docs/devel/loads-stores.rst | 39 +-

include/exec/cpu-all.h | 13 +-

include/exec/cpu_ldst.h | 283 +++--

include/exec/exec-all.h | 39 +

include/hw/arm/nrf51.h | 3 +-

include/hw/core/cpu.h | 23 +

include/hw/i2c/microbit_i2c.h | 2 +-

include/hw/misc/aspeed_scu.h | 1 +

include/hw/timer/nrf51_timer.h | 1 +

target/arm/cpu.h | 10 +

target/arm/helper-sve.h | 45 +-

target/arm/internals.h | 5 -

accel/tcg/cputlb.c | 413 ++++---

accel/tcg/user-exec.c | 256 ++++-

exec.c | 2 +-

hw/arm/aspeed.c | 73 +-

hw/arm/aspeed_ast2600.c | 6 +-

hw/arm/musicpal.c | 12 +-

hw/arm/nrf51_soc.c | 9 +-

hw/i2c/microbit_i2c.c | 2 +-

hw/misc/aspeed_scu.c | 11 +-

hw/misc/aspeed_sdmc.c | 55 +-

hw/timer/nrf51_timer.c | 14 +-

target/arm/cpu.c | 662 +----------

target/arm/cpu64.c | 18 +-

target/arm/cpu_tcg.c | 664 +++++++++++

target/arm/helper.c | 30 +-

target/arm/kvm32.c | 13 +-

target/arm/kvm64.c | 22 +-

target/arm/sve_helper.c | 2398 +++++++++++++++++++++-------------------

target/arm/translate-sve.c | 93 +-

hw/timer/trace-events | 5 +-

target/arm/Makefile.objs | 1 +

33 files changed, 2975 insertions(+), 2248 deletions(-)

create mode 100644 target/arm/cpu_tcg.c

From: Joel Stanley <joel@jms.id.au>

This is a boot stub that is similar to the code u-boot runs, allowing

the kernel to boot the secondary CPU.

u-boot works as follows:

1. Initialises the SMP mailbox area in the SCU at 0x1e6e2180 with default values

2. Copies a stub named 'mailbox_insn' from flash to the SCU, just above the

mailbox area

3. Sets AST_SMP_MBOX_FIELD_READY to a magic value to indicate the

secondary can begin execution from the stub

4. The stub waits until the AST_SMP_MBOX_FIELD_GOSIGN register is set to

a magic value

5. Jumps to the address in AST_SMP_MBOX_FIELD_ENTRY, starting Linux

Linux indicates it is ready by writing the address of its entrypoint

function to AST_SMP_MBOX_FIELD_ENTRY and the 'go' magic number to

AST_SMP_MBOX_FIELD_GOSIGN. The secondary CPU sees this at step 4 and

breaks out of it's loop.

To be compatible, a fixed qemu stub is loaded into the mailbox area. As

qemu can ensure the stub is loaded before execution starts, we do not

need to emulate the AST_SMP_MBOX_FIELD_READY behaviour of u-boot. The

secondary CPU's program counter points to the beginning of the stub,

allowing qemu to start secondaries at step four.

Reboot behaviour is preserved by resetting AST_SMP_MBOX_FIELD_GOSIGN

when the secondaries are reset.

This is only configured when the system is booted with -kernel and qemu

does not execute u-boot first.

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Tested-by: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Joel Stanley <joel@jms.id.au>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/aspeed.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 65 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/aspeed.c

+++ b/hw/arm/aspeed.c

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps max_ram_ops = {

.endianness = DEVICE_NATIVE_ENDIAN,

};

+#define AST_SMP_MAILBOX_BASE 0x1e6e2180

+#define AST_SMP_MBOX_FIELD_ENTRY (AST_SMP_MAILBOX_BASE + 0x0)

+#define AST_SMP_MBOX_FIELD_GOSIGN (AST_SMP_MAILBOX_BASE + 0x4)

+#define AST_SMP_MBOX_FIELD_READY (AST_SMP_MAILBOX_BASE + 0x8)

