Some more outstanding target-arm patches; nothing terribly

exciting. Mostly they're mine; I'm trying to reduce the

number of patches I still have in flight, so I've picked

out some of the reviewed patches from a couple of sets I've

sent out and will resend v2 versions of those sets with the

remaining patches with fixes for issues noted in review once

this is in master.

The following changes since commit adaec191bfb31e12d40af8ab1b869f5b40d61ee9:

Merge remote-tracking branch 'remotes/ehabkost/tags/machine-next-pull-request' into staging (2018-08-20 09:48:03 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180820

for you to fetch changes up to b85fad1588e812566f897f747e38da345a7016d6:

hw/dma/pl080: Remove hw_error() if DMA is enabled (2018-08-20 11:24:33 +0100)

* Fix crash on conditional instruction in an IT block

* docs/generic-loader: mention U-Boot and Intel HEX executable formats

* hw/intc/arm_gicv3_its: downgrade error_report to warn_report in kvm_arm_its_reset

* imx_serial: Generate interrupt on receive data ready if enabled

* Fix various minor bugs in AArch32 Hyp related coprocessor registers

* Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)

* Implement AArch32 ERET instruction

* hw/arm/virt: Add virt-3.1 machine type

* sdhci: add i.MX SD Stable Clock bit

* Remove now-obsolete MMIO request_ptr APIs

* hw/timer/m48t59: Move away from old_mmio accessors

* hw/watchdog/cmsdk_apb_watchdog: Implement CMSDK APB watchdog module

* nvic: Expose NMI line

* hw/dma/pl080: cleanups and new features required for use in MPS boards

Andrew Jones (1):

hw/arm/virt: Add virt-3.1 machine type

Hans-Erik Floryd (2):

imx_serial: Generate interrupt on receive data ready if enabled

sdhci: add i.MX SD Stable Clock bit

Jia He (1):

hw/intc/arm_gicv3_its: downgrade error_report to warn_report in kvm_arm_its_reset

Peter Maydell (19):

target/arm: Correct typo in HAMAIR1 regdef name

target/arm: Add missing .cp = 15 to HMAIR1 and HAMAIR1 regdefs

target/arm: Implement AArch32 HVBAR

target/arm: Implement AArch32 Hyp FARs

target/arm: Implement ESR_EL2/HSR for AArch32 and no-EL2

target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)

target/arm: Implement AArch32 ERET instruction

hw/ssi/xilinx_spips: Remove unneeded MMIO request_ptr code

memory: Remove MMIO request_ptr APIs

hw/misc: Remove mmio_interface device

hw/timer/m48t59: Move away from old_mmio accessors

hw/watchdog/cmsdk_apb_watchdog: Implement CMSDK APB watchdog module

nvic: Expose NMI line

hw/dma/pl080: Allow use as embedded-struct device

hw/dma/pl080: Support all three interrupt lines

hw/dma/pl080: Don't use CPU address space for DMA accesses

hw/dma/pl080: Provide device reset function

hw/dma/pl080: Correct bug in register address decode logic

hw/dma/pl080: Remove hw_error() if DMA is enabled

Roman Kapl (1):

target/arm: Fix crash on conditional instruction in an IT block

From: Roman Kapl <rka@sysgo.com>

If an instruction is conditional (like CBZ) and it is executed

conditionally (using the ITx instruction), a jump to an undefined

label is generated, and QEMU crashes.

CBZ in IT block is an UNPREDICTABLE behavior, but we should not

crash. Honouring the condition code is allowed by the spec in this

case (constrained unpredictable, ARMv8, section K1.1.7), and matches

what we do for other "UNPREDICTABLE inside an IT block" instructions.

Fix the 'skip on condition' code to create a new label only if it

does not already exist. Previously multiple labels were created, but

only the last one of them was set.

