Nothing too exciting, but does include the last bits of v8.1M support work.

-- PMM

The following changes since commit e79de63ab1bd1f6550e7b915e433bec1ad1a870a:

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210107' into staging (2021-01-07 20:34:05 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210108

for you to fetch changes up to c9f8511ea8d2b80723af0fea1f716d752c1b5208:

docs/system: arm: Add sabrelite board description (2021-01-08 15:13:39 +0000)

* intc/arm_gic: Fix gic_irq_signaling_enabled() for vCPUs

* target/arm: Fix MTE0_ACTIVE

* target/arm: Implement v8.1M and Cortex-M55 model

* hw/arm/highbank: Drop dead KVM support code

* util/qemu-timer: Make timer_free() imply timer_del()

* various devices: Use ptimer_free() in finalize function

* docs/system: arm: Add sabrelite board description

* sabrelite: Minor fixes to allow booting U-Boot

Andrew Jones (1):

hw/arm/virt: Remove virt machine state 'smp_cpus'

Bin Meng (4):

hw/misc: imx6_ccm: Update PMU_MISC0 reset value

hw/msic: imx6_ccm: Correct register value for silicon type

hw/arm: sabrelite: Connect the Ethernet PHY at address 6

docs/system: arm: Add sabrelite board description

Edgar E. Iglesias (1):

intc/arm_gic: Fix gic_irq_signaling_enabled() for vCPUs

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

hw/intc/arm_gic.c | 4 +++-

1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c

--- a/hw/intc/arm_gic.c

+++ b/hw/intc/arm_gic.c

@@ -XXX,XX +XXX,XX @@ static inline void gic_get_best_virq(GICState *s, int cpu,

static inline bool gic_irq_signaling_enabled(GICState *s, int cpu, bool virt,

int group_mask)

{

+ int cpu_iface = virt ? (cpu + GIC_NCPU) : cpu;

+

if (!virt && !(s->ctlr & group_mask)) {

return false;

@@ -XXX,XX +XXX,XX @@ static inline bool gic_irq_signaling_enabled(GICState *s, int cpu, bool virt,

return false;

- if (!(s->cpu_ctlr[cpu] & group_mask)) {

+ if (!(s->cpu_ctlr[cpu_iface] & group_mask)) {

return false;

From: Richard Henderson <richard.henderson@linaro.org>

In 50244cc76abc we updated mte_check_fail to match the ARM

pseudocode, using the correct EL to select the TCF field.

But we failed to update MTE0_ACTIVE the same way, which led

to g_assert_not_reached().

Cc: qemu-stable@nongnu.org

Buglink: https://bugs.launchpad.net/bugs/1907137

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20201221204426.88514-1-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/helper.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ static uint32_t rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,

if (FIELD_EX32(flags, TBFLAG_A64, UNPRIV)

&& tbid

&& !(env->pstate & PSTATE_TCO)

- && (sctlr & SCTLR_TCF0)

+ && (sctlr & SCTLR_TCF)

&& allocation_tag_access_enabled(env, 0, sctlr)) {

flags = FIELD_DP32(flags, TBFLAG_A64, MTE0_ACTIVE, 1);

The CCR is a register most of whose bits are banked between security

states but where BFHFNMIGN is not, and we keep it in the non-secure

entry of the v7m.ccr[] array. The logic which tries to handle this

bit fails to implement the "RAZ/WI from Nonsecure if AIRCR.BFHFNMINS

is zero" requirement; correct the omission.

Message-id: 20201210201433.26262-2-peter.maydell@linaro.org

hw/intc/armv7m_nvic.c | 15 +++++++++++++++

1 file changed, 15 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)

*/

val = cpu->env.v7m.ccr[attrs.secure];

val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;

+ /* BFHFNMIGN is RAZ/WI from NS if AIRCR.BFHFNMINS is 0 */

+ if (!attrs.secure) {

+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {

+ val &= ~R_V7M_CCR_BFHFNMIGN_MASK;

+ }

+ }

return val;

case 0xd24: /* System Handler Control and State (SHCSR) */

if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {

@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,

(cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)

| (value & R_V7M_CCR_BFHFNMIGN_MASK);

value &= ~R_V7M_CCR_BFHFNMIGN_MASK;

