ARM queue: nothing particularly exciting, but 18 patches

is enough to send out.

The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914

for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:

mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)

* v7M: various code cleanups

* v7M: set correct BFSR bits on bus fault

* v7M: clear exclusive monitor on reset and exception entry/exit

* v7M: don't apply priority mask to negative priorities

* zcu102: support 'secure' and 'virtualization' machine properties

* aarch64: fix ERET single stepping

* gpex: implement PCI INTx routing

* mps2-an511: fix UART overflow interrupt line wiring

Alistair Francis (5):

xlnx-ep108: Rename to ZCU102

xlnx-zcu102: Manually create the machines

xlnx-zcu102: Add a machine level secure property

xlnx-zcu102: Add a machine level virtualization property

xlnx-zcu102: Mark the EP108 machine as deprecated

Jaroslaw Pelczar (1):

AArch64: Fix single stepping of ERET instruction

Peter Maydell (8):

target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2

target/arm: Clear exclusive monitor on v7M reset, exception entry/exit

target/arm: Get PRECISERR and IBUSERR the right way round

nvic: Don't apply group priority mask to negative priorities

target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()

target/arm: Add and use defines for EXCRET constants

target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()

mps2-an511: Fix wiring of UART overflow interrupt lines

Pranavkumar Sawargaonkar (3):

hw/pci-host/gpex: Set INTx index/gsi mapping

hw/arm/virt: Set INTx/gsi mapping

hw/pci-host/gpex: Implement PCI INTx routing

Richard Henderson (1):

target/arm: Avoid an extra temporary for store_exclusive

hw/arm/Makefile.objs | 2 +-

include/hw/arm/xlnx-zynqmp.h | 2 +

include/hw/pci-host/gpex.h | 3 +

target/arm/cpu.h | 35 +++---

target/arm/internals.h | 20 ++++

hw/arm/mps2.c | 4 +-

hw/arm/virt.c | 1 +

hw/arm/xlnx-ep108.c | 139 -----------------------

hw/arm/xlnx-zcu102.c | 259 +++++++++++++++++++++++++++++++++++++++++++

hw/arm/xlnx-zynqmp.c | 3 +-

hw/intc/armv7m_nvic.c | 11 +-

hw/pci-host/gpex.c | 22 ++++

target/arm/cpu.c | 6 +

target/arm/helper.c | 43 ++++---

target/arm/op_helper.c | 2 +-

target/arm/translate-a64.c | 27 ++---

16 files changed, 382 insertions(+), 197 deletions(-)

delete mode 100644 hw/arm/xlnx-ep108.c

create mode 100644 hw/arm/xlnx-zcu102.c

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Let's provide the GPEX host bridge with the INTx/gsi mapping. This is

needed for INTx/gsi routing.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Andrew Jones <drjones@redhat.com>

Tested-by: Feng Kan <fkan@apm.com>

Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com

hw/arm/virt.c | 1 +

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)

for (i = 0; i < GPEX_NUM_IRQS; i++) {

sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);

+ gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);

}

pci = PCI_HOST_BRIDGE(dev);

2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

To implement INTx to gsi routing we need to pass the gpex host

bridge the gsi associated to each INTx index. Let's introduce

irq_num array and gpex_set_irq_num setter function.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Feng Kan <fkan@apm.com>

Reviewed-by: Andrew Jones <drjones@redhat.com>

Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com

include/hw/pci-host/gpex.h | 3 +++

hw/pci-host/gpex.c | 10 ++++++++++

2 files changed, 13 insertions(+)

diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h

--- a/include/hw/pci-host/gpex.h

+++ b/include/hw/pci-host/gpex.h

@@ -XXX,XX +XXX,XX @@ typedef struct GPEXHost {

MemoryRegion io_ioport;

MemoryRegion io_mmio;

qemu_irq irq[GPEX_NUM_IRQS];

+ int irq_num[GPEX_NUM_IRQS];

} GPEXHost;

+int gpex_set_irq_num(GPEXHost *s, int index, int gsi);

+

#endif /* HW_GPEX_H */

diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c

--- a/hw/pci-host/gpex.c

+++ b/hw/pci-host/gpex.c

@@ -XXX,XX +XXX,XX @@ static void gpex_set_irq(void *opaque, int irq_num, int level)

qemu_set_irq(s->irq[irq_num], level);

+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)

