers any other CPU state which necessities us exiting the

+ * TCG code to the main run-loop. Typically this includes anything

+ * that might change the interrupt state.

+ *

+ * Individual translators may define additional exit cases to deal

+ * with per-target special conditions.

+ */

#define DISAS_NEXT 0 /* next instruction can be analyzed */

#define DISAS_JUMP 1 /* only pc was modified dynamically */

-#define DISAS_UPDATE 2 /* cpu state was modified dynamically */

-#define DISAS_TB_JUMP 3 /* only pc was modified statically */

+#define DISAS_TB_JUMP 2 /* only pc was modified statically */

+#define DISAS_UPDATE 3 /* cpu state was modified dynamically */

#include "qemu/log.h"

From: Alex Bennée <alex.bennee@linaro.org>

DISAS_UPDATE should be used when the wider CPU state other than just

the PC has been updated and we should therefore exit the TCG runtime

and return to the main execution loop rather assuming DISAS_JUMP would

do that.

target/arm/translate-a64.c | 14 +++++++-------

target/arm/translate.c | 6 +++---

2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code_a64(ARMCPU *cpu, TranslationBlock *tb)

case DISAS_NEXT:

gen_goto_tb(dc, 1, dc->pc);

break;

- default:

- case DISAS_UPDATE:

- gen_a64_set_pc_im(dc->pc);

- /* fall through */

case DISAS_JUMP:

tcg_gen_lookup_and_goto_ptr(cpu_pc);

break;

- case DISAS_EXIT:

- tcg_gen_exit_tb(0);

- break;

case DISAS_TB_JUMP:

case DISAS_EXC:

case DISAS_SWI:

@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code_a64(ARMCPU *cpu, TranslationBlock *tb)

*/

tcg_gen_exit_tb(0);

break;

+ case DISAS_UPDATE:

+ gen_a64_set_pc_im(dc->pc);

+ /* fall through */

+ case DISAS_EXIT:

+ default:

+ tcg_gen_exit_tb(0);

+ break;

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)

case DISAS_NEXT:

gen_goto_tb(dc, 1, dc->pc);

break;

- case DISAS_UPDATE:

- gen_set_pc_im(dc, dc->pc);

- /* fall through */

case DISAS_JUMP:

gen_goto_ptr();

break;

+ case DISAS_UPDATE:

+ gen_set_pc_im(dc, dc->pc);

+ /* fall through */

default:

/* indicate that the hash table must be used to find the next TB */

tcg_gen_exit_tb(0);

From: Alex Bennée <alex.bennee@linaro.org>

We already have an exit condition, DISAS_UPDATE which will exit the

run-loop. Expand on the difference with DISAS_EXIT in the comments.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Richard Henderson <rth@twiddle.net>

Message-id: 20170713141928.25419-4-alex.bennee@linaro.org

target/arm/translate.h | 5 ++++-

1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h

--- a/target/arm/translate.h

+++ b/target/arm/translate.h

@@ -XXX,XX +XXX,XX @@ static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)

*/

#define DISAS_BX_EXCRET 11

/* For instructions which want an immediate exit to the main loop,

- * as opposed to attempting to use lookup_and_goto_ptr.

+ * as opposed to attempting to use lookup_and_goto_ptr. Unlike

+ * DISAS_UPDATE this doesn't write the PC on exiting the translation

+ * loop so you need to ensure something (gen_a64_set_pc_im or runtime

+ * helper) has done so before we reach return from cpu_tb_exec.

