First arm pullreq of 4.2...

The following changes since commit 27608c7c66bd923eb5e5faab80e795408cbe2b51:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20190814a' into staging (2019-08-16 12:00:18 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190816

for you to fetch changes up to 664b7e3b97d6376f3329986c465b3782458b0f8b:

target/arm: Use tcg_gen_extrh_i64_i32 to extract the high word (2019-08-16 14:02:53 +0100)

target-arm queue:

* target/arm: generate a custom MIDR for -cpu max

* hw/misc/zynq_slcr: refactor to use standard register definition

* Set ENET_BD_BDU in I.MX FEC controller

* target/arm: Fix routing of singlestep exceptions

* refactor a32/t32 decoder handling of PC

* minor optimisations/cleanups of some a32/t32 codegen

* target/arm/cpu64: Ensure kvm really supports aarch64=off

* target/arm/cpu: Ensure we can use the pmu with kvm

* target/arm: Minor cleanups preparatory to KVM SVE support

Aaron Hill (1):

Set ENET_BD_BDU in I.MX FEC controller

Alex Bennée (1):

target/arm: generate a custom MIDR for -cpu max

Andrew Jones (6):

target/arm/cpu64: Ensure kvm really supports aarch64=off

target/arm/cpu: Ensure we can use the pmu with kvm

target/arm/helper: zcr: Add build bug next to value range assumption

target/arm/cpu: Use div-round-up to determine predicate register array size

target/arm/kvm64: Fix error returns

target/arm/kvm64: Move the get/put of fpsimd registers out

Damien Hedde (1):

hw/misc/zynq_slcr: use standard register definition

Peter Maydell (2):

target/arm: Factor out 'generate singlestep exception' function

target/arm: Fix routing of singlestep exceptions

Richard Henderson (18):

target/arm: Pass in pc to thumb_insn_is_16bit

target/arm: Introduce pc_curr

target/arm: Introduce read_pc

target/arm: Introduce add_reg_for_lit

target/arm: Remove redundant s->pc & ~1

target/arm: Replace s->pc with s->base.pc_next

target/arm: Replace offset with pc in gen_exception_insn

target/arm: Replace offset with pc in gen_exception_internal_insn

target/arm: Remove offset argument to gen_exception_bkpt_insn

target/arm: Use unallocated_encoding for aarch32

target/arm: Remove helper_double_saturate

target/arm: Use tcg_gen_extract_i32 for shifter_out_im

target/arm: Use tcg_gen_deposit_i32 for PKHBT, PKHTB

target/arm: Remove redundant shift tests

target/arm: Use ror32 instead of open-coding the operation

target/arm: Use tcg_gen_rotri_i32 for gen_swap_half

target/arm: Simplify SMMLA, SMMLAR, SMMLS, SMMLSR

target/arm: Use tcg_gen_extrh_i64_i32 to extract the high word

target/arm/cpu.h | 13 +-

target/arm/helper.h | 1 -

target/arm/kvm_arm.h | 28 ++

target/arm/translate-a64.h | 4 +-

target/arm/translate.h | 39 ++-

hw/misc/zynq_slcr.c | 450 ++++++++++++++++----------------

hw/net/imx_fec.c | 4 +

target/arm/cpu.c | 30 ++-

target/arm/cpu64.c | 31 ++-

target/arm/helper.c | 7 +

target/arm/kvm.c | 7 +

target/arm/kvm64.c | 161 +++++++-----

target/arm/op_helper.c | 15 --

target/arm/translate-a64.c | 130 ++++------

target/arm/translate-vfp.inc.c | 45 +---

target/arm/translate.c | 572 +++++++++++++++++------------------------

16 files changed, 771 insertions(+), 766 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Rotate is the more compact and obvious way to swap 16-bit

elements of a 32-bit word.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20190808202616.13782-6-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/translate.c | 6 +-----

1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static TCGv_i64 gen_muls_i64_i32(TCGv_i32 a, TCGv_i32 b)

/* Swap low and high halfwords. */

static void gen_swap_half(TCGv_i32 var)

{

- TCGv_i32 tmp = tcg_temp_new_i32();

- tcg_gen_shri_i32(tmp, var, 16);

- tcg_gen_shli_i32(var, var, 16);

- tcg_gen_or_i32(var, var, tmp);

- tcg_temp_free_i32(tmp);

+ tcg_gen_rotri_i32(var, var, 16);

}

/* Dual 16-bit add. Result placed in t0 and t1 is marked as dead.

