Second pull request of the week; mostly RTH's support for some

new-in-v8.1/v8.3 instructions, and my v8M board model.

The following changes since commit 427cbc7e4136a061628cb4315cc8182ea36d772f:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2018-03-01 18:46:41 +0000)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180302

for you to fetch changes up to e66a67bf28e1b4fce2e3d72a2610dbd48d9d3078:

target/arm: Enable ARM_FEATURE_V8_FCMA (2018-03-02 11:03:45 +0000)

* implement FCMA and RDM v8.1 and v8.3 instructions

* enable Cortex-M33 v8M core, and provide new mps2-an505 board model

that uses it

* decodetree: Propagate return value from translate subroutines

* xlnx-zynqmp: Implement the RTC device

Alistair Francis (3):

xlnx-zynqmp-rtc: Initial commit

xlnx-zynqmp-rtc: Add basic time support

xlnx-zynqmp: Connect the RTC device

Peter Maydell (19):

loader: Add new load_ramdisk_as()

hw/arm/boot: Honour CPU's address space for image loads

hw/arm/armv7m: Honour CPU's address space for image loads

target/arm: Define an IDAU interface

armv7m: Forward idau property to CPU object

target/arm: Define init-svtor property for the reset secure VTOR value

armv7m: Forward init-svtor property to CPU object

target/arm: Add Cortex-M33

hw/misc/unimp: Move struct to header file

include/hw/or-irq.h: Add missing include guard

qdev: Add new qdev_init_gpio_in_named_with_opaque()

hw/core/split-irq: Device that splits IRQ lines

hw/misc/mps2-fpgaio: FPGA control block for MPS2 AN505

hw/misc/tz-ppc: Model TrustZone peripheral protection controller

hw/misc/iotkit-secctl: Arm IoT Kit security controller initial skeleton

hw/misc/iotkit-secctl: Add handling for PPCs

hw/misc/iotkit-secctl: Add remaining simple registers

hw/arm/iotkit: Model Arm IOT Kit

mps2-an505: New board model: MPS2 with AN505 Cortex-M33 FPGA image

Richard Henderson (17):

