Changes v1->v2: it turns out that the raspi3 support exposes a

preexisting bug in our register definitions for VMPIDR/VMIDR:

https://lists.gnu.org/archive/html/qemu-devel/2018-02/msg04181.html

So I've dropped the final "enable raspi3 board" patch for the

moment. When that VMIDR/VMPIDR patch gets reviewed we can

put the raspi3 patch in with it.

The following changes since commit f003d07337a6d4d02c43429b26a4270459afb51a:

Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging (2018-02-15 15:45:33 +0000)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180215-1

for you to fetch changes up to bade58166f4466546600d824a2695a00269d10eb:

raspi: Raspberry Pi 3 support (2018-02-15 18:33:46 +0000)

* aspeed: code cleanup to use unimplemented_device

* preparatory work for 'raspi3' RaspberryPi 3 machine model

* more SVE prep work

* v8M: add minor missing registers

* v7M: fix bug where we weren't migrating v7m.other_sp

* v7M: fix bugs in handling of interrupt registers for

external interrupts beyond 32

Pekka Enberg (2):

bcm2836: Make CPU type configurable

raspi: Raspberry Pi 3 support

Peter Maydell (11):

hw/intc/armv7m_nvic: Don't hardcode M profile ID registers in NVIC

hw/intc/armv7m_nvic: Fix ICSR PENDNMISET/CLR handling

hw/intc/armv7m_nvic: Implement M profile cache maintenance ops

hw/intc/armv7m_nvic: Implement v8M CPPWR register

hw/intc/armv7m_nvic: Implement cache ID registers

hw/intc/armv7m_nvic: Implement SCR

target/arm: Implement writing to CONTROL_NS for v8M

hw/intc/armv7m_nvic: Fix byte-to-interrupt number conversions

target/arm: Add AIRCR to vmstate struct

target/arm: Migrate v7m.other_sp

target/arm: Implement v8M MSPLIM and PSPLIM registers

Philippe Mathieu-Daudé (2):

hw/arm/aspeed: directly map the serial device to the system address space

hw/arm/aspeed: simplify using the 'unimplemented device' for aspeed_soc.io

Richard Henderson (5):

target/arm: Remove ARM_CP_64BIT from ZCR_EL registers

target/arm: Enforce FP access to FPCR/FPSR

target/arm: Suppress TB end for FPCR/FPSR

target/arm: Enforce access to ZCR_EL at translation

target/arm: Handle SVE registers when using clear_vec_high

include/hw/arm/aspeed_soc.h | 1 -

include/hw/arm/bcm2836.h | 1 +

target/arm/cpu.h | 71 ++++++++++++-----

target/arm/internals.h | 6 ++

hw/arm/aspeed_soc.c | 35 ++-------

hw/arm/bcm2836.c | 17 +++--

hw/arm/raspi.c | 34 ++++++---

hw/intc/armv7m_nvic.c | 98 ++++++++++++++++++------

target/arm/cpu.c | 28 +++++++

target/arm/helper.c | 84 +++++++++++++++-----

target/arm/machine.c | 84 ++++++++++++++++++++

target/arm/translate-a64.c | 181 ++++++++++++++++++++------------------------

12 files changed, 429 insertions(+), 211 deletions(-)

Nothing in either register affects the TB.

Message-id: 20180211205848.4568-4-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/helper.c | 4 ++--

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {

.writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },

{ .name = "FPCR", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,

- .access = PL0_RW, .type = ARM_CP_FPU,

+ .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,

.readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },

{ .name = "FPSR", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,

- .access = PL0_RW, .type = ARM_CP_FPU,

+ .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,

.readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },

{ .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,

.opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,

2.16.1

From: Pekka Enberg <penberg@iki.fi>

This patch adds Raspberry Pi 3 support to hw/arm/raspi.c. The

differences to Pi 2 are:

- Firmware address

- Board ID

- Board revision

The CPU is different too, but that's going to be configured as part of

the machine default CPU when we introduce a new machine type.

The patch was written from scratch by me but the logic is similar to

Zoltán Baldaszti's previous work, which I used as a reference (with

permission from the author):

https://github.com/bztsrc/qemu-raspi3

Signed-off-by: Pekka Enberg <penberg@iki.fi>

[PMM: fixed trailing whitespace on one line]

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

hw/arm/raspi.c | 31 +++++++++++++++++++++----------

1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c

--- a/hw/arm/raspi.c

+++ b/hw/arm/raspi.c

@@ -XXX,XX +XXX,XX @@

* Rasperry Pi 2 emulation Copyright (c) 2015, Microsoft

* Written by Andrew Baumann

*

+ * Raspberry Pi 3 emulation Copyright (c) 2018 Zoltán Baldaszti

+ * Upstream code cleanup (c) 2018 Pekka Enberg

+ *

* This code is licensed under the GNU GPLv2 and later.