+{

+ if (index >= GPEX_NUM_IRQS) {

+ return -EINVAL;

+ }

+

+ s->irq_num[index] = gsi;

+ return 0;

+}

+

static void gpex_host_realize(DeviceState *dev, Error **errp)

{

PCIHostState *pci = PCI_HOST_BRIDGE(dev);

2.7.4

For a bus fault, the M profile BFSR bit PRECISERR means a bus

fault on a data access, and IBUSERR means a bus fault on an

instruction access. We had these the wrong way around; fix this.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org

target/arm/helper.c | 8 ++++----

1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)

case 0x8: /* External Abort */

switch (cs->exception_index) {

case EXCP_PREFETCH_ABORT:

- env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK;

- qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");

+ env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;

+ qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");

break;

case EXCP_DATA_ABORT:

env->v7m.cfsr[M_REG_NS] |=

- (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);

+ (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);

env->v7m.bfar = env->exception.vaddress;

qemu_log_mask(CPU_LOG_INT,

- "...with CFSR.IBUSERR and BFAR 0x%x\n",

+ "...with CFSR.PRECISERR and BFAR 0x%x\n",

env->v7m.bfar);

break;

}

2.7.4

Fix an error that meant we were wiring every UART's overflow

interrupts into the same inputs 0 and 1 of the OR gate,

rather than giving each its own input.

Cc: qemu-stable@nongnu.org

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>

Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org

hw/arm/mps2.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c

--- a/hw/arm/mps2.c

+++ b/hw/arm/mps2.c

@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)

cmsdk_apb_uart_create(uartbase[i],

qdev_get_gpio_in(txrx_orgate_dev, 0),

qdev_get_gpio_in(txrx_orgate_dev, 1),

- qdev_get_gpio_in(orgate_dev, 0),

- qdev_get_gpio_in(orgate_dev, 1),

+ qdev_get_gpio_in(orgate_dev, i * 2),

+ qdev_get_gpio_in(orgate_dev, i * 2 + 1),

NULL,

uartchr, SYSCLK_FRQ);

}

2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Now we are able to retrieve the gsi from the INTx pin, let's

enable intx_to_irq routing. From that point on, irqfd becomes

usable along with INTx when assigning a PCIe device.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Andrew Jones <drjones@redhat.com>

Tested-by: Feng Kan <fkan@apm.com>

Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com

hw/pci-host/gpex.c | 12 ++++++++++++

1 file changed, 12 insertions(+)

diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c

--- a/hw/pci-host/gpex.c

+++ b/hw/pci-host/gpex.c

@@ -XXX,XX +XXX,XX @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi)

return 0;

}

+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)

+{

+ PCIINTxRoute route;

+ GPEXHost *s = opaque;

+

+ route.mode = PCI_INTX_ENABLED;

+ route.irq = s->irq_num[pin];

+

+ return route;

+}

+

static void gpex_host_realize(DeviceState *dev, Error **errp)

{

PCIHostState *pci = PCI_HOST_BRIDGE(dev);

@@ -XXX,XX +XXX,XX @@ static void gpex_host_realize(DeviceState *dev, Error **errp)

&s->io_ioport, 0, 4, TYPE_PCIE_BUS);

qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus));

+ pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);

qdev_init_nofail(DEVICE(&s->gpex_root));

}

2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Instead of copying addr to a local temp, reuse the value (which we

have just compared as equal) already saved in cpu_exclusive_addr.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>

Message-id: 20170908163859.29820-1-richard.henderson@linaro.org

target/arm/translate-a64.c | 26 +++++++++-----------------

1 file changed, 9 insertions(+), 17 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,

2.7.4

In several places we were unconditionally applying the

nvic_gprio_mask() to a priority value. This is incorrect

if the priority is one of the fixed negative priority

values (for NMI and HardFault), so don't do it.