decodetree: Propagate return value from translate subroutines

target/arm: Add ARM_FEATURE_V8_RDM

target/arm: Refactor disas_simd_indexed decode

target/arm: Refactor disas_simd_indexed size checks

target/arm: Decode aa64 armv8.1 scalar three same extra

target/arm: Decode aa64 armv8.1 three same extra

target/arm: Decode aa64 armv8.1 scalar/vector x indexed element

target/arm: Decode aa32 armv8.1 three same

target/arm: Decode aa32 armv8.1 two reg and a scalar

target/arm: Enable ARM_FEATURE_V8_RDM

target/arm: Add ARM_FEATURE_V8_FCMA

target/arm: Decode aa64 armv8.3 fcadd

target/arm: Decode aa64 armv8.3 fcmla

target/arm: Decode aa32 armv8.3 3-same

target/arm: Decode aa32 armv8.3 2-reg-index

target/arm: Decode t32 simd 3reg and 2reg_scalar extension

target/arm: Enable ARM_FEATURE_V8_FCMA

hw/arm/Makefile.objs | 2 +

hw/core/Makefile.objs | 1 +

hw/misc/Makefile.objs | 4 +

hw/timer/Makefile.objs | 1 +

target/arm/Makefile.objs | 2 +-

include/hw/arm/armv7m.h | 5 +

include/hw/arm/iotkit.h | 109 ++++++

include/hw/arm/xlnx-zynqmp.h | 2 +

include/hw/core/split-irq.h | 57 +++

include/hw/irq.h | 4 +-

include/hw/loader.h | 12 +-

include/hw/misc/iotkit-secctl.h | 103 ++++++

include/hw/misc/mps2-fpgaio.h | 43 +++

include/hw/misc/tz-ppc.h | 101 ++++++

include/hw/misc/unimp.h | 10 +

include/hw/or-irq.h | 5 +

include/hw/qdev-core.h | 30 +-

include/hw/timer/xlnx-zynqmp-rtc.h | 86 +++++

target/arm/cpu.h | 8 +

target/arm/helper.h | 31 ++

target/arm/idau.h | 61 ++++

hw/arm/armv7m.c | 35 +-

hw/arm/boot.c | 119 ++++---

hw/arm/iotkit.c | 598 +++++++++++++++++++++++++++++++

hw/arm/mps2-tz.c | 503 ++++++++++++++++++++++++++

hw/arm/xlnx-zynqmp.c | 14 +

hw/core/loader.c | 8 +-

hw/core/qdev.c | 8 +-

hw/core/split-irq.c | 89 +++++

hw/misc/iotkit-secctl.c | 704 +++++++++++++++++++++++++++++++++++++

hw/misc/mps2-fpgaio.c | 176 ++++++++++

hw/misc/tz-ppc.c | 302 ++++++++++++++++

hw/misc/unimp.c | 10 -

hw/timer/xlnx-zynqmp-rtc.c | 272 ++++++++++++++

linux-user/elfload.c | 2 +

target/arm/cpu.c | 66 +++-

target/arm/cpu64.c | 2 +

target/arm/helper.c | 28 +-

target/arm/translate-a64.c | 514 +++++++++++++++++++++------

target/arm/translate.c | 275 +++++++++++++--

target/arm/vec_helper.c | 429 ++++++++++++++++++++++

default-configs/arm-softmmu.mak | 5 +

hw/misc/trace-events | 24 ++

hw/timer/trace-events | 3 +

scripts/decodetree.py | 5 +-

45 files changed, 4668 insertions(+), 200 deletions(-)

create mode 100644 include/hw/arm/iotkit.h

create mode 100644 include/hw/core/split-irq.h

create mode 100644 include/hw/misc/iotkit-secctl.h

create mode 100644 include/hw/misc/mps2-fpgaio.h

create mode 100644 include/hw/misc/tz-ppc.h

create mode 100644 include/hw/timer/xlnx-zynqmp-rtc.h

create mode 100644 target/arm/idau.h

create mode 100644 hw/arm/iotkit.c

create mode 100644 hw/arm/mps2-tz.c

create mode 100644 hw/core/split-irq.c

create mode 100644 hw/misc/iotkit-secctl.c

create mode 100644 hw/misc/mps2-fpgaio.c

create mode 100644 hw/misc/tz-ppc.c

create mode 100644 hw/timer/xlnx-zynqmp-rtc.c

create mode 100644 target/arm/vec_helper.c

In v8M, the Implementation Defined Attribution Unit (IDAU) is

a small piece of hardware typically implemented in the SoC

which provides board or SoC specific security attribution

information for each address that the CPU performs MPU/SAU

checks on. For QEMU, we model this with a QOM interface which

is implemented by the board or SoC object and connected to

the CPU using a link property.

This commit defines the new interface class, adds the link

property to the CPU object, and makes the SAU checking

code call the IDAU interface if one is present.

target/arm/cpu.h | 3 +++

target/arm/idau.h | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++

target/arm/cpu.c | 15 +++++++++++++

target/arm/helper.c | 28 +++++++++++++++++++++---

4 files changed, 104 insertions(+), 3 deletions(-)

create mode 100644 target/arm/idau.h

@@ -XXX,XX +XXX,XX @@ struct ARMCPU {

/* MemoryRegion to use for secure physical accesses */

MemoryRegion *secure_memory;

+ /* For v8M, pointer to the IDAU interface provided by board/SoC */

+ Object *idau;

/* 'compatible' string for this CPU for Linux device trees */

const char *dtb_compatible;

diff --git a/target/arm/idau.h b/target/arm/idau.h

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/target/arm/idau.h

@@ -XXX,XX +XXX,XX @@

+/*

+ * QEMU ARM CPU -- interface for the Arm v8M IDAU

+ *

+ * Copyright (c) 2018 Linaro Ltd

+ *

+ * This program is free software; you can redistribute it and/or

+ * modify it under the terms of the GNU General Public License

+ * as published by the Free Software Foundation; either version 2

+ * of the License, or (at your option) any later version.

+ *

+ * This program is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

+ * GNU General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with this program; if not, see

+ * <http://www.gnu.org/licenses/gpl-2.0.html>

+ *

+ * In the v8M architecture, the IDAU is a small piece of hardware

+ * typically implemented in the SoC which provides board or SoC

+ * specific security attribution information for each address that

+ * the CPU performs MPU/SAU checks on. For QEMU, we model this with a

+ * QOM interface which is implemented by the board or SoC object and

+ * connected to the CPU using a link property.