Signed-off-by: Roman Kapl <rka@sysgo.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180816120533.6587-1-rka@sysgo.com

[PMM: fixed ^ 1 being applied to wrong argument, fixed typo]

target/arm/translate.c | 35 +++++++++++++++++++++--------------

1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,

s->base.is_jmp = DISAS_UPDATE;

+/* Generate a label used for skipping this instruction */

+static void arm_gen_condlabel(DisasContext *s)

+ if (!s->condjmp) {

+ s->condlabel = gen_new_label();

+ s->condjmp = 1;

+/* Skip this instruction if the ARM condition is false */

+static void arm_skip_unless(DisasContext *s, uint32_t cond)

+ arm_gen_condlabel(s);

+ arm_gen_test_cc(cond ^ 1, s->condlabel);

static void disas_arm_insn(DisasContext *s, unsigned int insn)

unsigned int cond, val, op1, i, shift, rm, rs, rn, rd, sh;

@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)

if (cond != 0xe) {

/* if not always execute, we generate a conditional jump to

next instruction */

- s->condlabel = gen_new_label();

- arm_gen_test_cc(cond ^ 1, s->condlabel);

- s->condjmp = 1;

+ arm_skip_unless(s, cond);

}

if ((insn & 0x0f900000) == 0x03000000) {

if ((insn & (1 << 21)) == 0) {

@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)

/* Conditional branch. */

op = (insn >> 22) & 0xf;

/* Generate a conditional jump to next instruction. */

- s->condlabel = gen_new_label();

- arm_gen_test_cc(op ^ 1, s->condlabel);

- s->condjmp = 1;

+ arm_skip_unless(s, op);

/* offset[11:1] = insn[10:0] */

offset = (insn & 0x7ff) << 1;

@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)

case 1: case 3: case 9: case 11: /* czb */

rm = insn & 7;

tmp = load_reg(s, rm);

- s->condlabel = gen_new_label();

- s->condjmp = 1;

+ arm_gen_condlabel(s);

if (insn & (1 << 11))

tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, s->condlabel);

else

@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)

break;

}

/* generate a conditional jump to next instruction */

- s->condlabel = gen_new_label();

- arm_gen_test_cc(cond ^ 1, s->condlabel);

- s->condjmp = 1;

+ arm_skip_unless(s, cond);

/* jump to the offset */

val = (uint32_t)s->pc + 2;

@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

uint32_t cond = dc->condexec_cond;

if (cond != 0x0e) { /* Skip conditional when condition is AL. */

- dc->condlabel = gen_new_label();

- arm_gen_test_cc(cond ^ 1, dc->condlabel);

- dc->condjmp = 1;

+ arm_skip_unless(dc, cond);

}

}

2.18.0

From: Stefan Hajnoczi <stefanha@redhat.com>

The generic loader device supports the U-Boot and Intel HEX executable

formats in addition to the document raw and ELF formats. Reword the

documentation to include these formats and explain how various options

depend on the executable format.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Message-id: 20180816145554.9814-1-stefanha@redhat.com

docs/generic-loader.txt | 20 ++++++++++----------

1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/docs/generic-loader.txt b/docs/generic-loader.txt

--- a/docs/generic-loader.txt

+++ b/docs/generic-loader.txt

@@ -XXX,XX +XXX,XX @@ An example of setting CPU 0's PC to 0x8000 is:

Loading Files

-------------

-The loader device also allows files to be loaded into memory. It can load raw

-files and ELF executable files. Raw files are loaded verbatim. ELF executable

-files are loaded by an ELF loader. The syntax is shown below:

+The loader device also allows files to be loaded into memory. It can load ELF,

+U-Boot, and Intel HEX executable formats as well as raw images. The syntax is

+shown below:

-device loader,file=<file>[,addr=<addr>][,cpu-num=<cpu-num>][,force-raw=<raw>]

<file> - A file to be loaded into memory

- <addr> - The addr in memory that the file should be loaded. This is

- ignored if you are using an ELF (unless force-raw is true).

- This is required if you aren't loading an ELF.

+ <addr> - The memory address where the file should be loaded. This is

+ required for raw images and ignored for non-raw files.

<cpu-num> - This specifies the CPU that should be used. This is an

optional argument and will cause the CPU's PC to be set to

- where the image is stored or in the case of an ELF file to

- the value in the header. This option should only be used

- for the boot image.

+ the memory address where the raw file is loaded or the entry

+ point specified in the executable format header. This option

+ should only be used for the boot image.

