target-arm queue: mostly just cleanup/minor stuff, but this does

include the raspi3 board model.

The following changes since commit 9f9c53368b219a9115eddb39f0ff5ad19c977134:

Merge remote-tracking branch 'remotes/vivier/tags/m68k-for-2.12-pull-request' into staging (2018-02-15 10:14:11 +0000)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180215

for you to fetch changes up to e545f0f9be1f9e60951017c1e6558216732cc14e:

target/arm: Implement v8M MSPLIM and PSPLIM registers (2018-02-15 13:48:11 +0000)

* aspeed: code cleanup to use unimplemented_device

* add 'raspi3' RaspberryPi 3 machine model

* more SVE prep work

* v8M: add minor missing registers

* v7M: fix bug where we weren't migrating v7m.other_sp

* v7M: fix bugs in handling of interrupt registers for

external interrupts beyond 32

Pekka Enberg (3):

bcm2836: Make CPU type configurable

raspi: Raspberry Pi 3 support

raspi: Add "raspi3" machine type

Peter Maydell (11):

hw/intc/armv7m_nvic: Don't hardcode M profile ID registers in NVIC

hw/intc/armv7m_nvic: Fix ICSR PENDNMISET/CLR handling

hw/intc/armv7m_nvic: Implement M profile cache maintenance ops

hw/intc/armv7m_nvic: Implement v8M CPPWR register

hw/intc/armv7m_nvic: Implement cache ID registers

hw/intc/armv7m_nvic: Implement SCR

target/arm: Implement writing to CONTROL_NS for v8M

hw/intc/armv7m_nvic: Fix byte-to-interrupt number conversions

target/arm: Add AIRCR to vmstate struct

target/arm: Migrate v7m.other_sp

target/arm: Implement v8M MSPLIM and PSPLIM registers

Philippe Mathieu-Daudé (2):

hw/arm/aspeed: directly map the serial device to the system address space

hw/arm/aspeed: simplify using the 'unimplemented device' for aspeed_soc.io

Richard Henderson (5):

target/arm: Remove ARM_CP_64BIT from ZCR_EL registers

target/arm: Enforce FP access to FPCR/FPSR

target/arm: Suppress TB end for FPCR/FPSR

target/arm: Enforce access to ZCR_EL at translation

target/arm: Handle SVE registers when using clear_vec_high

include/hw/arm/aspeed_soc.h | 1 -

include/hw/arm/bcm2836.h | 1 +

target/arm/cpu.h | 71 ++++++++++++-----

target/arm/internals.h | 6 ++

hw/arm/aspeed_soc.c | 35 ++-------

hw/arm/bcm2836.c | 17 +++--

hw/arm/raspi.c | 57 +++++++++++---

hw/intc/armv7m_nvic.c | 98 ++++++++++++++++++------

target/arm/cpu.c | 28 +++++++

target/arm/helper.c | 84 +++++++++++++++-----

target/arm/machine.c | 84 ++++++++++++++++++++

target/arm/translate-a64.c | 181 ++++++++++++++++++++------------------------

12 files changed, 452 insertions(+), 211 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Nothing in either register affects the TB.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180211205848.4568-4-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/helper.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {

.writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },

{ .name = "FPCR", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,

- .access = PL0_RW, .type = ARM_CP_FPU,

+ .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,

.readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },

{ .name = "FPSR", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,

- .access = PL0_RW, .type = ARM_CP_FPU,

+ .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,

.readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },

{ .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,

2.16.1

Because they are ARM_CP_STATE_AA64, ARM_CP_64BIT is implied.