+ */

+

+#ifndef TARGET_ARM_IDAU_H

+#define TARGET_ARM_IDAU_H

+

+#include "qom/object.h"

+

+#define TYPE_IDAU_INTERFACE "idau-interface"

+#define IDAU_INTERFACE(obj) \

+ INTERFACE_CHECK(IDAUInterface, (obj), TYPE_IDAU_INTERFACE)

+#define IDAU_INTERFACE_CLASS(class) \

+ OBJECT_CLASS_CHECK(IDAUInterfaceClass, (class), TYPE_IDAU_INTERFACE)

+#define IDAU_INTERFACE_GET_CLASS(obj) \

+ OBJECT_GET_CLASS(IDAUInterfaceClass, (obj), TYPE_IDAU_INTERFACE)

+

+typedef struct IDAUInterface {

+ Object parent;

+} IDAUInterface;

+

+#define IREGION_NOTVALID -1

+

+typedef struct IDAUInterfaceClass {

+ InterfaceClass parent;

+

+ /* Check the specified address and return the IDAU security information

+ * for it by filling in iregion, exempt, ns and nsc:

+ * iregion: IDAU region number, or IREGION_NOTVALID if not valid

+ * exempt: true if address is exempt from security attribution

+ * ns: true if the address is NonSecure

+ * nsc: true if the address is NonSecure-callable

+ */

+ void (*check)(IDAUInterface *ii, uint32_t address, int *iregion,

+ bool *exempt, bool *ns, bool *nsc);

+} IDAUInterfaceClass;

+

+#endif

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@

*/

#include "qemu/osdep.h"

+#include "target/arm/idau.h"

#include "qemu/error-report.h"

#include "qapi/error.h"

#include "cpu.h"

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)

}

}

+ if (arm_feature(&cpu->env, ARM_FEATURE_M_SECURITY)) {

+ object_property_add_link(obj, "idau", TYPE_IDAU_INTERFACE, &cpu->idau,

+ qdev_prop_allow_set_link_before_realize,

+ OBJ_PROP_LINK_UNREF_ON_RELEASE,

+ &error_abort);

+ }

+

qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,

&error_abort);

}

@@ -XXX,XX +XXX,XX @@ static const TypeInfo arm_cpu_type_info = {

.class_init = arm_cpu_class_init,

};

+static const TypeInfo idau_interface_type_info = {

+ .name = TYPE_IDAU_INTERFACE,

+ .parent = TYPE_INTERFACE,

+ .class_size = sizeof(IDAUInterfaceClass),

+};

+

static void arm_cpu_register_types(void)

const ARMCPUInfo *info = arm_cpus;

type_register_static(&arm_cpu_type_info);

+ type_register_static(&idau_interface_type_info);

while (info->name) {

cpu_register(info);

@@ -XXX,XX +XXX,XX @@

#include "qemu/osdep.h"

+#include "target/arm/idau.h"

#include "trace.h"

#include "cpu.h"

#include "internals.h"

@@ -XXX,XX +XXX,XX @@ static void v8m_security_lookup(CPUARMState *env, uint32_t address,

*/

ARMCPU *cpu = arm_env_get_cpu(env);

int r;

+ bool idau_exempt = false, idau_ns = true, idau_nsc = true;

+ int idau_region = IREGION_NOTVALID;

- /* TODO: implement IDAU */

+ if (cpu->idau) {

+ IDAUInterfaceClass *iic = IDAU_INTERFACE_GET_CLASS(cpu->idau);

+ IDAUInterface *ii = IDAU_INTERFACE(cpu->idau);

+ iic->check(ii, address, &idau_region, &idau_exempt, &idau_ns,

+ &idau_nsc);

+ }

if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {

/* 0xf0000000..0xffffffff is always S for insn fetches */

return;

}

- if (v8m_is_sau_exempt(env, address, access_type)) {

+ if (idau_exempt || v8m_is_sau_exempt(env, address, access_type)) {

sattrs->ns = !regime_is_secure(env, mmu_idx);

return;

}

+ if (idau_region != IREGION_NOTVALID) {

+ sattrs->irvalid = true;

+ sattrs->iregion = idau_region;

switch (env->sau.ctrl & 3) {

case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */

break;

@@ -XXX,XX +XXX,XX @@ static void v8m_security_lookup(CPUARMState *env, uint32_t address,

}

}

- /* TODO when we support the IDAU then it may override the result here */

+ /* The IDAU will override the SAU lookup results if it specifies

+ * higher security than the SAU does.

+ */

+ if (!idau_ns) {

+ if (sattrs->ns || (!idau_nsc && sattrs->nsc)) {

+ sattrs->ns = false;

+ sattrs->nsc = idau_nsc;

+ }

break;

}

}

2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Enable it for the "any" CPU used by *-linux-user.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20180228193125.20577-17-richard.henderson@linaro.org

2 files changed, 2 insertions(+)

@@ -XXX,XX +XXX,XX @@ static void aarch64_any_initfn(Object *obj)

set_feature(&cpu->env, ARM_FEATURE_CRC);

set_feature(&cpu->env, ARM_FEATURE_V8_RDM);

set_feature(&cpu->env, ARM_FEATURE_V8_FP16);

+ set_feature(&cpu->env, ARM_FEATURE_V8_FCMA);

cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */

cpu->dcz_blocksize = 7; /* 512 bytes */

}

2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Allow the translate subroutines to return false for invalid insns.