+#define AST_SMP_MBOX_FIELD_POLLINSN (AST_SMP_MAILBOX_BASE + 0xc)

+#define AST_SMP_MBOX_CODE (AST_SMP_MAILBOX_BASE + 0x10)

+#define AST_SMP_MBOX_GOSIGN 0xabbaab00

+

+static void aspeed_write_smpboot(ARMCPU *cpu,

+ const struct arm_boot_info *info)

+{

+ static const uint32_t poll_mailbox_ready[] = {

+ /*

+ * r2 = per-cpu go sign value

+ * r1 = AST_SMP_MBOX_FIELD_ENTRY

+ * r0 = AST_SMP_MBOX_FIELD_GOSIGN

+ */

+ 0xee100fb0, /* mrc p15, 0, r0, c0, c0, 5 */

+ 0xe21000ff, /* ands r0, r0, #255 */

+ 0xe59f201c, /* ldr r2, [pc, #28] */

+ 0xe1822000, /* orr r2, r2, r0 */

+

+ 0xe59f1018, /* ldr r1, [pc, #24] */

+ 0xe59f0018, /* ldr r0, [pc, #24] */

+

+ 0xe320f002, /* wfe */

+ 0xe5904000, /* ldr r4, [r0] */

+ 0xe1520004, /* cmp r2, r4 */

+ 0x1afffffb, /* bne <wfe> */

+ 0xe591f000, /* ldr pc, [r1] */

+ AST_SMP_MBOX_GOSIGN,

+ AST_SMP_MBOX_FIELD_ENTRY,

+ AST_SMP_MBOX_FIELD_GOSIGN,

+ };

+

+ rom_add_blob_fixed("aspeed.smpboot", poll_mailbox_ready,

+ sizeof(poll_mailbox_ready),

+ info->smp_loader_start);

+}

+

+static void aspeed_reset_secondary(ARMCPU *cpu,

+ const struct arm_boot_info *info)

+{

+ AddressSpace *as = arm_boot_address_space(cpu, info);

+ CPUState *cs = CPU(cpu);

+

+ /* info->smp_bootreg_addr */

+ address_space_stl_notdirty(as, AST_SMP_MBOX_FIELD_GOSIGN, 0,

+ MEMTXATTRS_UNSPECIFIED, NULL);

+ cpu_set_pc(cs, info->smp_loader_start);

+}

+

#define FIRMWARE_ADDR 0x0

static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,

@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)

}

}

+ if (machine->kernel_filename && bmc->soc.num_cpus > 1) {

+ /* With no u-boot we must set up a boot stub for the secondary CPU */

+ MemoryRegion *smpboot = g_new(MemoryRegion, 1);

+ memory_region_init_ram(smpboot, OBJECT(bmc), "aspeed.smpboot",

+ 0x80, &error_abort);

+ memory_region_add_subregion(get_system_memory(),

+ AST_SMP_MAILBOX_BASE, smpboot);

+

+ aspeed_board_binfo.write_secondary_boot = aspeed_write_smpboot;

+ aspeed_board_binfo.secondary_cpu_reset_hook = aspeed_reset_secondary;

+ aspeed_board_binfo.smp_loader_start = AST_SMP_MBOX_CODE;

+ }

+

aspeed_board_binfo.ram_size = ram_size;

aspeed_board_binfo.loader_start = sc->memmap[ASPEED_SDRAM];

aspeed_board_binfo.nb_cpus = bmc->soc.num_cpus;

--

2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Calling access_el3_aa32ns() works for AArch32 only cores

but it does not handle 32-bit EL2 on top of 64-bit EL3

for mixed 32/64-bit cores.

Merge access_el3_aa32ns_aa64any() into access_el3_aa32ns()

and only use the latter.

Fixes: 68e9c2fe65 ("target-arm: Add VTCR_EL2")

Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Message-id: 20200505141729.31930-2-edgar.iglesias@gmail.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/helper.c | 30 +++++++-----------------------

1 file changed, 7 insertions(+), 23 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void init_cpreg_list(ARMCPU *cpu)

}

/*

- * Some registers are not accessible if EL3.NS=0 and EL3 is using AArch32 but

- * they are accessible when EL3 is using AArch64 regardless of EL3.NS.