*/

@@ -XXX,XX +XXX,XX @@

#define SMPBOOT_ADDR 0x300 /* this should leave enough space for ATAGS */

#define MVBAR_ADDR 0x400 /* secure vectors */

#define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */

-#define FIRMWARE_ADDR 0x8000 /* Pi loads kernel.img here by default */

+#define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */

+#define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */

/* Table of Linux board IDs for different Pi versions */

-static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43};

+static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};

typedef struct RasPiState {

BCM2836State soc;

@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)

binfo.secure_board_setup = true;

binfo.secure_boot = true;

- /* Pi2 requires SMP setup */

- if (version == 2) {

+ /* Pi2 and Pi3 requires SMP setup */

+ if (version >= 2) {

binfo.smp_loader_start = SMPBOOT_ADDR;

binfo.write_secondary_boot = write_smpboot;

binfo.secondary_cpu_reset_hook = reset_secondary;

@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)

* the normal Linux boot process

*/

if (machine->firmware) {

+ hwaddr firmware_addr = version == 3 ? FIRMWARE_ADDR_3 : FIRMWARE_ADDR_2;

/* load the firmware image (typically kernel.img) */

- r = load_image_targphys(machine->firmware, FIRMWARE_ADDR,

- ram_size - FIRMWARE_ADDR);

+ r = load_image_targphys(machine->firmware, firmware_addr,

+ ram_size - firmware_addr);

if (r < 0) {

error_report("Failed to load firmware from %s", machine->firmware);

exit(1);

}

- binfo.entry = FIRMWARE_ADDR;

+ binfo.entry = firmware_addr;

binfo.firmware_loaded = true;

} else {

binfo.kernel_filename = machine->kernel_filename;

@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)

arm_load_kernel(ARM_CPU(first_cpu), &binfo);

}

-static void raspi2_init(MachineState *machine)

+static void raspi_init(MachineState *machine, int version)

{

RasPiState *s = g_new0(RasPiState, 1);

uint32_t vcram_size;

@@ -XXX,XX +XXX,XX @@ static void raspi2_init(MachineState *machine)

&error_abort);

object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",

&error_abort);

- object_property_set_int(OBJECT(&s->soc), 0xa21041, "board-rev",

+ int board_rev = version == 3 ? 0xa02082 : 0xa21041;

+ object_property_set_int(OBJECT(&s->soc), board_rev, "board-rev",

&error_abort);

object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_abort);

@@ -XXX,XX +XXX,XX @@ static void raspi2_init(MachineState *machine)

vcram_size = object_property_get_uint(OBJECT(&s->soc), "vcram-size",

&error_abort);

- setup_boot(machine, 2, machine->ram_size - vcram_size);

+ setup_boot(machine, version, machine->ram_size - vcram_size);

+}

+static void raspi2_init(MachineState *machine)

+{

+ raspi_init(machine, 2);

}

static void raspi2_machine_init(MachineClass *mc)

2.16.1

The v8M architecture includes hardware support for enforcing

stack pointer limits. We don't implement this behaviour yet,

but provide the MSPLIM and PSPLIM stack pointer limit registers

as reads-as-written, so that when we do implement the checks

in future this won't break guest migration.

Message-id: 20180209165810.6668-12-peter.maydell@linaro.org

target/arm/cpu.h | 2 ++

target/arm/helper.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++

target/arm/machine.c | 21 +++++++++++++++++++++

3 files changed, 69 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {

uint32_t secure; /* Is CPU in Secure state? (not guest visible) */

uint32_t csselr[M_REG_NUM_BANKS];

uint32_t scr[M_REG_NUM_BANKS];

+ uint32_t msplim[M_REG_NUM_BANKS];

+ uint32_t psplim[M_REG_NUM_BANKS];

} v7m;

/* Information associated with an exception about to be taken:

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)

return 0;

}

return env->v7m.other_ss_psp;

+ case 0x8a: /* MSPLIM_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.msplim[M_REG_NS];

+ case 0x8b: /* PSPLIM_NS */

+ if (!env->v7m.secure) {

+ return 0;

+ }

+ return env->v7m.psplim[M_REG_NS];

case 0x90: /* PRIMASK_NS */

if (!env->v7m.secure) {

return 0;

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)

return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];

case 9: /* PSP */

return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;

+ case 10: /* MSPLIM */

+ if (!arm_feature(env, ARM_FEATURE_V8)) {

+ goto bad_reg;

+ }

+ return env->v7m.msplim[env->v7m.secure];