At present we can of course invoke an invalid insn exception from within

the translate subroutine, but in the short term this consolidates code.

In the long term it would allow the decodetree language to support

overlapping patterns for ISA extensions.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180227232618.2908-1-richard.henderson@linaro.org

scripts/decodetree.py | 5 ++---

1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/scripts/decodetree.py b/scripts/decodetree.py

index XXXXXXX..XXXXXXX 100755

--- a/scripts/decodetree.py

+++ b/scripts/decodetree.py

@@ -XXX,XX +XXX,XX @@ class Pattern(General):

global translate_prefix

output('typedef ', self.base.base.struct_name(),

' arg_', self.name, ';\n')

- output(translate_scope, 'void ', translate_prefix, '_', self.name,

+ output(translate_scope, 'bool ', translate_prefix, '_', self.name,

'(DisasContext *ctx, arg_', self.name,

' *a, ', insntype, ' insn);\n')

@@ -XXX,XX +XXX,XX @@ class Pattern(General):

output(ind, self.base.extract_name(), '(&u.f_', arg, ', insn);\n')

for n, f in self.fields.items():

output(ind, 'u.f_', arg, '.', n, ' = ', f.str_extract(), ';\n')

- output(ind, translate_prefix, '_', self.name,

+ output(ind, 'return ', translate_prefix, '_', self.name,

'(ctx, &u.f_', arg, ', insn);\n')

- output(ind, 'return true;\n')

# end Pattern

2.16.2

From: Alistair Francis <alistair.francis@xilinx.com>

Allow the guest to determine the time set from the QEMU command line.

This includes adding a trace event to debug the new time.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>

include/hw/timer/xlnx-zynqmp-rtc.h | 2 ++

hw/timer/xlnx-zynqmp-rtc.c | 58 ++++++++++++++++++++++++++++++++++++++

hw/timer/trace-events | 3 ++

3 files changed, 63 insertions(+)

diff --git a/include/hw/timer/xlnx-zynqmp-rtc.h b/include/hw/timer/xlnx-zynqmp-rtc.h

--- a/include/hw/timer/xlnx-zynqmp-rtc.h

+++ b/include/hw/timer/xlnx-zynqmp-rtc.h

@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPRTC {

qemu_irq irq_rtc_int;

qemu_irq irq_addr_error_int;

+ uint32_t tick_offset;

+

uint32_t regs[XLNX_ZYNQMP_RTC_R_MAX];

RegisterInfo regs_info[XLNX_ZYNQMP_RTC_R_MAX];

} XlnxZynqMPRTC;

diff --git a/hw/timer/xlnx-zynqmp-rtc.c b/hw/timer/xlnx-zynqmp-rtc.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/xlnx-zynqmp-rtc.c

+++ b/hw/timer/xlnx-zynqmp-rtc.c

@@ -XXX,XX +XXX,XX @@

#include "hw/register.h"

#include "qemu/bitops.h"

#include "qemu/log.h"

+#include "hw/ptimer.h"

+#include "qemu/cutils.h"

+#include "sysemu/sysemu.h"

+#include "trace.h"

#include "hw/timer/xlnx-zynqmp-rtc.h"

#ifndef XLNX_ZYNQMP_RTC_ERR_DEBUG

@@ -XXX,XX +XXX,XX @@ static void addr_error_int_update_irq(XlnxZynqMPRTC *s)

qemu_set_irq(s->irq_addr_error_int, pending);

}

+static uint32_t rtc_get_count(XlnxZynqMPRTC *s)

+{

+ int64_t now = qemu_clock_get_ns(rtc_clock);

+ return s->tick_offset + now / NANOSECONDS_PER_SECOND;

+}

+

+static uint64_t current_time_postr(RegisterInfo *reg, uint64_t val64)

+{

+ XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);

+

+ return rtc_get_count(s);

+}

+

static void rtc_int_status_postw(RegisterInfo *reg, uint64_t val64)

{

XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(reg->opaque);

@@ -XXX,XX +XXX,XX @@ static uint64_t addr_error_int_dis_prew(RegisterInfo *reg, uint64_t val64)

static const RegisterAccessInfo rtc_regs_info[] = {

{ .name = "SET_TIME_WRITE", .addr = A_SET_TIME_WRITE,

+ .unimp = MAKE_64BIT_MASK(0, 32),

},{ .name = "SET_TIME_READ", .addr = A_SET_TIME_READ,

.ro = 0xffffffff,

+ .post_read = current_time_postr,

},{ .name = "CALIB_WRITE", .addr = A_CALIB_WRITE,

+ .unimp = MAKE_64BIT_MASK(0, 32),

},{ .name = "CALIB_READ", .addr = A_CALIB_READ,

.ro = 0x1fffff,

},{ .name = "CURRENT_TIME", .addr = A_CURRENT_TIME,

.ro = 0xffffffff,

+ .post_read = current_time_postr,

},{ .name = "CURRENT_TICK", .addr = A_CURRENT_TICK,

.ro = 0xffff,

},{ .name = "ALARM", .addr = A_ALARM,

@@ -XXX,XX +XXX,XX @@ static void rtc_init(Object *obj)

