Some more outstanding target-arm patches; nothing terribly

exciting. Mostly they're mine; I'm trying to reduce the

number of patches I still have in flight, so I've picked

out some of the reviewed patches from a couple of sets I've

sent out and will resend v2 versions of those sets with the

remaining patches with fixes for issues noted in review once

this is in master.

The following changes since commit adaec191bfb31e12d40af8ab1b869f5b40d61ee9:

Merge remote-tracking branch 'remotes/ehabkost/tags/machine-next-pull-request' into staging (2018-08-20 09:48:03 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180820

for you to fetch changes up to b85fad1588e812566f897f747e38da345a7016d6:

hw/dma/pl080: Remove hw_error() if DMA is enabled (2018-08-20 11:24:33 +0100)

* Fix crash on conditional instruction in an IT block

* docs/generic-loader: mention U-Boot and Intel HEX executable formats

* hw/intc/arm_gicv3_its: downgrade error_report to warn_report in kvm_arm_its_reset

* imx_serial: Generate interrupt on receive data ready if enabled

* Fix various minor bugs in AArch32 Hyp related coprocessor registers

* Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)

* Implement AArch32 ERET instruction

* hw/arm/virt: Add virt-3.1 machine type

* sdhci: add i.MX SD Stable Clock bit

* Remove now-obsolete MMIO request_ptr APIs

* hw/timer/m48t59: Move away from old_mmio accessors

* hw/watchdog/cmsdk_apb_watchdog: Implement CMSDK APB watchdog module

* nvic: Expose NMI line

* hw/dma/pl080: cleanups and new features required for use in MPS boards

Andrew Jones (1):

hw/arm/virt: Add virt-3.1 machine type

Hans-Erik Floryd (2):

imx_serial: Generate interrupt on receive data ready if enabled

sdhci: add i.MX SD Stable Clock bit

Jia He (1):

hw/intc/arm_gicv3_its: downgrade error_report to warn_report in kvm_arm_its_reset

Peter Maydell (19):

target/arm: Correct typo in HAMAIR1 regdef name

target/arm: Add missing .cp = 15 to HMAIR1 and HAMAIR1 regdefs

target/arm: Implement AArch32 HVBAR

target/arm: Implement AArch32 Hyp FARs

target/arm: Implement ESR_EL2/HSR for AArch32 and no-EL2

target/arm: Permit accesses to ELR_Hyp from Hyp mode via MSR/MRS (banked)

target/arm: Implement AArch32 ERET instruction

hw/ssi/xilinx_spips: Remove unneeded MMIO request_ptr code

memory: Remove MMIO request_ptr APIs

hw/misc: Remove mmio_interface device

hw/timer/m48t59: Move away from old_mmio accessors

hw/watchdog/cmsdk_apb_watchdog: Implement CMSDK APB watchdog module

nvic: Expose NMI line

hw/dma/pl080: Allow use as embedded-struct device

hw/dma/pl080: Support all three interrupt lines

hw/dma/pl080: Don't use CPU address space for DMA accesses

hw/dma/pl080: Provide device reset function

hw/dma/pl080: Correct bug in register address decode logic

hw/dma/pl080: Remove hw_error() if DMA is enabled

Roman Kapl (1):

target/arm: Fix crash on conditional instruction in an IT block

Stefan Hajnoczi (1):

docs/generic-loader: mention U-Boot and Intel HEX executable formats

docs/generic-loader.txt | 20 +-

Makefile.objs | 1 +

hw/misc/Makefile.objs | 1 -

hw/watchdog/Makefile.objs | 1 +

hw/sd/sdhci-internal.h | 2 +

include/exec/memory.h | 35 ----

include/hw/char/imx_serial.h | 1 +

include/hw/dma/pl080.h | 71 +++++++

include/hw/misc/mmio_interface.h | 49 -----

include/hw/watchdog/cmsdk-apb-watchdog.h | 59 ++++++

hw/arm/armv7m.c | 1 +

hw/arm/realview.c | 8 +-

hw/arm/versatilepb.c | 9 +-

hw/arm/virt.c | 23 ++-

hw/char/imx_serial.c | 3 +-

hw/dma/pl080.c | 113 ++++++-----

hw/intc/arm_gicv3_its_kvm.c | 2 +-

hw/intc/armv7m_nvic.c | 19 ++

hw/misc/mmio_interface.c | 135 -------------

hw/sd/sdhci.c | 8 +

hw/ssi/xilinx_spips.c | 46 -----

hw/timer/m48t59.c | 59 ++----

hw/watchdog/cmsdk-apb-watchdog.c | 326 +++++++++++++++++++++++++++++++

memory.c | 110 -----------

target/arm/helper.c | 36 +++-

target/arm/op_helper.c | 22 +--

target/arm/translate.c | 76 +++++--

MAINTAINERS | 3 +

default-configs/arm-softmmu.mak | 1 +

hw/intc/trace-events | 1 +

hw/watchdog/trace-events | 6 +

31 files changed, 717 insertions(+), 530 deletions(-)