Message-id: 20180211205848.4568-2-richard.henderson@linaro.org

target/arm/helper.c | 8 ++++----

1 file changed, 4 insertions(+), 4 deletions(-)

@@ -XXX,XX +XXX,XX @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,

static const ARMCPRegInfo zcr_el1_reginfo = {

.name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,

- .access = PL1_RW, .accessfn = zcr_access, .type = ARM_CP_64BIT,

+ .access = PL1_RW, .accessfn = zcr_access,

.fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),

.writefn = zcr_write, .raw_writefn = raw_write

};

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_el1_reginfo = {

static const ARMCPRegInfo zcr_el2_reginfo = {

.name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,

- .access = PL2_RW, .accessfn = zcr_access, .type = ARM_CP_64BIT,

+ .access = PL2_RW, .accessfn = zcr_access,

.fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),

.writefn = zcr_write, .raw_writefn = raw_write

};

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_el2_reginfo = {

static const ARMCPRegInfo zcr_no_el2_reginfo = {

.name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,

- .access = PL2_RW, .type = ARM_CP_64BIT,

+ .access = PL2_RW,

.readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore

};

static const ARMCPRegInfo zcr_el3_reginfo = {

.name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,

- .access = PL3_RW, .accessfn = zcr_access, .type = ARM_CP_64BIT,

+ .access = PL3_RW, .accessfn = zcr_access,

.fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),

.writefn = zcr_write, .raw_writefn = raw_write

};

2.16.1

The Coprocessor Power Control Register (CPPWR) is new in v8M.

It allows software to control whether coprocessors are allowed

to power down and lose their state. QEMU doesn't have any

notion of power control, so we choose the IMPDEF option of

making the whole register RAZ/WI (indicating that no coprocessors

can ever power down and lose state).

Message-id: 20180209165810.6668-5-peter.maydell@linaro.org

hw/intc/armv7m_nvic.c | 14 ++++++++++++++

1 file changed, 14 insertions(+)

switch (offset) {

case 4: /* Interrupt Control Type. */

return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;

+ case 0xc: /* CPPWR */

+ if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {

+ goto bad_offset;

+ /* We make the IMPDEF choice that nothing can ever go into a

+ * non-retentive power state, which allows us to RAZ/WI this.

+ */

+ return 0;

case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */

{

int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;

ARMCPU *cpu = s->cpu;

switch (offset) {

+ case 0xc: /* CPPWR */

+ if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {

+ goto bad_offset;

+ }

+ /* Make the IMPDEF choice to RAZ/WI this. */

+ break;

case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */

{

int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;

2.16.1

In commit 50f11062d4c896 we added support for MSR/MRS access

to the NS banked special registers, but we forgot to implement

the support for writing to CONTROL_NS. Correct the omission.

Message-id: 20180209165810.6668-8-peter.maydell@linaro.org

target/arm/helper.c | 10 ++++++++++

1 file changed, 10 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)

}

env->v7m.faultmask[M_REG_NS] = val & 1;

return;

+ case 0x94: /* CONTROL_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ write_v7m_control_spsel_for_secstate(env,

+ val & R_V7M_CONTROL_SPSEL_MASK,

+ M_REG_NS);

+ env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK;

+ env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK;

+ return;

case 0x98: /* SP_NS */

{

/* This gives the non-secure SP selected based on whether we're

2.16.1

We were previously making the system control register (SCR)

just RAZ/WI. Although we don't implement the functionality

this register controls, we should at least provide the state,

including the banked state for v8M.

Message-id: 20180209165810.6668-7-peter.maydell@linaro.org

target/arm/cpu.h | 7 +++++++

hw/intc/armv7m_nvic.c | 12 ++++++++----

target/arm/machine.c | 12 ++++++++++++

3 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {

uint32_t aircr; /* only holds r/w state if security extn implemented */

uint32_t secure; /* Is CPU in Secure state? (not guest visible) */

uint32_t csselr[M_REG_NUM_BANKS];

+ uint32_t scr[M_REG_NUM_BANKS];

} v7m;

/* Information associated with an exception about to be taken:

@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CCR, STKALIGN, 9, 1)

FIELD(V7M_CCR, DC, 16, 1)

FIELD(V7M_CCR, IC, 17, 1)

+/* V7M SCR bits */

+FIELD(V7M_SCR, SLEEPONEXIT, 1, 1)

+FIELD(V7M_SCR, SLEEPDEEP, 2, 1)

