Some more outstanding target-arm patches; nothing terribly

exciting. Mostly they're mine; I'm trying to reduce the

number of patches I still have in flight, so I've picked

out some of the reviewed patches from a couple of sets I've

sent out and will resend v2 versions of those sets with the

remaining patches with fixes for issues noted in review once

this is in master.

The following changes since commit adaec191bfb31e12d40af8ab1b869f5b40d61ee9:

Merge remote-tracking branch 'remotes/ehabkost/tags/machine-next-pull-request' into staging (2018-08-20 09:48:03 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180820

for you to fetch changes up to b85fad1588e812566f897f747e38da345a7016d6:

hw/dma/pl080: Remove hw_error() if DMA is enabled (2018-08-20 11:24:33 +0100)

* Fix crash on conditional instruction in an IT block

* docs/generic-loader: mention U-Boot and Intel HEX executable formats

* hw/intc/arm_gicv3_its: downgrade error_report to warn_report in kvm_arm_its_reset

* imx_serial: Generate interrupt on receive data ready if enabled

* Fix various minor bugs in AArch32 Hyp related coprocessor registers

* Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)

* Implement AArch32 ERET instruction

* hw/arm/virt: Add virt-3.1 machine type

* sdhci: add i.MX SD Stable Clock bit

* Remove now-obsolete MMIO request_ptr APIs

* hw/timer/m48t59: Move away from old_mmio accessors

* hw/watchdog/cmsdk_apb_watchdog: Implement CMSDK APB watchdog module

* nvic: Expose NMI line

* hw/dma/pl080: cleanups and new features required for use in MPS boards

Andrew Jones (1):

hw/arm/virt: Add virt-3.1 machine type

Hans-Erik Floryd (2):

imx_serial: Generate interrupt on receive data ready if enabled

sdhci: add i.MX SD Stable Clock bit

Jia He (1):

hw/intc/arm_gicv3_its: downgrade error_report to warn_report in kvm_arm_its_reset

Peter Maydell (19):

target/arm: Correct typo in HAMAIR1 regdef name

target/arm: Add missing .cp = 15 to HMAIR1 and HAMAIR1 regdefs

target/arm: Implement AArch32 HVBAR

target/arm: Implement AArch32 Hyp FARs

target/arm: Implement ESR_EL2/HSR for AArch32 and no-EL2

target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)

target/arm: Implement AArch32 ERET instruction

hw/ssi/xilinx_spips: Remove unneeded MMIO request_ptr code

memory: Remove MMIO request_ptr APIs

hw/misc: Remove mmio_interface device

hw/timer/m48t59: Move away from old_mmio accessors

hw/watchdog/cmsdk_apb_watchdog: Implement CMSDK APB watchdog module

nvic: Expose NMI line

hw/dma/pl080: Allow use as embedded-struct device

hw/dma/pl080: Support all three interrupt lines

hw/dma/pl080: Don't use CPU address space for DMA accesses

hw/dma/pl080: Provide device reset function

hw/dma/pl080: Correct bug in register address decode logic

hw/dma/pl080: Remove hw_error() if DMA is enabled

Roman Kapl (1):

target/arm: Fix crash on conditional instruction in an IT block

Stefan Hajnoczi (1):

docs/generic-loader: mention U-Boot and Intel HEX executable formats

From: Roman Kapl <rka@sysgo.com>

If an instruction is conditional (like CBZ) and it is executed

conditionally (using the ITx instruction), a jump to an undefined

label is generated, and QEMU crashes.

CBZ in IT block is an UNPREDICTABLE behavior, but we should not

crash. Honouring the condition code is allowed by the spec in this

case (constrained unpredictable, ARMv8, section K1.1.7), and matches

what we do for other "UNPREDICTABLE inside an IT block" instructions.

Fix the 'skip on condition' code to create a new label only if it

does not already exist. Previously multiple labels were created, but

only the last one of them was set.