- *

- * access_el3_aa32ns: Used to check AArch32 register views.

- * access_el3_aa32ns_aa64any: Used to check both AArch32/64 register views.

+ * Some registers are not accessible from AArch32 EL3 if SCR.NS == 0.

*/

static CPAccessResult access_el3_aa32ns(CPUARMState *env,

const ARMCPRegInfo *ri,

bool isread)

{

- bool secure = arm_is_secure_below_el3(env);

-

- assert(!arm_el_is_aa64(env, 3));

- if (secure) {

+ if (!is_a64(env) && arm_current_el(env) == 3 &&

+ arm_is_secure_below_el3(env)) {

return CP_ACCESS_TRAP_UNCATEGORIZED;

}

return CP_ACCESS_OK;

}

-static CPAccessResult access_el3_aa32ns_aa64any(CPUARMState *env,

- const ARMCPRegInfo *ri,

- bool isread)

-{

- if (!arm_el_is_aa64(env, 3)) {

- return access_el3_aa32ns(env, ri, isread);

- }

- return CP_ACCESS_OK;

-}

-

/* Some secure-only AArch32 registers trap to EL3 if used from

* Secure EL1 (but are just ordinary UNDEF in other non-EL3 contexts).

* Note that an access from Secure EL1 can only happen if EL3 is AArch64.

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {

.access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },

{ .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,

- .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,

+ .access = PL2_RW, .accessfn = access_el3_aa32ns,

.type = ARM_CP_CONST, .resetvalue = 0 },

{ .name = "VTTBR", .state = ARM_CP_STATE_AA32,

.cp = 15, .opc1 = 6, .crm = 2,

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {

.type = ARM_CP_CONST, .resetvalue = 0 },

{ .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,

- .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,

+ .access = PL2_RW, .accessfn = access_el3_aa32ns,

.type = ARM_CP_CONST, .resetvalue = 0 },

{ .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

ARMCPRegInfo vpidr_regs[] = {

{ .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,

- .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,

+ .access = PL2_RW, .accessfn = access_el3_aa32ns,

.type = ARM_CP_CONST, .resetvalue = cpu->midr,

.fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },

{ .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,

- .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any,

+ .access = PL2_RW, .accessfn = access_el3_aa32ns,

.type = ARM_CP_NO_RAW,

.writefn = arm_cp_write_ignore, .readfn = mpidr_read },

REGINFO_SENTINEL

--

2.20.1

From: Joel Stanley <joel@jms.id.au>

There are minimal differences from Qemu's point of view between the A0

and A1 silicon revisions.

As the A1 exercises different code paths in u-boot it is desirable to

emulate that instead.

Signed-off-by: Joel Stanley <joel@jms.id.au>

Reviewed-by: Andrew Jeffery <andrew@aj.id.au>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Message-id: 20200504093703.261135-1-joel@jms.id.au

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/misc/aspeed_scu.h | 1 +

hw/arm/aspeed.c | 8 ++++----

hw/arm/aspeed_ast2600.c | 6 +++---

hw/misc/aspeed_scu.c | 11 +++++------

4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/misc/aspeed_scu.h

+++ b/include/hw/misc/aspeed_scu.h

@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {

#define AST2500_A0_SILICON_REV 0x04000303U

#define AST2500_A1_SILICON_REV 0x04010303U

#define AST2600_A0_SILICON_REV 0x05000303U

+#define AST2600_A1_SILICON_REV 0x05010303U

#define ASPEED_IS_AST2500(si_rev) ((((si_rev) >> 24) & 0xff) == 0x04)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/aspeed.c

+++ b/hw/arm/aspeed.c

@@ -XXX,XX +XXX,XX @@ struct AspeedBoardState {

/* Tacoma hardware value */

#define TACOMA_BMC_HW_STRAP1 0x00000000

-#define TACOMA_BMC_HW_STRAP2 0x00000000

+#define TACOMA_BMC_HW_STRAP2 0x00000040

/*

* The max ram region is for firmwares that scan the address space

@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc, void *data)

AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);

mc->desc = "Aspeed AST2600 EVB (Cortex A7)";

- amc->soc_name = "ast2600-a0";

+ amc->soc_name = "ast2600-a1";

amc->hw_strap1 = AST2600_EVB_HW_STRAP1;

amc->hw_strap2 = AST2600_EVB_HW_STRAP2;

amc->fmc_model = "w25q512jv";

@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_tacoma_class_init(ObjectClass *oc, void *data)

MachineClass *mc = MACHINE_CLASS(oc);

AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);

- mc->desc = "Aspeed AST2600 EVB (Cortex A7)";

- amc->soc_name = "ast2600-a0";

+ mc->desc = "OpenPOWER Tacoma BMC (Cortex A7)";

+ amc->soc_name = "ast2600-a1";

amc->hw_strap1 = TACOMA_BMC_HW_STRAP1;

amc->hw_strap2 = TACOMA_BMC_HW_STRAP2;

amc->fmc_model = "mx66l1g45g";

diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/aspeed_ast2600.c

+++ b/hw/arm/aspeed_ast2600.c

@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)

dc->realize = aspeed_soc_ast2600_realize;

- sc->name = "ast2600-a0";

+ sc->name = "ast2600-a1";

sc->cpu_type = ARM_CPU_TYPE_NAME("cortex-a7");

- sc->silicon_rev = AST2600_A0_SILICON_REV;

+ sc->silicon_rev = AST2600_A1_SILICON_REV;

sc->sram_size = 0x10000;

sc->spis_num = 2;

sc->ehcis_num = 2;

@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)

}

static const TypeInfo aspeed_soc_ast2600_type_info = {

- .name = "ast2600-a0",

+ .name = "ast2600-a1",

.parent = TYPE_ASPEED_SOC,

.instance_size = sizeof(AspeedSoCState),

.instance_init = aspeed_soc_ast2600_init,

diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/misc/aspeed_scu.c

+++ b/hw/misc/aspeed_scu.c

@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_silicon_revs[] = {

AST2500_A0_SILICON_REV,

AST2500_A1_SILICON_REV,

AST2600_A0_SILICON_REV,

+ AST2600_A1_SILICON_REV,

};

bool is_supported_silicon_rev(uint32_t silicon_rev)

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_ast2600_scu_ops = {

.valid.unaligned = false,

};

-static const uint32_t ast2600_a0_resets[ASPEED_AST2600_SCU_NR_REGS] = {

- [AST2600_SILICON_REV] = AST2600_SILICON_REV,

- [AST2600_SILICON_REV2] = AST2600_SILICON_REV,

- [AST2600_SYS_RST_CTRL] = 0xF7CFFEDC | 0x100,

+static const uint32_t ast2600_a1_resets[ASPEED_AST2600_SCU_NR_REGS] = {

+ [AST2600_SYS_RST_CTRL] = 0xF7C3FED8,

[AST2600_SYS_RST_CTRL2] = 0xFFFFFFFC,

- [AST2600_CLK_STOP_CTRL] = 0xEFF43E8B,

+ [AST2600_CLK_STOP_CTRL] = 0xFFFF7F8A,

[AST2600_CLK_STOP_CTRL2] = 0xFFF0FFF0,

[AST2600_SDRAM_HANDSHAKE] = 0x00000040, /* SoC completed DRAM init */

[AST2600_HPLL_PARAM] = 0x1000405F,

@@ -XXX,XX +XXX,XX @@ static void aspeed_2600_scu_class_init(ObjectClass *klass, void *data)

dc->desc = "ASPEED 2600 System Control Unit";

dc->reset = aspeed_ast2600_scu_reset;

- asc->resets = ast2600_a0_resets;

+ asc->resets = ast2600_a1_resets;

asc->calc_hpll = aspeed_2500_scu_calc_hpll; /* No change since AST2500 */

asc->apb_divider = 4;

asc->nr_regs = ASPEED_AST2600_SCU_NR_REGS;