create mode 100644 include/hw/dma/pl080.h

delete mode 100644 include/hw/misc/mmio_interface.h

create mode 100644 include/hw/watchdog/cmsdk-apb-watchdog.h

delete mode 100644 hw/misc/mmio_interface.c

create mode 100644 hw/watchdog/cmsdk-apb-watchdog.c

create mode 100644 hw/watchdog/trace-events

ARMCPRegInfo structs will default to .cp = 15 if they

are ARM_CP_STATE_BOTH, but not if they are ARM_CP_STATE_AA32

(because a coprocessor number of 0 is valid for AArch32).

We forgot to explicitly set .cp = 15 for the HMAIR1 and

HAMAIR1 regdefs, which meant they would UNDEF when the guest

tried to access them under cp15.

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20180814124254.5229-3-peter.maydell@linaro.org

target/arm/helper.c | 8 ++++----

1 file changed, 4 insertions(+), 4 deletions(-)

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

{ .name = "HMAIR1", .state = ARM_CP_STATE_AA32,

- .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,

+ .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,

.access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },

{ .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,

.opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

{ .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,

- .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,

+ .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

{ .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {

.access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.mair_el[2]),

.resetvalue = 0 },

{ .name = "HMAIR1", .state = ARM_CP_STATE_AA32,

- .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,

+ .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,

.access = PL2_RW, .type = ARM_CP_ALIAS,

.fieldoffset = offsetofhigh32(CPUARMState, cp15.mair_el[2]) },

{ .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {

.resetvalue = 0 },

/* HAMAIR1 is mapped to AMAIR_EL2[63:32] */

{ .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,

- .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,

+ .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

{ .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,

2.18.0

We implement the HAMAIR1 register as RAZ/WI; we had a typo in the

regdef, though, and were incorrectly naming it HMAIR1 (which is

a different register which we also implement as RAZ/WI).

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20180814124254.5229-2-peter.maydell@linaro.org

target/arm/helper.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {

.opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

- { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,

+ { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,

.opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

/* HAMAIR1 is mapped to AMAIR_EL2[63:32] */

- { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,

+ { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,

.opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,

.access = PL2_RW, .type = ARM_CP_CONST,

.resetvalue = 0 },

2.18.0

The PL08x model currently will unconditionally call hw_error()

if the DMA engine is enabled by the guest. This has been

present since the PL080 model was edded in 2006, and is

presumably either unintentional debug code left enabled,

or a guard against untested DMA engine code being used.

Remove the hw_error(), since we now have a guest which

will actually try to use the DMA engine (the self-test

binary for the AN505 MPS2 FPGA image).

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

hw/dma/pl080.c | 1 -

1 file changed, 1 deletion(-)

diff --git a/hw/dma/pl080.c b/hw/dma/pl080.c

--- a/hw/dma/pl080.c

+++ b/hw/dma/pl080.c

@@ -XXX,XX +XXX,XX @@ static void pl080_run(PL080State *s)

if ((s->conf & PL080_CONF_E) == 0)

return;

-hw_error("DMA active\n");

/* If we are already in the middle of a DMA operation then indicate that

there may be new DMA requests and return immediately. */

if (s->running) {

2.18.0

Move the m48t59 device away from using old_mmio MemoryRegionOps

accessors.

Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

Message-id: 20180802180602.22047-1-peter.maydell@linaro.org

hw/timer/m48t59.c | 59 +++++++++--------------------------------------

1 file changed, 11 insertions(+), 48 deletions(-)

diff --git a/hw/timer/m48t59.c b/hw/timer/m48t59.c

--- a/hw/timer/m48t59.c

+++ b/hw/timer/m48t59.c

@@ -XXX,XX +XXX,XX @@ static uint64_t NVRAM_readb(void *opaque, hwaddr addr, unsigned size)

return retval;

-static void nvram_writeb (void *opaque, hwaddr addr, uint32_t value)

- M48t59State *NVRAM = opaque;

-

- m48t59_write(NVRAM, addr, value & 0xff);

-static void nvram_writew (void *opaque, hwaddr addr, uint32_t value)

- M48t59State *NVRAM = opaque;

-

- m48t59_write(NVRAM, addr, (value >> 8) & 0xff);

- m48t59_write(NVRAM, addr + 1, value & 0xff);

-static void nvram_writel (void *opaque, hwaddr addr, uint32_t value)

- M48t59State *NVRAM = opaque;

-

- m48t59_write(NVRAM, addr, (value >> 24) & 0xff);