This will also cause the image to be written to the specified

CPU's address space. If not specified, the default is CPU 0.

<force-raw> - Setting force-raw=on forces the file to be treated as a raw

- image. This can be used to load ELF files as if they were raw.

+ image. This can be used to load supported executable formats

+ as if they were raw.

All values are parsed using the standard QemuOps parsing. This allows the user

to specify any values in any format supported. By default the values

2.18.0

From: Jia He <hejianet@gmail.com>

In scripts/arch-run.bash of kvm-unit-tests, it will check the qemu

output log with:

if [ -z "$(echo "$errors" | grep -vi warning)" ]; then

Thus without the warning prefix, all of the test fail.

Since it is not unrecoverable error in kvm_arm_its_reset for

current implementation, downgrading the report from error to

warn makes sense.

Signed-off-by: Jia He <jia.he@hxt-semitech.com>

Message-id: 1531969910-32843-1-git-send-email-jia.he@hxt-semitech.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

hw/intc/arm_gicv3_its_kvm.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_reset(DeviceState *dev)

return;

}

- error_report("ITS KVM: full reset is not supported by the host kernel");

+ warn_report("ITS KVM: full reset is not supported by the host kernel");

if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,

GITS_CTLR)) {

2.18.0

From: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>

Generate an interrupt if USR2_RDR and UCR4_DREN are both set.

Signed-off-by: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>

Message-id: 1534341354-11956-1-git-send-email-hans-erik.floryd@rt-labs.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

include/hw/char/imx_serial.h | 1 +

hw/char/imx_serial.c | 3 ++-

2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h

--- a/include/hw/char/imx_serial.h

+++ b/include/hw/char/imx_serial.h

@@ -XXX,XX +XXX,XX @@

#define UCR2_RXEN (1<<1) /* Receiver enable */

#define UCR2_SRST (1<<0) /* Reset complete */

+#define UCR4_DREN BIT(0) /* Receive Data Ready interrupt enable */

#define UCR4_TCEN BIT(3) /* TX complete interrupt enable */

#define UTS1_TXEMPTY (1<<6)

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/char/imx_serial.c

+++ b/hw/char/imx_serial.c

@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)

mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;

/*

* TCEN and TXDC are both bit 3

+ * RDR and DREN are both bit 0

*/

- mask |= s->ucr4 & UCR4_TCEN;

+ mask |= s->ucr4 & (UCR4_TCEN | UCR4_DREN);

usr2 = s->usr2 & mask;

2.18.0

We implement the HAMAIR1 register as RAZ/WI; we had a typo in the

regdef, though, and were incorrectly naming it HMAIR1 (which is

a different register which we also implement as RAZ/WI).

target/arm/helper.c | 4 ++--

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {

.opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

- { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,

+ { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,

.opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

/* HAMAIR1 is mapped to AMAIR_EL2[63:32] */

- { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,

+ { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,

.opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

2.18.0

Implement the AArch32 HVBAR register; we can do this just by

making the existing VBAR_EL2 regdefs be STATE_BOTH.

target/arm/helper.c | 4 ++--

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {

/* Used to describe the behaviour of EL2 regs when EL2 does not exist. */

static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {

- { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,

+ { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,

.access = PL2_RW,

.readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {

.opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,

.access = PL2_RW,

.fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) },

- { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,

+ { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,

.access = PL2_RW, .writefn = vbar_write,

.fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),

2.18.0

The MSR (banked) and MRS (banked) instructions allow accesses to ELR_Hyp

from either Monitor or Hyp mode. Our translate time check

was overly strict and only permitted access from Monitor mode.