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The NRF51 series SoC have 3 timer peripherals, each having

4 counters. To help differentiate which peripheral is accessed,

display the timer ID in the trace events.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200504072822.18799-4-f4bug@amsat.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/timer/nrf51_timer.h | 1 +

hw/arm/nrf51_soc.c | 5 +++++

hw/timer/nrf51_timer.c | 11 +++++++++--

hw/timer/trace-events | 4 ++--

4 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/include/hw/timer/nrf51_timer.h b/include/hw/timer/nrf51_timer.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/timer/nrf51_timer.h

+++ b/include/hw/timer/nrf51_timer.h

@@ -XXX,XX +XXX,XX @@ typedef struct NRF51TimerState {

MemoryRegion iomem;

qemu_irq irq;

+ uint8_t id;

QEMUTimer timer;

int64_t timer_start_ns;

int64_t update_counter_ns;

diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/nrf51_soc.c

+++ b/hw/arm/nrf51_soc.c

@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)

/* TIMER */

for (i = 0; i < NRF51_NUM_TIMERS; i++) {

+ object_property_set_uint(OBJECT(&s->timer[i]), i, "id", &err);

+ if (err) {

+ error_propagate(errp, err);

+ return;

+ }

object_property_set_bool(OBJECT(&s->timer[i]), true, "realized", &err);

if (err) {

error_propagate(errp, err);

diff --git a/hw/timer/nrf51_timer.c b/hw/timer/nrf51_timer.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/nrf51_timer.c

+++ b/hw/timer/nrf51_timer.c

@@ -XXX,XX +XXX,XX @@

#include "hw/arm/nrf51.h"

#include "hw/irq.h"

#include "hw/timer/nrf51_timer.h"

+#include "hw/qdev-properties.h"

#include "migration/vmstate.h"

#include "trace.h"

@@ -XXX,XX +XXX,XX @@ static uint64_t nrf51_timer_read(void *opaque, hwaddr offset, unsigned int size)

__func__, offset);

}

- trace_nrf51_timer_read(offset, r, size);

+ trace_nrf51_timer_read(s->id, offset, r, size);

return r;

}

@@ -XXX,XX +XXX,XX @@ static void nrf51_timer_write(void *opaque, hwaddr offset,

uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);

size_t idx;

- trace_nrf51_timer_write(offset, value, size);

+ trace_nrf51_timer_write(s->id, offset, value, size);

switch (offset) {

case NRF51_TIMER_TASK_START:

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_nrf51_timer = {

}

};

+static Property nrf51_timer_properties[] = {

+ DEFINE_PROP_UINT8("id", NRF51TimerState, id, 0),

+ DEFINE_PROP_END_OF_LIST(),

+};

+

static void nrf51_timer_class_init(ObjectClass *klass, void *data)

{

DeviceClass *dc = DEVICE_CLASS(klass);

dc->reset = nrf51_timer_reset;

dc->vmsd = &vmstate_nrf51_timer;

+ device_class_set_props(dc, nrf51_timer_properties);

}

static const TypeInfo nrf51_timer_info = {

diff --git a/hw/timer/trace-events b/hw/timer/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/trace-events

+++ b/hw/timer/trace-events

@@ -XXX,XX +XXX,XX @@ cmsdk_apb_dualtimer_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK

cmsdk_apb_dualtimer_reset(void) "CMSDK APB dualtimer: reset"

# nrf51_timer.c

-nrf51_timer_read(uint64_t addr, uint32_t value, unsigned size) "read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

-nrf51_timer_write(uint64_t addr, uint32_t value, unsigned size) "write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

+nrf51_timer_read(uint8_t timer_id, uint64_t addr, uint32_t value, unsigned size) "timer %u read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

+nrf51_timer_write(uint8_t timer_id, uint64_t addr, uint32_t value, unsigned size) "timer %u write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

# bcm2835_systmr.c

bcm2835_systmr_irq(bool enable) "timer irq state %u"