Signed-off-by: Roman Kapl <rka@sysgo.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180816120533.6587-1-rka@sysgo.com

[PMM: fixed ^ 1 being applied to wrong argument, fixed typo]

target/arm/translate.c | 35 +++++++++++++++++++++--------------

1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,

s->base.is_jmp = DISAS_UPDATE;

+/* Generate a label used for skipping this instruction */

+static void arm_gen_condlabel(DisasContext *s)

+{

+ if (!s->condjmp) {

+ s->condlabel = gen_new_label();

+ s->condjmp = 1;

+ }

+}

+

+/* Skip this instruction if the ARM condition is false */

+static void arm_skip_unless(DisasContext *s, uint32_t cond)

+{

+ arm_gen_condlabel(s);

+ arm_gen_test_cc(cond ^ 1, s->condlabel);

+}

+

static void disas_arm_insn(DisasContext *s, unsigned int insn)

{

unsigned int cond, val, op1, i, shift, rm, rs, rn, rd, sh;

@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)

if (cond != 0xe) {

/* if not always execute, we generate a conditional jump to

next instruction */

- s->condlabel = gen_new_label();

- arm_gen_test_cc(cond ^ 1, s->condlabel);

- s->condjmp = 1;

+ arm_skip_unless(s, cond);

}

if ((insn & 0x0f900000) == 0x03000000) {

if ((insn & (1 << 21)) == 0) {

@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)

/* Conditional branch. */

op = (insn >> 22) & 0xf;

/* Generate a conditional jump to next instruction. */

- s->condlabel = gen_new_label();

- arm_gen_test_cc(op ^ 1, s->condlabel);

- s->condjmp = 1;

+ arm_skip_unless(s, op);

/* offset[11:1] = insn[10:0] */

offset = (insn & 0x7ff) << 1;

@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)

case 1: case 3: case 9: case 11: /* czb */

rm = insn & 7;

tmp = load_reg(s, rm);

- s->condlabel = gen_new_label();

- s->condjmp = 1;

+ arm_gen_condlabel(s);

if (insn & (1 << 11))

tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, s->condlabel);

else

@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)

break;

}

/* generate a conditional jump to next instruction */

- s->condlabel = gen_new_label();

- arm_gen_test_cc(cond ^ 1, s->condlabel);

- s->condjmp = 1;

+ arm_skip_unless(s, cond);

/* jump to the offset */

val = (uint32_t)s->pc + 2;

@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)

uint32_t cond = dc->condexec_cond;

if (cond != 0x0e) { /* Skip conditional when condition is AL. */

- dc->condlabel = gen_new_label();

- arm_gen_test_cc(cond ^ 1, dc->condlabel);

- dc->condjmp = 1;

+ arm_skip_unless(dc, cond);

}

}

2.18.0

Implement the AArch32 HVBAR register; we can do this just by

making the existing VBAR_EL2 regdefs be STATE_BOTH.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20180814124254.5229-5-peter.maydell@linaro.org

target/arm/helper.c | 4 ++--

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {

/* Used to describe the behaviour of EL2 regs when EL2 does not exist. */

static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {

- { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,

+ { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,

.access = PL2_RW,

.readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {

.opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,

.access = PL2_RW,

.fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) },

- { .name = "VBAR_EL2", .state = ARM_CP_STATE_AA64,

+ { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,

.access = PL2_RW, .writefn = vbar_write,

.fieldoffset = offsetof(CPUARMState, cp15.vbar_el[2]),

2.18.0

The MSR (banked) and MRS (banked) instructions allow accesses to ELR_Hyp

from either Monitor or Hyp mode. Our translate time check

was overly strict and only permitted access from Monitor mode.

The runtime check we do in msr_mrs_banked_exc_checks() had the

correct code in it, but never got there because of the earlier

"currmode == tgtmode" check. Special case ELR_Hyp.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20180814124254.5229-9-peter.maydell@linaro.org

target/arm/op_helper.c | 22 +++++++++++-----------

target/arm/translate.c | 10 +++++++---

2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c

--- a/target/arm/op_helper.c

+++ b/target/arm/op_helper.c

@@ -XXX,XX +XXX,XX @@ static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,

*/

int curmode = env->uncached_cpsr & CPSR_M;

+ if (regno == 17) {

+ /* ELR_Hyp: a special case because access from tgtmode is OK */

+ if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {

+ goto undef;

+ }

+ return;

+ }

+

if (curmode == tgtmode) {

goto undef;

}

@@ -XXX,XX +XXX,XX @@ static void msr_mrs_banked_exc_checks(CPUARMState *env, uint32_t tgtmode,