+ } else {

+ /*

+ * BFHFNMIGN is RAZ/WI from NS if AIRCR.BFHFNMINS is 0, so

+ * preserve the state currently in the NS element of the array

+ */

+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {

+ value &= ~R_V7M_CCR_BFHFNMIGN_MASK;

+ value |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;

+ }

}

cpu->env.v7m.ccr[attrs.secure] = value;

Implement the v8.1M FPCXT_NS floating-point system register. This is

a little more complicated than FPCXT_S, because it has specific

handling for "current FP state is inactive", and it only wants to do

PreserveFPState(), not the full set of actions done by

ExecuteFPCheck() which vfp_access_check() implements.

Message-id: 20201210201433.26262-4-peter.maydell@linaro.org

target/arm/translate-vfp.c.inc | 102 ++++++++++++++++++++++++++++++++-

1 file changed, 99 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc

--- a/target/arm/translate-vfp.c.inc

+++ b/target/arm/translate-vfp.c.inc

@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)

case ARM_VFP_FPCXT_S:

+ case ARM_VFP_FPCXT_NS:

if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {

return false;

}

@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)

return FPSysRegCheckFailed;

}

- if (!vfp_access_check(s)) {

+ /*

+ * FPCXT_NS is a special case: it has specific handling for

+ * "current FP state is inactive", and must do the PreserveFPState()

+ * but not the usual full set of actions done by ExecuteFPCheck().

+ * So we don't call vfp_access_check() and the callers must handle this.

+ */

+ if (regno != ARM_VFP_FPCXT_NS && !vfp_access_check(s)) {

return FPSysRegCheckDone;

}

-

return FPSysRegCheckContinue;

+static void gen_branch_fpInactive(DisasContext *s, TCGCond cond,

+ TCGLabel *label)

+ /*

+ * FPCXT_NS is a special case: it has specific handling for

+ * "current FP state is inactive", and must do the PreserveFPState()

+ * but not the usual full set of actions done by ExecuteFPCheck().

+ * We don't have a TB flag that matches the fpInactive check, so we

+ * do it at runtime as we don't expect FPCXT_NS accesses to be frequent.

+ *

+ * Emit code that checks fpInactive and does a conditional

+ * branch to label based on it:

+ * if cond is TCG_COND_NE then branch if fpInactive != 0 (ie if inactive)

+ * if cond is TCG_COND_EQ then branch if fpInactive == 0 (ie if active)

+ */

+ assert(cond == TCG_COND_EQ || cond == TCG_COND_NE);

+ /* fpInactive = FPCCR_NS.ASPEN == 1 && CONTROL.FPCA == 0 */

+ TCGv_i32 aspen, fpca;

+ aspen = load_cpu_field(v7m.fpccr[M_REG_NS]);

+ fpca = load_cpu_field(v7m.control[M_REG_S]);

+ tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);

+ tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);

+ tcg_gen_andi_i32(fpca, fpca, R_V7M_CONTROL_FPCA_MASK);

+ tcg_gen_or_i32(fpca, fpca, aspen);

+ tcg_gen_brcondi_i32(tcg_invert_cond(cond), fpca, 0, label);

+ tcg_temp_free_i32(aspen);

+ tcg_temp_free_i32(fpca);

static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

fp_sysreg_loadfn *loadfn,

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

{

/* Do a write to an M-profile floating point system register */

TCGv_i32 tmp;

+ TCGLabel *lab_end = NULL;

switch (fp_sysreg_checks(s, regno)) {

case FPSysRegCheckFailed:

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

tcg_temp_free_i32(tmp);

break;

}

+ case ARM_VFP_FPCXT_NS:

+ lab_end = gen_new_label();

+ /* fpInactive case: write is a NOP, so branch to end */

+ gen_branch_fpInactive(s, TCG_COND_NE, lab_end);

+ /* !fpInactive: PreserveFPState(), and reads same as FPCXT_S */

+ gen_preserve_fp_state(s);

+ /* fall through */

case ARM_VFP_FPCXT_S:

{

TCGv_i32 sfpa, control;

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

default:

g_assert_not_reached();

}

+ if (lab_end) {

+ gen_set_label(lab_end);

+ }

return true;

}