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add trace event to display timer's counter value updates.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200504072822.18799-5-f4bug@amsat.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/timer/nrf51_timer.c | 1 +

hw/timer/trace-events | 1 +

2 files changed, 2 insertions(+)

diff --git a/hw/timer/nrf51_timer.c b/hw/timer/nrf51_timer.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/nrf51_timer.c

+++ b/hw/timer/nrf51_timer.c

@@ -XXX,XX +XXX,XX @@ static void nrf51_timer_write(void *opaque, hwaddr offset,

idx = (offset - NRF51_TIMER_TASK_CAPTURE_0) / 4;

s->cc[idx] = s->counter;

+ trace_nrf51_timer_set_count(s->id, idx, s->counter);

}

break;

case NRF51_TIMER_EVENT_COMPARE_0 ... NRF51_TIMER_EVENT_COMPARE_3:

diff --git a/hw/timer/trace-events b/hw/timer/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/trace-events

+++ b/hw/timer/trace-events

@@ -XXX,XX +XXX,XX @@ cmsdk_apb_dualtimer_reset(void) "CMSDK APB dualtimer: reset"

# nrf51_timer.c

nrf51_timer_read(uint8_t timer_id, uint64_t addr, uint32_t value, unsigned size) "timer %u read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

nrf51_timer_write(uint8_t timer_id, uint64_t addr, uint32_t value, unsigned size) "timer %u write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

+nrf51_timer_set_count(uint8_t timer_id, uint8_t counter_id, uint32_t value) "timer %u counter %u count 0x%" PRIx32

# bcm2835_systmr.c

bcm2835_systmr_irq(bool enable) "timer irq state %u"

--

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200508154359.7494-2-richard.henderson@linaro.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/core/cpu.h | 23 +++++++++++++++++++++++

1 file changed, 23 insertions(+)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/core/cpu.h

+++ b/include/hw/core/cpu.h

@@ -XXX,XX +XXX,XX @@ int cpu_watchpoint_remove(CPUState *cpu, vaddr addr,

vaddr len, int flags);

void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint);

void cpu_watchpoint_remove_all(CPUState *cpu, int mask);

+

+/**

+ * cpu_check_watchpoint:

+ * @cpu: cpu context

+ * @addr: guest virtual address

+ * @len: access length

+ * @attrs: memory access attributes

+ * @flags: watchpoint access type

+ * @ra: unwind return address

+ *

+ * Check for a watchpoint hit in [addr, addr+len) of the type

+ * specified by @flags. Exit via exception with a hit.

+ */

void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,

MemTxAttrs attrs, int flags, uintptr_t ra);

+

+/**

+ * cpu_watchpoint_address_matches:

+ * @cpu: cpu context

+ * @addr: guest virtual address

+ * @len: access length

+ *

+ * Return the watchpoint flags that apply to [addr, addr+len).

+ * If no watchpoint is registered for the range, the result is 0.

+ */

int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len);

#endif

--

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200508154359.7494-4-richard.henderson@linaro.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/exec/exec-all.h | 17 +++++++++++++++++

1 file changed, 17 insertions(+)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h

index XXXXXXX..XXXXXXX 100644

--- a/include/exec/exec-all.h

+++ b/include/exec/exec-all.h

@@ -XXX,XX +XXX,XX @@ static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,

{

}

#endif

+/**

+ * probe_access:

+ * @env: CPUArchState

+ * @addr: guest virtual address to look up

+ * @size: size of the access

+ * @access_type: read, write or execute permission

+ * @mmu_idx: MMU index to use for lookup

+ * @retaddr: return address for unwinding

+ *

+ * Look up the guest virtual address @addr. Raise an exception if the

+ * page does not satisfy @access_type. Raise an exception if the

+ * access (@addr, @size) hits a watchpoint. For writes, mark a clean

+ * page as dirty.

+ *

+ * Finally, return the host address for a page that is backed by RAM,

+ * or NULL if the page requires I/O.

+ */

void *probe_access(CPUArchState *env, target_ulong addr, int size,

MMUAccessType access_type, int mmu_idx, uintptr_t retaddr);

--

2.20.1