A last arm pullreq before rc0. This is mostly bug fixes,

though you could call adding the missing local timer

support to bcm2836_control a new feature I suppose --

in any case it's a small and localised change.

The following changes since commit 7074ab12c81a1b2b1e0e1c40983f56b2c5ccc494:

Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-03-14 16:19:37 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190315

for you to fetch changes up to 5de56742a3c91de3d646326bec43a989bba83ca4:

target/arm: Check access permission to ADDVL/ADDPL/RDVL (2019-03-15 11:12:29 +0000)

target-arm queue:

* Add missing SVE-enabled check to ADDVL/ADDPL/RDVL

* virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number

* virt-acpi-build: Fix SMMUv3 GSIV values

* Allow EL0 to write to arch timer registers, not just read them

* bcm2836_control: Implement local timer

Amir Charif (1):

target/arm: Check access permission to ADDVL/ADDPL/RDVL

Dongjiu Geng (1):

target/arm: change arch timer registers access permission

Eric Auger (1):

hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values

Wei Yang (1):

hw/arm/virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number

Zoltán Baldaszti (1):

hw/intc/bcm2836_control: Implement local timer

include/hw/intc/bcm2836_control.h | 9 ++++

hw/arm/virt-acpi-build.c | 6 +--

hw/intc/bcm2836_control.c | 101 +++++++++++++++++++++++++++++++++++++-

target/arm/helper.c | 30 +++++------

target/arm/translate-sve.c | 22 ++++++---

5 files changed, 140 insertions(+), 28 deletions(-)

From: Zoltán Baldaszti <bztemail@gmail.com>

The BCM2836 control logic module includes a simple

"local timer" which is a programmable down-counter that

can generates an interrupt. Implement this functionality.

Signed-off-by: Zoltán Baldaszti <bztemail@gmail.com>

[PMM: wrote commit message; wrapped long line; tweaked

some comments to match the final version of the code]

include/hw/intc/bcm2836_control.h | 9 +++

hw/intc/bcm2836_control.c | 101 +++++++++++++++++++++++++++++-

2 files changed, 108 insertions(+), 2 deletions(-)

diff --git a/include/hw/intc/bcm2836_control.h b/include/hw/intc/bcm2836_control.h

--- a/include/hw/intc/bcm2836_control.h

+++ b/include/hw/intc/bcm2836_control.h

@@ -XXX,XX +XXX,XX @@

* Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft

* Written by Andrew Baumann

*

+ * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti

+ * Added basic IRQ_TIMER interrupt support

+ *

* This code is licensed under the GNU GPLv2 and later.

*/

@@ -XXX,XX +XXX,XX @@

#define BCM2836_CONTROL_H

#include "hw/sysbus.h"

+#include "qemu/timer.h"

/* 4 mailboxes per core, for 16 total */

#define BCM2836_NCORES 4

@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836ControlState {

bool gpu_irq, gpu_fiq;

uint8_t timerirqs[BCM2836_NCORES];

+ /* local timer */

+ QEMUTimer timer;

+ uint32_t local_timer_control;

+ uint8_t route_localtimer;

/* interrupt source registers, post-routing (also input-derived; visible) */

uint32_t irqsrc[BCM2836_NCORES];

uint32_t fiqsrc[BCM2836_NCORES];

diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/bcm2836_control.c

+++ b/hw/intc/bcm2836_control.c

@@ -XXX,XX +XXX,XX @@

* This code is licensed under the GNU GPLv2 and later.

*

* At present, only implements interrupt routing, and mailboxes (i.e.,

- * not local timer, PMU interrupt, or AXI counters).

+ * not PMU interrupt, or AXI counters).