+FIELD(V7M_SCR, SLEEPDEEPS, 3, 1)

+FIELD(V7M_SCR, SEVONPEND, 4, 1)

+

/* V7M AIRCR bits */

FIELD(V7M_AIRCR, VECTRESET, 0, 1)

FIELD(V7M_AIRCR, VECTCLRACTIVE, 1, 1)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)

}

return val;

case 0xd10: /* System Control. */

- /* TODO: Implement SLEEPONEXIT. */

- return 0;

+ return cpu->env.v7m.scr[attrs.secure];

case 0xd14: /* Configuration Control. */

/* The BFHFNMIGN bit is the only non-banked bit; we

* keep it in the non-secure copy of the register.

@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,

case 0xd10: /* System Control. */

- /* TODO: Implement control registers. */

- qemu_log_mask(LOG_UNIMP, "NVIC: SCR unimplemented\n");

+ /* We don't implement deep-sleep so these bits are RAZ/WI.

+ * The other bits in the register are banked.

+ * QEMU's implementation ignores SEVONPEND and SLEEPONEXIT, which

+ * is architecturally permitted.

+ */

+ value &= ~(R_V7M_SCR_SLEEPDEEP_MASK | R_V7M_SCR_SLEEPDEEPS_MASK);

+ cpu->env.v7m.scr[attrs.secure] = value;

};

+static const VMStateDescription vmstate_m_scr = {

+ .name = "cpu/m/scr",

+ .version_id = 1,

+ .minimum_version_id = 1,

+ .fields = (VMStateField[]) {

+ VMSTATE_UINT32(env.v7m.scr[M_REG_NS], ARMCPU),

+ VMSTATE_END_OF_LIST()

+};

static const VMStateDescription vmstate_m = {

.name = "cpu/m",

.version_id = 4,

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {

.subsections = (const VMStateDescription*[]) {

&vmstate_m_faultmask_primask,

&vmstate_m_csselr,

+ &vmstate_m_scr,

NULL

};

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {

VMSTATE_UINT32(env.sau.rnr, ARMCPU),

VMSTATE_VALIDATE("SAU_RNR is valid", sau_rnr_vmstate_validate),

VMSTATE_UINT32(env.sau.ctrl, ARMCPU),

+ VMSTATE_UINT32(env.v7m.scr[M_REG_S], ARMCPU),

VMSTATE_END_OF_LIST()

};

2.16.1

The v8M architecture includes hardware support for enforcing

stack pointer limits. We don't implement this behaviour yet,

but provide the MSPLIM and PSPLIM stack pointer limit registers

as reads-as-written, so that when we do implement the checks

in future this won't break guest migration.

Message-id: 20180209165810.6668-12-peter.maydell@linaro.org

target/arm/cpu.h | 2 ++

target/arm/helper.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++

target/arm/machine.c | 21 +++++++++++++++++++++

3 files changed, 69 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {

uint32_t secure; /* Is CPU in Secure state? (not guest visible) */

uint32_t csselr[M_REG_NUM_BANKS];

uint32_t scr[M_REG_NUM_BANKS];

+ uint32_t msplim[M_REG_NUM_BANKS];

+ uint32_t psplim[M_REG_NUM_BANKS];

} v7m;

/* Information associated with an exception about to be taken:

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)

return 0;

}

return env->v7m.other_ss_psp;

+ case 0x8a: /* MSPLIM_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.msplim[M_REG_NS];

+ case 0x8b: /* PSPLIM_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.psplim[M_REG_NS];

case 0x90: /* PRIMASK_NS */

if (!env->v7m.secure) {

return 0;

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)

return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];

case 9: /* PSP */

return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;

+ case 10: /* MSPLIM */

+ if (!arm_feature(env, ARM_FEATURE_V8)) {

+ goto bad_reg;

+ }

+ return env->v7m.msplim[env->v7m.secure];

+ case 11: /* PSPLIM */

+ if (!arm_feature(env, ARM_FEATURE_V8)) {

+ goto bad_reg;