XlnxZynqMPRTC *s = XLNX_ZYNQMP_RTC(obj);

SysBusDevice *sbd = SYS_BUS_DEVICE(obj);

RegisterInfoArray *reg_array;

+ struct tm current_tm;

memory_region_init(&s->iomem, obj, TYPE_XLNX_ZYNQMP_RTC,

XLNX_ZYNQMP_RTC_R_MAX * 4);

@@ -XXX,XX +XXX,XX @@ static void rtc_init(Object *obj)

sysbus_init_mmio(sbd, &s->iomem);

sysbus_init_irq(sbd, &s->irq_rtc_int);

sysbus_init_irq(sbd, &s->irq_addr_error_int);

+

+ qemu_get_timedate(&current_tm, 0);

+ s->tick_offset = mktimegm(&current_tm) -

+ qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;

+

+ trace_xlnx_zynqmp_rtc_gettime(current_tm.tm_year, current_tm.tm_mon,

+ current_tm.tm_mday, current_tm.tm_hour,

+ current_tm.tm_min, current_tm.tm_sec);

+}

+

+static int rtc_pre_save(void *opaque)

+{

+ XlnxZynqMPRTC *s = opaque;

+ int64_t now = qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;

+

+ /* Add the time at migration */

+ s->tick_offset = s->tick_offset + now;

+

+ return 0;

+}

+

+static int rtc_post_load(void *opaque, int version_id)

+{

+ XlnxZynqMPRTC *s = opaque;

+ int64_t now = qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;

+

+ /* Subtract the time after migration. This combined with the pre_save

+ * action results in us having subtracted the time that the guest was

+ * stopped to the offset.

+ */

+ s->tick_offset = s->tick_offset - now;

+

+ return 0;

}

static const VMStateDescription vmstate_rtc = {

.name = TYPE_XLNX_ZYNQMP_RTC,

.version_id = 1,

.minimum_version_id = 1,

+ .pre_save = rtc_pre_save,

+ .post_load = rtc_post_load,

.fields = (VMStateField[]) {

VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPRTC, XLNX_ZYNQMP_RTC_R_MAX),

+ VMSTATE_UINT32(tick_offset, XlnxZynqMPRTC),

VMSTATE_END_OF_LIST(),

}

};

diff --git a/hw/timer/trace-events b/hw/timer/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/trace-events

+++ b/hw/timer/trace-events

@@ -XXX,XX +XXX,XX @@ systick_write(uint64_t addr, uint32_t value, unsigned size) "systick write addr

cmsdk_apb_timer_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB timer read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"

cmsdk_apb_timer_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB timer write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"

cmsdk_apb_timer_reset(void) "CMSDK APB timer: reset"

+

+# hw/timer/xlnx-zynqmp-rtc.c

+xlnx_zynqmp_rtc_gettime(int year, int month, int day, int hour, int min, int sec) "Get time from host: %d-%d-%d %2d:%02d:%02d"

2.16.2

The Cortex-M33 allows the system to specify the reset value of the

secure Vector Table Offset Register (VTOR) by asserting config

signals. In particular, guest images for the MPS2 AN505 board rely

on the MPS2's initial VTOR being correct for that board.

Implement a QEMU property so board and SoC code can set the reset

value to the correct value.

target/arm/cpu.h | 3 +++

target/arm/cpu.c | 18 ++++++++++++++----

2 files changed, 17 insertions(+), 4 deletions(-)

*/

uint32_t psci_conduit;

+ /* For v8M, initial value of the Secure VTOR */

+ uint32_t init_svtor;

+

/* [QEMU_]KVM_ARM_TARGET_* constant for this CPU, or

* QEMU_KVM_ARM_TARGET_NONE if the kernel doesn't support this CPU type.