}

if (tgtmode == ARM_CPU_MODE_HYP) {

- switch (regno) {

- case 17: /* ELR_Hyp */

- if (curmode != ARM_CPU_MODE_HYP && curmode != ARM_CPU_MODE_MON) {

- goto undef;

- }

- break;

- default:

- if (curmode != ARM_CPU_MODE_MON) {

- goto undef;

- }

- break;

+ /* SPSR_Hyp, r13_hyp: accessible from Monitor mode only */

+ if (curmode != ARM_CPU_MODE_MON) {

+ goto undef;

2.18.0

From: Andrew Jones <drjones@redhat.com>

Signed-off-by: Andrew Jones <drjones@redhat.com>

Reviewed-by: Igor Mammedov <imammedo@redhat.com>

hw/arm/virt.c | 23 +++++++++++++++++------

1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void machvirt_machine_init(void)

}

type_init(machvirt_machine_init);

-#define VIRT_COMPAT_2_12 \

- HW_COMPAT_2_12

-

-static void virt_3_0_instance_init(Object *obj)

+static void virt_3_1_instance_init(Object *obj)

{

VirtMachineState *vms = VIRT_MACHINE(obj);

VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);

@@ -XXX,XX +XXX,XX @@ static void virt_3_0_instance_init(Object *obj)

vms->irqmap = a15irqmap;

}

-static void virt_machine_3_0_options(MachineClass *mc)

+static void virt_machine_3_1_options(MachineClass *mc)

{

}

-DEFINE_VIRT_MACHINE_AS_LATEST(3, 0)

+DEFINE_VIRT_MACHINE_AS_LATEST(3, 1)

+

+static void virt_3_0_instance_init(Object *obj)

+{

+ virt_3_1_instance_init(obj);

+}

+

+static void virt_machine_3_0_options(MachineClass *mc)

+{

+ virt_machine_3_1_options(mc);

+}

+DEFINE_VIRT_MACHINE(3, 0)

+

+#define VIRT_COMPAT_2_12 \

+ HW_COMPAT_2_12

static void virt_2_12_instance_init(Object *obj)

2.18.0

From: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>

Add the ESDHC PRSSTAT_SDSTB bit, using the value of SDHC_CLOCK_INT_STABLE.

Freescale recommends checking this bit when changing clock frequency.

Signed-off-by: Hans-Erik Floryd <hans-erik.floryd@rt-labs.com>

Message-id: 1534507843-4251-1-git-send-email-hans-erik.floryd@rt-labs.com

[PMM: fixed indentation]

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

hw/sd/sdhci-internal.h | 2 ++

hw/sd/sdhci.c | 8 ++++++++

2 files changed, 10 insertions(+)

diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h

--- a/hw/sd/sdhci-internal.h

+++ b/hw/sd/sdhci-internal.h

@@ -XXX,XX +XXX,XX @@ extern const VMStateDescription sdhci_vmstate;

#define ESDHC_CTRL_4BITBUS (0x1 << 1)

#define ESDHC_CTRL_8BITBUS (0x2 << 1)

+#define ESDHC_PRNSTS_SDSTB (1 << 3)

#endif

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c

--- a/hw/sd/sdhci.c

+++ b/hw/sd/sdhci.c

@@ -XXX,XX +XXX,XX @@ static uint64_t usdhc_read(void *opaque, hwaddr offset, unsigned size)

+ case SDHC_PRNSTS:

+ /* Add SDSTB (SD Clock Stable) bit to PRNSTS */

+ ret = sdhci_read(opaque, offset, size) & ~ESDHC_PRNSTS_SDSTB;

+ if (s->clkcon & SDHC_CLOCK_INT_STABLE) {

+ ret |= ESDHC_PRNSTS_SDSTB;

+

case ESDHC_DLL_CTRL:

case ESDHC_TUNE_CTRL_STATUS:

case ESDHC_UNDOCUMENTED_REG27:

2.18.0

The mmio_interface device was a purely internal artifact

of the implementation of the memory subsystem's request_ptr

APIs. Now that we have removed those APIs, we can remove

the mmio_interface device too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com>

Message-id: 20180817114619.22354-4-peter.maydell@linaro.org