- m48t59_write(NVRAM, addr + 1, (value >> 16) & 0xff);

- m48t59_write(NVRAM, addr + 2, (value >> 8) & 0xff);

- m48t59_write(NVRAM, addr + 3, value & 0xff);

-static uint32_t nvram_readb (void *opaque, hwaddr addr)

+static uint64_t nvram_read(void *opaque, hwaddr addr, unsigned size)

M48t59State *NVRAM = opaque;

return m48t59_read(NVRAM, addr);

-static uint32_t nvram_readw (void *opaque, hwaddr addr)

+static void nvram_write(void *opaque, hwaddr addr, uint64_t value,

+ unsigned size)

M48t59State *NVRAM = opaque;

- uint32_t retval;

- retval = m48t59_read(NVRAM, addr) << 8;

- retval |= m48t59_read(NVRAM, addr + 1);

- return retval;

-static uint32_t nvram_readl (void *opaque, hwaddr addr)

-{

- M48t59State *NVRAM = opaque;

- uint32_t retval;

-

- retval = m48t59_read(NVRAM, addr) << 24;

- retval |= m48t59_read(NVRAM, addr + 1) << 16;

- retval |= m48t59_read(NVRAM, addr + 2) << 8;

- retval |= m48t59_read(NVRAM, addr + 3);

- return retval;

+ return m48t59_write(NVRAM, addr, value);

}

static const MemoryRegionOps nvram_ops = {

- .old_mmio = {

- .read = { nvram_readb, nvram_readw, nvram_readl, },

- .write = { nvram_writeb, nvram_writew, nvram_writel, },

- },

- .endianness = DEVICE_NATIVE_ENDIAN,

+ .read = nvram_read,

+ .write = nvram_write,

+ .impl.min_access_size = 1,

+ .impl.max_access_size = 1,

+ .valid.min_access_size = 1,

+ .valid.max_access_size = 4,

+ .endianness = DEVICE_BIG_ENDIAN,

};

static const VMStateDescription vmstate_m48t59 = {

2.18.0

From: Roman Kapl <rka@sysgo.com>

If an instruction is conditional (like CBZ) and it is executed

conditionally (using the ITx instruction), a jump to an undefined

label is generated, and QEMU crashes.

CBZ in IT block is an UNPREDICTABLE behavior, but we should not

crash. Honouring the condition code is allowed by the spec in this

case (constrained unpredictable, ARMv8, section K1.1.7), and matches

what we do for other "UNPREDICTABLE inside an IT block" instructions.

Fix the 'skip on condition' code to create a new label only if it

does not already exist. Previously multiple labels were created, but

only the last one of them was set.

Signed-off-by: Roman Kapl <rka@sysgo.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20180816120533.6587-1-rka@sysgo.com

[PMM: fixed ^ 1 being applied to wrong argument, fixed typo]

target/arm/translate.c | 35 +++++++++++++++++++++--------------

1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,

s->base.is_jmp = DISAS_UPDATE;

+/* Generate a label used for skipping this instruction */

+static void arm_gen_condlabel(DisasContext *s)

+{

+ if (!s->condjmp) {

+ s->condlabel = gen_new_label();

+ s->condjmp = 1;

+}

+

+/* Skip this instruction if the ARM condition is false */

+static void arm_skip_unless(DisasContext *s, uint32_t cond)

+{

+ arm_gen_condlabel(s);

+ arm_gen_test_cc(cond ^ 1, s->condlabel);

+}

+

static void disas_arm_insn(DisasContext *s, unsigned int insn)

{

unsigned int cond, val, op1, i, shift, rm, rs, rn, rd, sh;

@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)

if (cond != 0xe) {

/* if not always execute, we generate a conditional jump to

next instruction */

- s->condlabel = gen_new_label();

- arm_gen_test_cc(cond ^ 1, s->condlabel);

- s->condjmp = 1;

+ arm_skip_unless(s, cond);

}

if ((insn & 0x0f900000) == 0x03000000) {

if ((insn & (1 << 21)) == 0) {

@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)

/* Conditional branch. */

op = (insn >> 22) & 0xf;

/* Generate a conditional jump to next instruction. */

- s->condlabel = gen_new_label();

- arm_gen_test_cc(op ^ 1, s->condlabel);

- s->condjmp = 1;

+ arm_skip_unless(s, op);

/* offset[11:1] = insn[10:0] */

offset = (insn & 0x7ff) << 1;

@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(DisasContext *s, uint32_t insn)

case 1: case 3: case 9: case 11: /* czb */

rm = insn & 7;

tmp = load_reg(s, rm);

- s->condlabel = gen_new_label();

- s->condjmp = 1;

+ arm_gen_condlabel(s);