*/

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)

uint32_t initial_msp; /* Loaded from 0x0 */

uint32_t initial_pc; /* Loaded from 0x4 */

uint8_t *rom;

+ uint32_t vecbase;

if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {

env->v7m.secure = true;

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)

/* Unlike A/R profile, M profile defines the reset LR value */

env->regs[14] = 0xffffffff;

- /* Load the initial SP and PC from the vector table at address 0 */

- rom = rom_ptr(0);

+ env->v7m.vecbase[M_REG_S] = cpu->init_svtor & 0xffffff80;

+

+ /* Load the initial SP and PC from offset 0 and 4 in the vector table */

+ vecbase = env->v7m.vecbase[env->v7m.secure];

+ rom = rom_ptr(vecbase);

if (rom) {

/* Address zero is covered by ROM which hasn't yet been

* copied into physical memory.

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)

* it got copied into memory. In the latter case, rom_ptr

* will return a NULL pointer and we should use ldl_phys instead.

*/

- initial_msp = ldl_phys(s->as, 0);

- initial_pc = ldl_phys(s->as, 4);

+ initial_msp = ldl_phys(s->as, vecbase);

+ initial_pc = ldl_phys(s->as, vecbase + 4);

}

env->regs[13] = initial_msp & 0xFFFFFFFC;

@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pmsav7_dregion_property =

pmsav7_dregion,

qdev_prop_uint32, uint32_t);

+/* M profile: initial value of the Secure VTOR */

+static Property arm_cpu_initsvtor_property =

+ DEFINE_PROP_UINT32("init-svtor", ARMCPU, init_svtor, 0);

+

static void arm_cpu_post_init(Object *obj)

{

ARMCPU *cpu = ARM_CPU(obj);

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)

qdev_prop_allow_set_link_before_realize,

OBJ_PROP_LINK_UNREF_ON_RELEASE,

&error_abort);

+ qdev_property_add_static(DEVICE(obj), &arm_cpu_initsvtor_property,

+ &error_abort);

}

qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,

2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Happily, the bits are in the same places compared to a32.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180228193125.20577-16-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/translate.c | 14 +++++++++++++-

1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)

default_exception_el(s));

break;

}

- if (((insn >> 24) & 3) == 3) {

+ if ((insn & 0xfe000a00) == 0xfc000800

+ && arm_dc_feature(s, ARM_FEATURE_V8)) {

+ /* The Thumb2 and ARM encodings are identical. */

+ if (disas_neon_insn_3same_ext(s, insn)) {

+ goto illegal_op;

+ }

+ } else if ((insn & 0xff000a00) == 0xfe000800

+ && arm_dc_feature(s, ARM_FEATURE_V8)) {

+ /* The Thumb2 and ARM encodings are identical. */

+ if (disas_neon_insn_2reg_scalar_ext(s, insn)) {

+ goto illegal_op;

+ }

+ } else if (((insn >> 24) & 3) == 3) {

/* Translate into the equivalent ARM encoding. */

insn = (insn & 0xe2ffffff) | ((insn & (1 << 28)) >> 4) | (1 << 28);

if (disas_neon_data_insn(s, insn)) {

2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Not enabled anywhere yet.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180228193125.20577-11-richard.henderson@linaro.org

target/arm/cpu.h | 1 +

linux-user/elfload.c | 1 +

2 files changed, 2 insertions(+)

@@ -XXX,XX +XXX,XX @@ enum arm_features {

ARM_FEATURE_V8_SM4, /* implements SM4 part of v8 Crypto Extensions */

ARM_FEATURE_V8_RDM, /* implements v8.1 simd round multiply */

ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */

+ ARM_FEATURE_V8_FCMA, /* has complex number part of v8.3 extensions. */

};

static inline int arm_feature(CPUARMState *env, int feature)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c

index XXXXXXX..XXXXXXX 100644

--- a/linux-user/elfload.c

+++ b/linux-user/elfload.c

@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)

GET_FEATURE(ARM_FEATURE_V8_FP16,

ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);

GET_FEATURE(ARM_FEATURE_V8_RDM, ARM_HWCAP_A64_ASIMDRDM);

+ GET_FEATURE(ARM_FEATURE_V8_FCMA, ARM_HWCAP_A64_FCMA);

#undef GET_FEATURE

return hwcaps;

2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Not enabled anywhere yet.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180228193125.20577-2-richard.henderson@linaro.org

target/arm/cpu.h | 1 +

linux-user/elfload.c | 1 +

2 files changed, 2 insertions(+)

@@ -XXX,XX +XXX,XX @@ enum arm_features {

ARM_FEATURE_V8_SHA3, /* implements SHA3 part of v8 Crypto Extensions */

ARM_FEATURE_V8_SM3, /* implements SM3 part of v8 Crypto Extensions */

ARM_FEATURE_V8_SM4, /* implements SM4 part of v8 Crypto Extensions */

+ ARM_FEATURE_V8_RDM, /* implements v8.1 simd round multiply */

ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */

};

diff --git a/linux-user/elfload.c b/linux-user/elfload.c

index XXXXXXX..XXXXXXX 100644

--- a/linux-user/elfload.c

+++ b/linux-user/elfload.c

@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)