From: Richard Henderson <richard.henderson@linaro.org>

The helper function is more documentary, and also already

handles the case of rotate by zero.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20190808202616.13782-5-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/translate.c | 7 ++-----

1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)

/* CPSR = immediate */

val = insn & 0xff;

shift = ((insn >> 8) & 0xf) * 2;

- if (shift)

- val = (val >> shift) | (val << (32 - shift));

+ val = ror32(val, shift);

i = ((insn & (1 << 22)) != 0);

if (gen_set_psr_im(s, msr_mask(s, (insn >> 16) & 0xf, i),

i, val)) {

@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)

/* immediate operand */

val = insn & 0xff;

shift = ((insn >> 8) & 0xf) * 2;

- if (shift) {

- val = (val >> shift) | (val << (32 - shift));

- }

+ val = ror32(val, shift);

tmp2 = tcg_temp_new_i32();

tcg_gen_movi_i32(tmp2, val);

if (logic_cc && shift) {

When generating an architectural single-step exception we were

routing it to the "default exception level", which is to say

the same exception level we execute at except that EL0 exceptions

go to EL1. This is incorrect because the debug exception level

can be configured by the guest for situations such as single

stepping of EL0 and EL1 code by EL2.

We have to track the target debug exception level in the TB

flags, because it is dependent on CPU state like HCR_EL2.TGE

and MDCR_EL2.TDE. (That we were previously calling the

arm_debug_target_el() function to determine dc->ss_same_el

is itself a bug, though one that would only have manifested

as incorrect syndrome information.) Since we are out of TB

flag bits unless we want to expand into the cs_base field,

we share some bits with the M-profile only HANDLER and

STACKCHECK bits, since only A-profile has this singlestep.

Fixes: https://bugs.launchpad.net/qemu/+bug/1838913

target/arm/cpu.h | 5 +++++

target/arm/translate.h | 15 +++++++++++----

target/arm/helper.c | 6 ++++++

target/arm/translate-a64.c | 2 +-

target/arm/translate.c | 4 +++-

5 files changed, 26 insertions(+), 6 deletions(-)

@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, PSTATE_SS, 26, 1)

/* Target EL if we take a floating-point-disabled exception */

FIELD(TBFLAG_ANY, FPEXC_EL, 24, 2)

FIELD(TBFLAG_ANY, BE_DATA, 23, 1)

+/*

+ * For A-profile only, target EL for debug exceptions.

+ * Note that this overlaps with the M-profile-only HANDLER and STACKCHECK bits.

+ */

+FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 21, 2)

/* Bit usage when in AArch32 state: */

FIELD(TBFLAG_A32, THUMB, 0, 1)

diff --git a/target/arm/translate.h b/target/arm/translate.h

--- a/target/arm/translate.h

+++ b/target/arm/translate.h

@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {

uint32_t svc_imm;

int aarch64;

int current_el;

+ /* Debug target exception level for single-step exceptions */

+ int debug_target_el;

GHashTable *cp_regs;

uint64_t features; /* CPU features bits */

/* Because unallocated encodings generate different exception syndrome

@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {

* ie A64 LDX*, LDAX*, A32/T32 LDREX*, LDAEX*.

*/

bool is_ldex;

- /* True if a single-step exception will be taken to the current EL */

- bool ss_same_el;

/* True if v8.3-PAuth is active. */

bool pauth_active;

/* True with v8.5-BTI and SCTLR_ELx.BT* set. */

@@ -XXX,XX +XXX,XX @@ static inline void gen_exception(int excp, uint32_t syndrome,

/* Generate an architectural singlestep exception */

static inline void gen_swstep_exception(DisasContext *s, int isv, int ex)

{

- gen_exception(EXCP_UDEF, syn_swstep(s->ss_same_el, isv, ex),

- default_exception_el(s));

+ bool same_el = (s->debug_target_el == s->current_el);

+

+ /*

+ * If singlestep is targeting a lower EL than the current one,

+ * then s->ss_active must be false and we can never get here.

+ */

+ assert(s->debug_target_el >= s->current_el);

+

+ gen_exception(EXCP_UDEF, syn_swstep(same_el, isv, ex), s->debug_target_el);

/*

@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,

}

+ if (!arm_feature(env, ARM_FEATURE_M)) {

+ int target_el = arm_debug_target_el(env);

+

+ flags = FIELD_DP32(flags, TBFLAG_ANY, DEBUG_TARGET_EL, target_el);

*pflags = flags;

*cs_base = 0;

}

@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,

dc->ss_active = FIELD_EX32(tb_flags, TBFLAG_ANY, SS_ACTIVE);

dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE_SS);

dc->is_ldex = false;

- dc->ss_same_el = (arm_debug_target_el(env) == dc->current_el);

+ dc->debug_target_el = FIELD_EX32(tb_flags, TBFLAG_ANY, DEBUG_TARGET_EL);

/* Bound the number of insns to execute to those left on the page. */

bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)

dc->ss_active = FIELD_EX32(tb_flags, TBFLAG_ANY, SS_ACTIVE);

dc->pstate_ss = FIELD_EX32(tb_flags, TBFLAG_ANY, PSTATE_SS);

dc->is_ldex = false;

- dc->ss_same_el = false; /* Can't be true since EL_d must be AArch64 */

+ if (!arm_feature(env, ARM_FEATURE_M)) {

+ dc->debug_target_el = FIELD_EX32(tb_flags, TBFLAG_ANY, DEBUG_TARGET_EL);

+ }

dc->page_start = dc->base.pc_first & TARGET_PAGE_MASK;

From: Alex Bennée <alex.bennee@linaro.org>

While most features are now detected by probing the ID_* registers

kernels can (and do) use MIDR_EL1 for working out of they have to

apply errata. This can trip up warnings in the kernel as it tries to

work out if it should apply workarounds to features that don't

actually exist in the reported CPU type.