+ *

+ * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti

*

* Ref:

* https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2836/QA7_rev3.4.pdf

@@ -XXX,XX +XXX,XX @@

#include "qemu/log.h"

#define REG_GPU_ROUTE 0x0c

+#define REG_LOCALTIMERROUTING 0x24

+#define REG_LOCALTIMERCONTROL 0x34

+#define REG_LOCALTIMERACK 0x38

#define REG_TIMERCONTROL 0x40

#define REG_MBOXCONTROL 0x50

#define REG_IRQSRC 0x60

@@ -XXX,XX +XXX,XX @@

#define IRQ_TIMER 11

#define IRQ_MAX IRQ_TIMER

+#define LOCALTIMER_FREQ 38400000

+#define LOCALTIMER_INTFLAG (1 << 31)

+#define LOCALTIMER_RELOAD (1 << 30)

+#define LOCALTIMER_INTENABLE (1 << 29)

+#define LOCALTIMER_ENABLE (1 << 28)

+#define LOCALTIMER_VALUE(x) ((x) & 0xfffffff)

+

static void deliver_local(BCM2836ControlState *s, uint8_t core, uint8_t irq,

uint32_t controlreg, uint8_t controlidx)

{

@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_update(BCM2836ControlState *s)

s->fiqsrc[s->route_gpu_fiq] |= (uint32_t)1 << IRQ_GPU;

+ /*

+ * handle the control module 'local timer' interrupt for one of the

+ * cores' IRQ/FIQ; this is distinct from the per-CPU timer

+ * interrupts handled below.

+ */

+ if ((s->local_timer_control & LOCALTIMER_INTENABLE) &&

+ (s->local_timer_control & LOCALTIMER_INTFLAG)) {

+ if (s->route_localtimer & 4) {

+ s->fiqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;

+ } else {

+ s->irqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;

+ }

+ }

+

for (i = 0; i < BCM2836_NCORES; i++) {

/* handle local timer interrupts for this core */

if (s->timerirqs[i]) {

@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_set_gpu_fiq(void *opaque, int irq, int level)

bcm2836_control_update(s);

}

+static void bcm2836_control_local_timer_set_next(void *opaque)

+{

+ BCM2836ControlState *s = opaque;

+ uint64_t next_event;

+

+ assert(LOCALTIMER_VALUE(s->local_timer_control) > 0);

+

+ next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +

+ muldiv64(LOCALTIMER_VALUE(s->local_timer_control),

+ NANOSECONDS_PER_SECOND, LOCALTIMER_FREQ);

+ timer_mod(&s->timer, next_event);

+}

+

+static void bcm2836_control_local_timer_tick(void *opaque)

+{

+ BCM2836ControlState *s = opaque;

+

+ bcm2836_control_local_timer_set_next(s);

+

+ s->local_timer_control |= LOCALTIMER_INTFLAG;

+ bcm2836_control_update(s);

+}

+

+static void bcm2836_control_local_timer_control(void *opaque, uint32_t val)

+{

+ BCM2836ControlState *s = opaque;

+

+ s->local_timer_control = val;

+ if (val & LOCALTIMER_ENABLE) {

+ bcm2836_control_local_timer_set_next(s);

+ } else {

+ timer_del(&s->timer);

+ }

+}

+

+static void bcm2836_control_local_timer_ack(void *opaque, uint32_t val)

+{

+ BCM2836ControlState *s = opaque;

+

+ if (val & LOCALTIMER_INTFLAG) {

+ s->local_timer_control &= ~LOCALTIMER_INTFLAG;

+ }

+ if ((val & LOCALTIMER_RELOAD) &&

+ (s->local_timer_control & LOCALTIMER_ENABLE)) {

+ bcm2836_control_local_timer_set_next(s);

+ }

+}

+

static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)

{

BCM2836ControlState *s = opaque;

@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)

assert(s->route_gpu_fiq < BCM2836_NCORES

&& s->route_gpu_irq < BCM2836_NCORES);

return ((uint32_t)s->route_gpu_fiq << 2) | s->route_gpu_irq;

+ } else if (offset == REG_LOCALTIMERROUTING) {

+ return s->route_localtimer;

+ } else if (offset == REG_LOCALTIMERCONTROL) {

+ return s->local_timer_control;

+ } else if (offset == REG_LOCALTIMERACK) {

+ return 0;

} else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {

return s->timercontrol[(offset - REG_TIMERCONTROL) >> 2];

} else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {

@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_write(void *opaque, hwaddr offset,

if (offset == REG_GPU_ROUTE) {

s->route_gpu_irq = val & 0x3;

s->route_gpu_fiq = (val >> 2) & 0x3;