GET_FEATURE(ARM_FEATURE_V8_SHA512, ARM_HWCAP_A64_SHA512);

GET_FEATURE(ARM_FEATURE_V8_FP16,

ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);

+ GET_FEATURE(ARM_FEATURE_V8_RDM, ARM_HWCAP_A64_ASIMDRDM);

#undef GET_FEATURE

return hwcaps;

2.16.2

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180228193125.20577-15-richard.henderson@linaro.org

target/arm/translate.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 61 insertions(+)

diff --git a/target/arm/translate.c b/target/arm/translate.c

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)

return 0;

}

+/* Advanced SIMD two registers and a scalar extension.

+ * 31 24 23 22 20 16 12 11 10 9 8 3 0

+ * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+

+ * | 1 1 1 1 1 1 1 0 | o1 | D | o2 | Vn | Vd | 1 | o3 | 0 | o4 | N Q M U | Vm |

+ * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+

+ *

+ */

+

+static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)

+{

+ int rd, rn, rm, rot, size, opr_sz;

+ TCGv_ptr fpst;

+ bool q;

+

+ q = extract32(insn, 6, 1);

+ VFP_DREG_D(rd, insn);

+ VFP_DREG_N(rn, insn);

+ VFP_DREG_M(rm, insn);

+ if ((rd | rn) & q) {

+ return 1;

+ }

+

+ if ((insn & 0xff000f10) == 0xfe000800) {

+ /* VCMLA (indexed) -- 1111 1110 S.RR .... .... 1000 ...0 .... */

+ rot = extract32(insn, 20, 2);

+ size = extract32(insn, 23, 1);

+ if (!arm_dc_feature(s, ARM_FEATURE_V8_FCMA)

+ || (!size && !arm_dc_feature(s, ARM_FEATURE_V8_FP16))) {

+ return 1;

+ }

+ } else {

+ return 1;

+ }

+

+ if (s->fp_excp_el) {

+ gen_exception_insn(s, 4, EXCP_UDEF,

+ syn_fp_access_trap(1, 0xe, false), s->fp_excp_el);

+ return 0;

+ }

+ if (!s->vfp_enabled) {

+ return 1;

+ }

+

+ opr_sz = (1 + q) * 8;

+ fpst = get_fpstatus_ptr(1);

+ tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd),

+ vfp_reg_offset(1, rn),

+ vfp_reg_offset(1, rm), fpst,

+ opr_sz, opr_sz, rot,

+ size ? gen_helper_gvec_fcmlas_idx

+ : gen_helper_gvec_fcmlah_idx);

+ tcg_temp_free_ptr(fpst);

+ return 0;

+}

+

static int disas_coproc_insn(DisasContext *s, uint32_t insn)

int cpnum, is64, crn, crm, opc1, opc2, isread, rt, rt2;

@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)

goto illegal_op;

}

return;

+ } else if ((insn & 0x0f000a00) == 0x0e000800

+ && arm_dc_feature(s, ARM_FEATURE_V8)) {

+ if (disas_neon_insn_2reg_scalar_ext(s, insn)) {

+ goto illegal_op;

+ }

+ return;

} else if ((insn & 0x0fe00000) == 0x0c400000) {

/* Coprocessor double register transfer. */

ARCH(5TE);

2.16.2

Define a new board model for the MPS2 with an AN505 FPGA image

containing a Cortex-M33. Since the FPGA images for TrustZone

cores (AN505, and the similar AN519 for Cortex-M23) have a

significantly different layout of devices to the non-TrustZone

images, we use a new source file rather than shoehorning them

into the existing mps2.c.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180220180325.29818-20-peter.maydell@linaro.org

hw/arm/Makefile.objs | 1 +

hw/arm/mps2-tz.c | 503 +++++++++++++++++++++++++++++++++++++++++++++++++++

2 files changed, 504 insertions(+)

create mode 100644 hw/arm/mps2-tz.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs

--- a/hw/arm/Makefile.objs

+++ b/hw/arm/Makefile.objs

@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o

obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o

obj-$(CONFIG_ASPEED_SOC) += aspeed_soc.o aspeed.o

obj-$(CONFIG_MPS2) += mps2.o

+obj-$(CONFIG_MPS2) += mps2-tz.o

obj-$(CONFIG_MSF2) += msf2-soc.o msf2-som.o

obj-$(CONFIG_IOTKIT) += iotkit.o

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/hw/arm/mps2-tz.c

@@ -XXX,XX +XXX,XX @@

+/*

+ * ARM V2M MPS2 board emulation, trustzone aware FPGA images

+ *

+ * Copyright (c) 2017 Linaro Limited

+ * Written by Peter Maydell

+ *

+ * This program is free software; you can redistribute it and/or modify

+ * it under the terms of the GNU General Public License version 2 or

+ * (at your option) any later version.