Avoid this problem by synthesising our own MIDR value.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20190726113950.7499-1-alex.bennee@linaro.org

target/arm/cpu.h | 6 ++++++

target/arm/cpu64.c | 19 +++++++++++++++++++

2 files changed, 25 insertions(+)

uint32_t u;

aarch64_a57_initfn(obj);

+ /*

+ * Reset MIDR so the guest doesn't mistake our 'max' CPU type for a real

+ * one and try to apply errata workarounds or use impdef features we

+ * don't provide.

+ * An IMPLEMENTER field of 0 means "reserved for software use";

+ * ARCHITECTURE must be 0xf indicating "v7 or later, check ID registers

+ * to see which features are present";

+ * the VARIANT, PARTNUM and REVISION fields are all implementation

+ * defined and we choose to define PARTNUM just in case guest

+ * code needs to distinguish this QEMU CPU from other software

+ * implementations, though this shouldn't be needed.

+ */

+ t = FIELD_DP64(0, MIDR_EL1, IMPLEMENTER, 0);

+ t = FIELD_DP64(t, MIDR_EL1, ARCHITECTURE, 0xf);

+ t = FIELD_DP64(t, MIDR_EL1, PARTNUM, 'Q');

+ t = FIELD_DP64(t, MIDR_EL1, VARIANT, 0);

+ t = FIELD_DP64(t, MIDR_EL1, REVISION, 0);

+ cpu->midr = t;

t = cpu->isar.id_aa64isar0;

t = FIELD_DP64(t, ID_AA64ISAR0, AES, 2); /* AES + PMULL */

t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 1);

From: Aaron Hill <aa1ronham@gmail.com>

This commit properly sets the ENET_BD_BDU flag once the emulated FEC controller

has finished processing the last descriptor. This is done for both transmit

and receive descriptors.

This allows the QNX 7.0.0 BSP for the Sabrelite board (which can be

found at http://blackberry.qnx.com/en/developers/bsp) to properly

control the FEC. Without this patch, the BSP ethernet driver will never

re-use FEC descriptors, as the unset ENET_BD_BDU flag will cause

it to believe that the descriptors are still in use by the NIC.

Note that Linux does not appear to use this field at all, and is

unaffected by this patch.

Without this patch, QNX will think that the NIC is still processing its

transaction descriptors, and won't send any more data over the network.

For reference:

On page 1192 of the I.MX 6DQ reference manual revision (Rev. 5, 06/2018),

which can be found at https://www.nxp.com/products/processors-and-microcontrollers/arm-based-processors-and-mcus/i.mx-applications-processors/i.mx-6-processors/i.mx-6quad-processors-high-performance-3d-graphics-hd-video-arm-cortex-a9-core:i.MX6Q?&tab=Documentation_Tab&linkline=Application-Note

the 'BDU' field is described as follows for the 'Enhanced transmit

buffer descriptor':

'Last buffer descriptor update done. Indicates that the last BD data has been updated by

uDMA. This field is written by the user (=0) and uDMA (=1).'

The same description is used for the receive buffer descriptor.

Signed-off-by: Aaron Hill <aa1ronham@gmail.com>

Message-id: 20190805142417.10433-1-aaron.hill@alertinnovation.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

hw/net/imx_fec.c | 4 ++++

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c

--- a/hw/net/imx_fec.c

+++ b/hw/net/imx_fec.c

@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s, uint32_t index)

if (bd.option & ENET_BD_TX_INT) {

s->regs[ENET_EIR] |= int_txf;

}

+ /* Indicate that we've updated the last buffer descriptor. */

+ bd.last_buffer = ENET_BD_BDU;

}

if (bd.option & ENET_BD_TX_INT) {

s->regs[ENET_EIR] |= int_txb;

@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,

/* Last buffer in frame. */

bd.flags |= flags | ENET_BD_L;

FEC_PRINTF("rx frame flags %04x\n", bd.flags);

+ /* Indicate that we've updated the last buffer descriptor. */

+ bd.last_buffer = ENET_BD_BDU;

if (bd.option & ENET_BD_RX_INT) {

s->regs[ENET_EIR] |= ENET_INT_RXF;

}

From: Richard Henderson <richard.henderson@linaro.org>

Use deposit as the composit operation to merge the

bits from the two inputs.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20190808202616.13782-3-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/translate.c | 26 ++++++++++----------------

1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c