This bug would have caused both NMI and HardFault to be

considered as the same priority and so NMI wouldn't

correctly preempt HardFault.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org

hw/intc/armv7m_nvic.c | 11 +++++++++--

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)

}

}

+ if (active_prio > 0) {

+ active_prio &= nvic_gprio_mask(s);

+ }

+

s->vectpending = pend_irq;

- s->exception_prio = active_prio & nvic_gprio_mask(s);

+ s->exception_prio = active_prio;

trace_nvic_recompute_state(s->vectpending, s->exception_prio);

}

@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)

assert(vec->enabled);

assert(vec->pending);

- pendgroupprio = vec->prio & nvic_gprio_mask(s);

+ pendgroupprio = vec->prio;

+ if (pendgroupprio > 0) {

+ pendgroupprio &= nvic_gprio_mask(s);

+ }

assert(pendgroupprio < running);

trace_nvic_acknowledge_irq(pending, vec->prio);

2.7.4

For M profile we must clear the exclusive monitor on reset, exception

entry and exception exit. We weren't doing any of these things; fix

this bug.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org

target/arm/internals.h | 10 ++++++++++

target/arm/cpu.c | 6 ++++++

target/arm/helper.c | 2 ++

target/arm/op_helper.c | 2 +-

4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h

--- a/target/arm/internals.h

+++ b/target/arm/internals.h

@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu);

#endif

/**

+ * arm_clear_exclusive: clear the exclusive monitor

+ * @env: CPU env

+ * Clear the CPU's exclusive monitor, like the guest CLREX instruction.

+ */

+static inline void arm_clear_exclusive(CPUARMState *env)

+{

+ env->exclusive_addr = -1;

+}

+/**

* ARMMMUFaultInfo: Information describing an ARM MMU Fault

* @s2addr: Address that caused a fault at stage 2

* @stage2: True if we faulted at stage 2

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)

env->regs[15] = 0xFFFF0000;

}

+ /* M profile requires that reset clears the exclusive monitor;

+ * A profile does not, but clearing it makes more sense than having it

+ * set with an exclusive access on address zero.

+ */

+ arm_clear_exclusive(env);

+

env->vfp.xregs[ARM_VFP_FPEXC] = 0;

#endif

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)

armv7m_nvic_acknowledge_irq(env->nvic);

switch_v7m_sp(env, 0);

+ arm_clear_exclusive(env);

/* Clear IT bits */

env->condexec_bits = 0;

env->regs[14] = lr;

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

}

/* Otherwise, we have a successful exception exit. */

+ arm_clear_exclusive(env);

qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");

2.7.4

In the v7M and v8M ARM ARM, the magic exception return values are

referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_*

constants to define bits within them. Rename the 'type' variable

which holds the exception return value in do_v7m_exception_exit()

to excret, making it clearer that it does hold an EXC_RETURN value.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org

target/arm/helper.c | 23 ++++++++++++-----------

1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)

static void do_v7m_exception_exit(ARMCPU *cpu)

{

CPUARMState *env = &cpu->env;

- uint32_t type;

+ uint32_t excret;

uint32_t xpsr;

bool ufault = false;

bool return_to_sp_process = false;

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

* the target value up between env->regs[15] and env->thumb in

* gen_bx(). Reconstitute it.

*/

- type = env->regs[15];

+ excret = env->regs[15];

if (env->thumb) {

- type |= 1;

+ excret |= 1;

qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32

" previous exception %d\n",

- type, env->v7m.exception);

+ excret, env->v7m.exception);

- if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {

+ if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {

qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "

- "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);

+ "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",

+ excret);

if (env->v7m.exception != ARMV7M_EXCP_NMI) {

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

* which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)

*/

if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {

- int es = type & R_V7M_EXCRET_ES_MASK;

+ int es = excret & R_V7M_EXCRET_ES_MASK;

if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {

env->v7m.faultmask[es] = 0;

}

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

g_assert_not_reached();

- switch (type & 0xf) {

+ switch (excret & 0xf) {

case 1: /* Return to Handler */

return_to_handler = true;

break;

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

*/

env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;

armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);

- v7m_exception_taken(cpu, type);

+ v7m_exception_taken(cpu, excret);

qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "

"stackframe: failed exception return integrity check\n");

return;

@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)

/* The restored xPSR exception field will be zero if we're

* resuming in Thread mode. If that doesn't match what the

- * exception return type specified then this is a UsageFault.

+ * exception return excret specified then this is a UsageFault.

*/

if (return_to_handler != arm_v7m_is_handler_mode(env)) {

/* Take an INVPC UsageFault by pushing the stack again. */

armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);

env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;

v7m_push_stack(cpu);

- v7m_exception_taken(cpu, type);

+ v7m_exception_taken(cpu, excret);

qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "

"failed exception return integrity check\n");

return;

2.7.4