+ case 11: /* PSPLIM */

+ if (!arm_feature(env, ARM_FEATURE_V8)) {

+ goto bad_reg;

+ }

+ return env->v7m.psplim[env->v7m.secure];

case 16: /* PRIMASK */

return env->v7m.primask[env->v7m.secure];

case 17: /* BASEPRI */

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)

case 19: /* FAULTMASK */

return env->v7m.faultmask[env->v7m.secure];

default:

+ bad_reg:

qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"

" register %d\n", reg);

return 0;

@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)

}

env->v7m.other_ss_psp = val;

return;

+ case 0x8a: /* MSPLIM_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.msplim[M_REG_NS] = val & ~7;

+ return;

+ case 0x8b: /* PSPLIM_NS */

+ if (!env->v7m.secure) {

+ return;

+ }

+ env->v7m.psplim[M_REG_NS] = val & ~7;

+ return;

case 0x90: /* PRIMASK_NS */

if (!env->v7m.secure) {

return;

@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)

env->v7m.other_sp = val;

}

break;

+ case 10: /* MSPLIM */

+ if (!arm_feature(env, ARM_FEATURE_V8)) {

+ goto bad_reg;

+ }

+ env->v7m.msplim[env->v7m.secure] = val & ~7;

+ break;

+ case 11: /* PSPLIM */

+ if (!arm_feature(env, ARM_FEATURE_V8)) {

+ goto bad_reg;

+ }

+ env->v7m.psplim[env->v7m.secure] = val & ~7;

+ break;

case 16: /* PRIMASK */

env->v7m.primask[env->v7m.secure] = val & 1;

break;

@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)

env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;

break;

default:

+ bad_reg:

qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"

" register %d\n", reg);

return;

diff --git a/target/arm/machine.c b/target/arm/machine.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/machine.c

+++ b/target/arm/machine.c

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_other_sp = {

}

};

+static bool m_v8m_needed(void *opaque)

+{

+ ARMCPU *cpu = opaque;

+ CPUARMState *env = &cpu->env;

+ return arm_feature(env, ARM_FEATURE_M) && arm_feature(env, ARM_FEATURE_V8);

+}

+static const VMStateDescription vmstate_m_v8m = {

+ .name = "cpu/m/v8m",

+ .version_id = 1,

+ .minimum_version_id = 1,

+ .needed = m_v8m_needed,

+ .fields = (VMStateField[]) {

+ VMSTATE_UINT32_ARRAY(env.v7m.msplim, ARMCPU, M_REG_NUM_BANKS),

+ VMSTATE_UINT32_ARRAY(env.v7m.psplim, ARMCPU, M_REG_NUM_BANKS),

+ VMSTATE_END_OF_LIST()

+ }

+};

+

static const VMStateDescription vmstate_m = {

.name = "cpu/m",

.version_id = 4,

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {

&vmstate_m_csselr,

&vmstate_m_scr,

&vmstate_m_other_sp,

+ &vmstate_m_v8m,

NULL

}

};

2.16.1

In commit abc24d86cc0364f we accidentally broke migration of

the stack pointer value for the mode (process, handler) the CPU

is not currently running as. (The commit correctly removed the

no-longer-used v7m.current_sp flag from the VMState but also

deleted the still very much in use v7m.other_sp SP value field.)

Add a subsection to migrate it again. (We don't need to care

about trying to retain compatibility with pre-abc24d86cc0364f

versions of QEMU, because that commit bumped the version_id

and we've since bumped it again a couple of times.)

Message-id: 20180209165810.6668-11-peter.maydell@linaro.org

target/arm/machine.c | 11 +++++++++++

1 file changed, 11 insertions(+)

diff --git a/target/arm/machine.c b/target/arm/machine.c

--- a/target/arm/machine.c

+++ b/target/arm/machine.c

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_scr = {

}

};

+static const VMStateDescription vmstate_m_other_sp = {

+ .name = "cpu/m/other-sp",

+ .version_id = 1,

+ .minimum_version_id = 1,

+ .fields = (VMStateField[]) {

+ VMSTATE_UINT32(env.v7m.other_sp, ARMCPU),

+ VMSTATE_END_OF_LIST()

+ }

+};

+

static const VMStateDescription vmstate_m = {

.name = "cpu/m",

.version_id = 4,

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {

&vmstate_m_faultmask_primask,

&vmstate_m_csselr,

&vmstate_m_scr,

+ &vmstate_m_other_sp,

NULL

}

};

2.16.1

From: Pekka Enberg <penberg@iki.fi>

This patch adds a "cpu-type" property to BCM2836 SoC in preparation for

reusing the code for the Raspberry Pi 3, which has a different processor

model.