The runtime check we do in msr_mrs_banked_exc_checks() had the

correct code in it, but never got there because of the earlier

"currmode == tgtmode" check. Special case ELR_Hyp.

target/arm/op_helper.c | 22 +++++++++++-----------

target/arm/translate.c | 10 +++++++---

2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c

--- a/target/arm/op_helper.c

+++ b/target/arm/op_helper.c

@@ -XXX,XX +XXX,XX @@ static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,

*/

int curmode = env->uncached_cpsr & CPSR_M;

+ if (regno == 17) {

+ /* ELR_Hyp: a special case because access from tgtmode is OK */

+ if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {

+ goto undef;

+ }

+ return;

+ }

+

if (curmode == tgtmode) {

goto undef;

}

@@ -XXX,XX +XXX,XX @@ static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,

}

if (tgtmode == ARM_CPU_MODE_HYP) {

- switch (regno) {

- case 17: /* ELR_Hyp */

- if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {

- goto undef;

- }

- break;

- default:

- if (curmode != ARM_CPU_MODE_MON) {

- goto undef;

- }

- break;

+ /* SPSR_Hyp, r13_hyp: accessible from Monitor mode only */

+ if (curmode != ARM_CPU_MODE_MON) {

+ goto undef;

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,

case ARM_CPU_MODE_HYP:

- /* Note that we can forbid accesses from EL2 here because they

- * must be from Hyp mode itself

+ /*

+ * SPSR_hyp and r13_hyp can only be accessed from Monitor mode

+ * (and so we can forbid accesses from EL2 or below). elr_hyp

+ * can be accessed also from Hyp mode, so forbid accesses from

+ * EL0 or EL1.

*/

- if (!arm_dc_feature(s, ARM_FEATURE_EL2) || s->current_el < 3) {

+ if (!arm_dc_feature(s, ARM_FEATURE_EL2) || s->current_el < 2 ||

+ (s->current_el < 3 && *regno != 17)) {

goto undef;

2.18.0

From: Andrew Jones <drjones@redhat.com>

Signed-off-by: Andrew Jones <drjones@redhat.com>

Reviewed-by: Igor Mammedov <imammedo@redhat.com>

hw/arm/virt.c | 23 +++++++++++++++++------

1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void machvirt_machine_init(void)

}

type_init(machvirt_machine_init);

-#define VIRT_COMPAT_2_12 \

- HW_COMPAT_2_12

-

-static void virt_3_0_instance_init(Object *obj)

+static void virt_3_1_instance_init(Object *obj)

{

VirtMachineState *vms = VIRT_MACHINE(obj);

VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);

@@ -XXX,XX +XXX,XX @@ static void virt_3_0_instance_init(Object *obj)

vms->irqmap = a15irqmap;

}

-static void virt_machine_3_0_options(MachineClass *mc)

+static void virt_machine_3_1_options(MachineClass *mc)

{

}

-DEFINE_VIRT_MACHINE_AS_LATEST(3, 0)

+DEFINE_VIRT_MACHINE_AS_LATEST(3, 1)

+

+static void virt_3_0_instance_init(Object *obj)

+ virt_3_1_instance_init(obj);

+static void virt_machine_3_0_options(MachineClass *mc)

+{

+ virt_machine_3_1_options(mc);

+}

+DEFINE_VIRT_MACHINE(3, 0)

+

+#define VIRT_COMPAT_2_12 \

+ HW_COMPAT_2_12

static void virt_2_12_instance_init(Object *obj)

2.18.0

From: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>

Add the ESDHC PRSSTAT_SDSTB bit, using the value of SDHC_CLOCK_INT_STABLE.

Freescale recommends checking this bit when changing clock frequency.

Signed-off-by: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>

Message-id: 1534507843-4251-1-git-send-email-hans-erik.floryd@rt-labs.com

[PMM: fixed indentation]

hw/sd/sdhci-internal.h | 2 ++

hw/sd/sdhci.c | 8 ++++++++

2 files changed, 10 insertions(+)

diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h

--- a/hw/sd/sdhci-internal.h

+++ b/hw/sd/sdhci-internal.h

@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription sdhci_vmstate;

#define ESDHC_CTRL_4BITBUS (0x1 << 1)

#define ESDHC_CTRL_8BITBUS (0x2 << 1)

+#define ESDHC_PRNSTS_SDSTB (1 << 3)

+

#endif

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/sd/sdhci.c

+++ b/hw/sd/sdhci.c

@@ -XXX,XX +XXX,XX @@ static uint64_t usdhc_read(void *opaque, hwaddr offset, unsigned size)