+ } else if (offset == REG_LOCALTIMERROUTING) {

+ s->route_localtimer = val & 7;

+ } else if (offset == REG_LOCALTIMERCONTROL) {

+ bcm2836_control_local_timer_control(s, val);

+ } else if (offset == REG_LOCALTIMERACK) {

+ bcm2836_control_local_timer_ack(s, val);

} else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {

s->timercontrol[(offset - REG_TIMERCONTROL) >> 2] = val & 0xff;

} else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {

@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_reset(DeviceState *d)

s->route_gpu_irq = s->route_gpu_fiq = 0;

+ timer_del(&s->timer);

+ s->route_localtimer = 0;

+ s->local_timer_control = 0;

+

for (i = 0; i < BCM2836_NCORES; i++) {

s->timercontrol[i] = 0;

s->mailboxcontrol[i] = 0;

@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_init(Object *obj)

/* outputs to CPU cores */

qdev_init_gpio_out_named(dev, s->irq, "irq", BCM2836_NCORES);

qdev_init_gpio_out_named(dev, s->fiq, "fiq", BCM2836_NCORES);

+

+ /* create a qemu virtual timer */

+ timer_init_ns(&s->timer, QEMU_CLOCK_VIRTUAL,

+ bcm2836_control_local_timer_tick, s);

}

static const VMStateDescription vmstate_bcm2836_control = {

.name = TYPE_BCM2836_CONTROL,

- .version_id = 1,

+ .version_id = 2,

.minimum_version_id = 1,

.fields = (VMStateField[]) {

VMSTATE_UINT32_ARRAY(mailboxes, BCM2836ControlState,

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_bcm2836_control = {

VMSTATE_UINT32_ARRAY(timercontrol, BCM2836ControlState, BCM2836_NCORES),

VMSTATE_UINT32_ARRAY(mailboxcontrol, BCM2836ControlState,

BCM2836_NCORES),

+ VMSTATE_TIMER_V(timer, BCM2836ControlState, 2),

+ VMSTATE_UINT32_V(local_timer_control, BCM2836ControlState, 2),

+ VMSTATE_UINT8_V(route_localtimer, BCM2836ControlState, 2),

VMSTATE_END_OF_LIST()

}

};

2.20.1

From: Amir Charif <amir.charif@cea.fr>

These instructions do not trap when SVE is disabled in EL0,

causing them to be executed with wrong size information.

Signed-off-by: Amir Charif <amir.charif@cea.fr>

Message-id: 1552579248-31025-1-git-send-email-amir.charif@cea.fr

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

[PMM: added 'target/arm' prefix to subject]

target/arm/translate-sve.c | 22 ++++++++++++++--------

1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c

--- a/target/arm/translate-sve.c

+++ b/target/arm/translate-sve.c

@@ -XXX,XX +XXX,XX @@ static bool trans_INDEX_rr(DisasContext *s, arg_INDEX_rr *a)

static bool trans_ADDVL(DisasContext *s, arg_ADDVL *a)

{

- TCGv_i64 rd = cpu_reg_sp(s, a->rd);

- TCGv_i64 rn = cpu_reg_sp(s, a->rn);

- tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));

+ if (sve_access_check(s)) {

+ TCGv_i64 rd = cpu_reg_sp(s, a->rd);

+ TCGv_i64 rn = cpu_reg_sp(s, a->rn);

+ tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));

+ }

return true;

}

static bool trans_ADDPL(DisasContext *s, arg_ADDPL *a)

{

- TCGv_i64 rd = cpu_reg_sp(s, a->rd);

- TCGv_i64 rn = cpu_reg_sp(s, a->rn);

- tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));

+ if (sve_access_check(s)) {

+ TCGv_i64 rd = cpu_reg_sp(s, a->rd);

+ TCGv_i64 rn = cpu_reg_sp(s, a->rn);

+ tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));

+ }

return true;

}

static bool trans_RDVL(DisasContext *s, arg_RDVL *a)

{

- TCGv_i64 reg = cpu_reg(s, a->rd);

- tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));

+ if (sve_access_check(s)) {

+ TCGv_i64 reg = cpu_reg(s, a->rd);

+ tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));

+ }

return true;

}

2.20.1