Signed-off-by: Pekka Enberg <penberg@iki.fi>

include/hw/arm/bcm2836.h | 1 +

hw/arm/bcm2836.c | 17 +++++++++--------

hw/arm/raspi.c | 3 +++

3 files changed, 13 insertions(+), 8 deletions(-)

@@ -XXX,XX +XXX,XX @@

static void bcm2836_init(Object *obj)

{

BCM2836State *s = BCM2836(obj);

- int n;

-

- for (n = 0; n < BCM2836_NCPUS; n++) {

- object_initialize(&s->cpus[n], sizeof(s->cpus[n]),

- "cortex-a15-" TYPE_ARM_CPU);

- object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),

- &error_abort);

- }

object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);

object_property_add_child(obj, "control", OBJECT(&s->control), NULL);

@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)

/* common peripherals from bcm2835 */

+ obj = OBJECT(dev);

+ for (n = 0; n < BCM2836_NCPUS; n++) {

+ object_initialize(&s->cpus[n], sizeof(s->cpus[n]),

+ s->cpu_type);

+ object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),

+ &error_abort);

+ }

+

obj = object_property_get_link(OBJECT(dev), "ram", &err);

if (obj == NULL) {

error_setg(errp, "%s: required ram link not found: %s",

@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)

static Property bcm2836_props[] = {

+ DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),

DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),

DEFINE_PROP_END_OF_LIST()

};

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/raspi.c

+++ b/hw/arm/raspi.c

@@ -XXX,XX +XXX,XX @@ static void raspi2_init(MachineState *machine)

/* Setup the SOC */

object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),

&error_abort);

+ object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",

+ &error_abort);

object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",

&error_abort);

object_property_set_int(OBJECT(&s->soc), 0xa21041, "board-rev",

@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)

mc->no_parallel = 1;

mc->no_floppy = 1;

mc->no_cdrom = 1;

+ mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");

mc->max_cpus = BCM2836_NCPUS;

mc->min_cpus = BCM2836_NCPUS;

mc->default_cpus = BCM2836_NCPUS;

2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

(qemu) info mtree

address-space: cpu-memory-0

0000000000000000-ffffffffffffffff (prio 0, i/o): system

0000000000000000-0000000007ffffff (prio 0, rom): aspeed.boot_rom

- 000000001e600000-000000001e7fffff (prio -1, i/o): aspeed_soc.io

+ 000000001e600000-000000001e7fffff (prio -1000, i/o): aspeed_soc.io

000000001e620000-000000001e6200ff (prio 0, i/o): aspeed.smc.ast2500-fmc

000000001e630000-000000001e6300ff (prio 0, i/o): aspeed.smc.ast2500-spi1

000000001e631000-000000001e6310ff (prio 0, i/o): aspeed.smc.ast2500-spi2

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Reviewed-by: Andrew Jeffery <andrew@aj.id.au>

Message-id: 20180209085755.30414-3-f4bug@amsat.org

include/hw/arm/aspeed_soc.h | 1 -

hw/arm/aspeed_soc.c | 32 +++-----------------------------

2 files changed, 3 insertions(+), 30 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h

--- a/include/hw/arm/aspeed_soc.h

+++ b/include/hw/arm/aspeed_soc.h

@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {

/*< public >*/

ARMCPU cpu;

- MemoryRegion iomem;

MemoryRegion sram;

AspeedVICState vic;

AspeedTimerCtrlState timerctrl;

diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/aspeed_soc.c

+++ b/hw/arm/aspeed_soc.c

#include "qemu-common.h"

#include "cpu.h"

#include "exec/address-spaces.h"

+#include "hw/misc/unimp.h"

#include "hw/arm/aspeed_soc.h"

#include "hw/char/serial.h"

#include "qemu/log.h"

@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {

},

};

-/*

- * IO handlers: simply catch any reads/writes to IO addresses that aren't

- * handled by a device mapping.

- */

-

-static uint64_t aspeed_soc_io_read(void *p, hwaddr offset, unsigned size)

-{

- qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " [%u]\n",

- __func__, offset, size);

- return 0;

-}

-

-static void aspeed_soc_io_write(void *opaque, hwaddr offset, uint64_t value,

- unsigned size)

-{

- qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " <- 0x%" PRIx64 " [%u]\n",

- __func__, offset, value, size);

-}

-

-static const MemoryRegionOps aspeed_soc_io_ops = {

- .read = aspeed_soc_io_read,

- .write = aspeed_soc_io_write,

- .endianness = DEVICE_LITTLE_ENDIAN,

-};

-

static void aspeed_soc_init(Object *obj)

2.16.1