+ }

+ return env->v7m.psplim[env->v7m.secure];

case 16: /* PRIMASK */

return env->v7m.primask[env->v7m.secure];

case 17: /* BASEPRI */

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)

case 19: /* FAULTMASK */

return env->v7m.faultmask[env->v7m.secure];

default:

+ bad_reg:

qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"

" register %d\n", reg);

return 0;

@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)

}

env->v7m.other_ss_psp = val;

return;

+ case 0x8a: /* MSPLIM_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.msplim[M_REG_NS] = val & ~7;

+ return;

+ case 0x8b: /* PSPLIM_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.psplim[M_REG_NS] = val & ~7;

+ return;

case 0x90: /* PRIMASK_NS */

if (!env->v7m.secure) {

return;

@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)

env->v7m.other_sp = val;

}

break;

+ case 10: /* MSPLIM */

+ if (!arm_feature(env, ARM_FEATURE_V8)) {

+ goto bad_reg;

+ }

+ env->v7m.msplim[env->v7m.secure] = val & ~7;

+ break;

+ case 11: /* PSPLIM */

+ if (!arm_feature(env, ARM_FEATURE_V8)) {

+ goto bad_reg;

+ }

+ env->v7m.psplim[env->v7m.secure] = val & ~7;

+ break;

case 16: /* PRIMASK */

env->v7m.primask[env->v7m.secure] = val & 1;

break;

@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)

env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;

break;

default:

+ bad_reg:

qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"

" register %d\n", reg);

return;

diff --git a/target/arm/machine.c b/target/arm/machine.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/machine.c

+++ b/target/arm/machine.c

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_other_sp = {

}

};

+static bool m_v8m_needed(void *opaque)

+ ARMCPU *cpu = opaque;

+ CPUARMState *env = &cpu->env;

+ return arm_feature(env, ARM_FEATURE_M) && arm_feature(env, ARM_FEATURE_V8);

+static const VMStateDescription vmstate_m_v8m = {

+ .name = "cpu/m/v8m",

+ .version_id = 1,

+ .minimum_version_id = 1,

+ .needed = m_v8m_needed,

+ .fields = (VMStateField[]) {

+ VMSTATE_UINT32_ARRAY(env.v7m.msplim, ARMCPU, M_REG_NUM_BANKS),

+ VMSTATE_UINT32_ARRAY(env.v7m.psplim, ARMCPU, M_REG_NUM_BANKS),

+ VMSTATE_END_OF_LIST()

+ }

+};

+

static const VMStateDescription vmstate_m = {

.name = "cpu/m",

.version_id = 4,

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {

&vmstate_m_csselr,

&vmstate_m_scr,

&vmstate_m_other_sp,

+ &vmstate_m_v8m,

NULL

}

};

2.16.1

For M profile cores, cache maintenance operations are done by

writing to special registers in the system register space.

For QEMU, cache operations are always NOPs, since we don't

implement the cache. Implementing these explicitly avoids

a spurious LOG_GUEST_ERROR when the guest uses them.

Message-id: 20180209165810.6668-4-peter.maydell@linaro.org

hw/intc/armv7m_nvic.c | 12 ++++++++++++

1 file changed, 12 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,

}

break;

}

+ case 0xf50: /* ICIALLU */

+ case 0xf58: /* ICIMVAU */

+ case 0xf5c: /* DCIMVAC */

+ case 0xf60: /* DCISW */

+ case 0xf64: /* DCCMVAU */

+ case 0xf68: /* DCCMVAC */

+ case 0xf6c: /* DCCSW */

+ case 0xf70: /* DCCIMVAC */

+ case 0xf74: /* DCCISW */

+ case 0xf78: /* BPIALL */

+ /* Cache and branch predictor maintenance: for QEMU these always NOP */

+ break;

default:

bad_offset:

qemu_log_mask(LOG_GUEST_ERROR,

2.16.1

From: Pekka Enberg <penberg@iki.fi>

This patch adds a "raspi3" machine type, which can now be selected as

the machine to run on by users via the "-M" command line option to QEMU.