*/

#define DISAS_EXIT 12

From: Alex Bennée <alex.bennee@linaro.org>

As the gen_goto_tb function can do both static and dynamic jumps it

should also set the is_jmp field. This matches the behaviour of the

a64 code.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Richard Henderson <rth@twiddle.net>

Message-id: 20170713141928.25419-5-alex.bennee@linaro.org

[tweak to multiline comment formatting]

target/arm/translate.c | 6 +++++-

1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void gen_goto_ptr(void)

tcg_temp_free(addr);

}

+/* This will end the TB but doesn't guarantee we'll return to

+ * cpu_loop_exec. Any live exit_requests will be processed as we

+ * enter the next TB.

static void gen_goto_tb(DisasContext *s, int n, target_ulong dest)

{

if (use_goto_tb(s, dest)) {

@@ -XXX,XX +XXX,XX @@ static void gen_goto_tb(DisasContext *s, int n, target_ulong dest)

gen_set_pc_im(s, dest);

gen_goto_ptr();

}

+ s->is_jmp = DISAS_TB_JUMP;

}

static inline void gen_jmp (DisasContext *s, uint32_t dest)

@@ -XXX,XX +XXX,XX @@ static inline void gen_jmp (DisasContext *s, uint32_t dest)

gen_bx_im(s, dest);

} else {

gen_goto_tb(s, 0, dest);

- s->is_jmp = DISAS_TB_JUMP;

From: Alex Bennée <alex.bennee@linaro.org>

While an ISB will ensure any raised IRQs happen on the next

instruction it doesn't cause any to get raised by itself. We can

therefore use a simple tb exit for ISB instructions and rely on the

exit_request check at the top of each TB to deal with exiting if

needed.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Richard Henderson <rth@twiddle.net>

Message-id: 20170713141928.25419-6-alex.bennee@linaro.org

target/arm/translate-a64.c | 2 +-

target/arm/translate.c | 4 ++--

2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static void handle_sync(DisasContext *s, uint32_t insn,

* a self-modified code correctly and also to take

* any pending interrupts immediately.

*/

- s->is_jmp = DISAS_UPDATE;

+ gen_goto_tb(s, 0, s->pc);

return;

default:

unallocated_encoding(s);

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)

* self-modifying code correctly and also to take

* any pending interrupts immediately.

*/

- gen_lookup_tb(s);

+ gen_goto_tb(s, 0, s->pc & ~1);

return;

default:

goto illegal_op;

@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw

* and also to take any pending interrupts

* immediately.

*/

- gen_lookup_tb(s);

+ gen_goto_tb(s, 0, s->pc & ~1);

break;

default:

goto illegal_op;

From: Alex Bennée <alex.bennee@linaro.org>

Previously DISAS_JUMP did ensure this but with the optimisation of

8a6b28c7 (optimize indirect branches) we might not leave the loop.

This means if any pending interrupts are cleared by changing IRQ flags

we might never get around to servicing them. You usually notice this

by seeing the lookup_tb_ptr() helper gainfully chaining TBs together

while cpu->interrupt_request remains high and the exit_request has not

been set.

This breaks amongst other things the OPTEE test suite which executes

an eret from the secure world after a non-secure world IRQ has gone

pending which then never gets serviced.

Instead of using the previously implied semantics of DISAS_JUMP we use

DISAS_EXIT which will always exit the run-loop.

CC: Etienne Carriere <etienne.carriere@linaro.org>

CC: Joakim Bech <joakim.bech@linaro.org>

CC: Jaroslaw Pelczar <j.pelczar@samsung.com>

CC: Peter Maydell <peter.maydell@linaro.org>

CC: Emilio G. Cota <cota@braap.org>

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Richard Henderson <rth@twiddle.net>

Message-id: 20170713141928.25419-7-alex.bennee@linaro.org

target/arm/translate-a64.c | 3 ++-

target/arm/translate.c | 6 ++++--

2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)

return;

}

gen_helper_exception_return(cpu_env);

- s->is_jmp = DISAS_JUMP;

+ /* Must exit loop to check un-masked IRQs */

+ s->is_jmp = DISAS_EXIT;

return;

case 5: /* DRPS */

if (rn != 0x1f) {

diff --git a/target/arm/translate.c b/target/arm/translate.c