+ */

+

+/* The MPS2 and MPS2+ dev boards are FPGA based (the 2+ has a bigger

+ * FPGA but is otherwise the same as the 2). Since the CPU itself

+ * and most of the devices are in the FPGA, the details of the board

+ * as seen by the guest depend significantly on the FPGA image.

+ * This source file covers the following FPGA images, for TrustZone cores:

+ * "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505

+ *

+ * Links to the TRM for the board itself and to the various Application

+ * Notes which document the FPGA images can be found here:

+ * https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2

+ *

+ * Board TRM:

+ * http://infocenter.arm.com/help/topic/com.arm.doc.100112_0200_06_en/versatile_express_cortex_m_prototyping_systems_v2m_mps2_and_v2m_mps2plus_technical_reference_100112_0200_06_en.pdf

+ * Application Note AN505:

+ * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html

+ *

+ * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide

+ * (ARM ECM0601256) for the details of some of the device layout:

+ * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html

+ */

+

+#include "qemu/osdep.h"

+#include "qapi/error.h"

+#include "qemu/error-report.h"

+#include "hw/arm/arm.h"

+#include "hw/arm/armv7m.h"

+#include "hw/or-irq.h"

+#include "hw/boards.h"

+#include "exec/address-spaces.h"

+#include "sysemu/sysemu.h"

+#include "hw/misc/unimp.h"

+#include "hw/char/cmsdk-apb-uart.h"

+#include "hw/timer/cmsdk-apb-timer.h"

+#include "hw/misc/mps2-scc.h"

+#include "hw/misc/mps2-fpgaio.h"

+#include "hw/arm/iotkit.h"

+#include "hw/devices.h"

+#include "net/net.h"

+#include "hw/core/split-irq.h"

+

+typedef enum MPS2TZFPGAType {

+ FPGA_AN505,

+} MPS2TZFPGAType;

+

+typedef struct {

+ MachineClass parent;

+ MPS2TZFPGAType fpga_type;

+ uint32_t scc_id;

+} MPS2TZMachineClass;

+

+typedef struct {

+ MachineState parent;

+

+ IoTKit iotkit;

+ MemoryRegion psram;

+ MemoryRegion ssram1;

+ MemoryRegion ssram1_m;

+ MemoryRegion ssram23;

+ MPS2SCC scc;

+ MPS2FPGAIO fpgaio;

+ TZPPC ppc[5];

+ UnimplementedDeviceState ssram_mpc[3];

+ UnimplementedDeviceState spi[5];

+ UnimplementedDeviceState i2c[4];

+ UnimplementedDeviceState i2s_audio;

+ UnimplementedDeviceState gpio[5];

+ UnimplementedDeviceState dma[4];

+ UnimplementedDeviceState gfx;

+ CMSDKAPBUART uart[5];

+ SplitIRQ sec_resp_splitter;

+ qemu_or_irq uart_irq_orgate;

+} MPS2TZMachineState;

+

+#define TYPE_MPS2TZ_MACHINE "mps2tz"

+#define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505")

+

+#define MPS2TZ_MACHINE(obj) \

+ OBJECT_CHECK(MPS2TZMachineState, obj, TYPE_MPS2TZ_MACHINE)

+#define MPS2TZ_MACHINE_GET_CLASS(obj) \

+ OBJECT_GET_CLASS(MPS2TZMachineClass, obj, TYPE_MPS2TZ_MACHINE)

+#define MPS2TZ_MACHINE_CLASS(klass) \

+ OBJECT_CLASS_CHECK(MPS2TZMachineClass, klass, TYPE_MPS2TZ_MACHINE)

+

+/* Main SYSCLK frequency in Hz */

+#define SYSCLK_FRQ 20000000

+

+/* Initialize the auxiliary RAM region @mr and map it into

+ * the memory map at @base.

+ */

+static void make_ram(MemoryRegion *mr, const char *name,

+ hwaddr base, hwaddr size)

+{

+ memory_region_init_ram(mr, NULL, name, size, &error_fatal);

+ memory_region_add_subregion(get_system_memory(), base, mr);

+}

+

+/* Create an alias of an entire original MemoryRegion @orig

+ * located at @base in the memory map.

+ */

+static void make_ram_alias(MemoryRegion *mr, const char *name,

+ MemoryRegion *orig, hwaddr base)