The machine type does *not* ignore memory transaction failures so we

likely need to add some dummy devices later when people run something

more complicated than what I'm using for testing.

hw/arm/raspi.c | 23 +++++++++++++++++++++++

1 file changed, 23 insertions(+)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c

--- a/hw/arm/raspi.c

+++ b/hw/arm/raspi.c

@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)

mc->ignore_memory_transaction_failures = true;

};

DEFINE_MACHINE("raspi2", raspi2_machine_init)

+

+#ifdef TARGET_AARCH64

+static void raspi3_init(MachineState *machine)

+ raspi_init(machine, 3);

+static void raspi3_machine_init(MachineClass *mc)

+{

+ mc->desc = "Raspberry Pi 3";

+ mc->init = raspi3_init;

+ mc->block_default_type = IF_SD;

+ mc->no_parallel = 1;

+ mc->no_floppy = 1;

+ mc->no_cdrom = 1;

+ mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");

+ mc->max_cpus = BCM2836_NCPUS;

+ mc->min_cpus = BCM2836_NCPUS;

+ mc->default_cpus = BCM2836_NCPUS;

+ mc->default_ram_size = 1024 * 1024 * 1024;

+}

+DEFINE_MACHINE("raspi3", raspi3_machine_init)

+#endif

2.16.1

In many of the NVIC registers relating to interrupts, we

have to convert from a byte offset within a register set

into the number of the first interrupt which is affected.

We were getting this wrong for:

* reads of NVIC_ISPR<n>, NVIC_ISER<n>, NVIC_ICPR<n>, NVIC_ICER<n>,

NVIC_IABR<n> -- in all these cases we were missing the "* 8"

needed to convert from the byte offset to the interrupt number

(since all these registers use one bit per interrupt)

* writes of NVIC_IPR<n> had the opposite problem of a spurious

"* 8" (since these registers use one byte per interrupt)

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20180209165810.6668-9-peter.maydell@linaro.org

hw/intc/armv7m_nvic.c | 8 ++++----

1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,

/* fall through */

case 0x180 ... 0x1bf: /* NVIC Clear enable */

val = 0;

- startvec = offset - 0x180 + NVIC_FIRST_IRQ; /* vector # */

+ startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ; /* vector # */

for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {

if (s->vectors[startvec + i].enabled &&

@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,

/* fall through */

case 0x280 ... 0x2bf: /* NVIC Clear pend */

val = 0;

- startvec = offset - 0x280 + NVIC_FIRST_IRQ; /* vector # */

+ startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */

for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {

if (s->vectors[startvec + i].pending &&

(attrs.secure || s->itns[startvec + i])) {

@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,

break;

case 0x300 ... 0x33f: /* NVIC Active */

val = 0;

- startvec = offset - 0x300 + NVIC_FIRST_IRQ; /* vector # */

+ startvec = 8 * (offset - 0x300) + NVIC_FIRST_IRQ; /* vector # */

for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {

if (s->vectors[startvec + i].active &&

@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,

case 0x300 ... 0x33f: /* NVIC Active */

return MEMTX_OK; /* R/O */

case 0x400 ... 0x5ef: /* NVIC Priority */

- startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */

+ startvec = (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */

for (i = 0; i < size && startvec + i < s->num_irq; i++) {

if (attrs.secure || s->itns[startvec + i]) {

2.16.1

The PENDNMISET/CLR bits in the ICSR should be RAZ/WI from

NonSecure state if the AIRCR.BFHFNMINS bit is zero. We had

misimplemented this as making the bits RAZ/WI from both

Secure and NonSecure states. Fix this bug by checking

attrs.secure so that Secure code can pend and unpend NMIs.

Message-id: 20180209165810.6668-3-peter.maydell@linaro.org

hw/intc/armv7m_nvic.c | 6 +++---

1 file changed, 3 insertions(+), 3 deletions(-)