Patches for rc1: nothing major, just some minor bugfixes and

code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

* hw/arm/Kconfig: ARM_V7M depends on PTIMER

* Minor coding style fixes

* docs: add some notes on the sbsa-ref machine

* hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals

* target/arm: Fix neon VTBL/VTBX for len > 1

* hw/arm/armsse: Correct expansion MPC interrupt lines

* hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ

* hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()

* hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input

* hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

* hw/arm/nseries: Check return value from load_image_targphys()

* tests/qtest/npcm7xx_rng-test: count runs properly

* target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Alex Bennée (1):

docs: add some notes on the sbsa-ref machine

AlexChen (1):

ssi: Fix bad printf format specifiers

Andrew Jones (1):

hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):

tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):

hw/arm/nseries: Check return value from load_image_targphys()

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals

hw/arm/armsse: Correct expansion MPC interrupt lines

hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ

hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()

hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input

hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):

target/arm: Fix neon VTBL/VTBX for len > 1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,

plus one. Currently, it's counting the number of times these transitions

do _not_ happen, plus one.

Source:

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf

section 2.3.4 point (3).

tests/qtest/npcm7xx_rng-test.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c

--- a/tests/qtest/npcm7xx_rng-test.c

+++ b/tests/qtest/npcm7xx_rng-test.c

@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)

pi = (double)nr_ones / nr_bits;

for (k = 0; k < nr_bits - 1; k++) {

- vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));

+ vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));

}

vn_obs += 1;

2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access

check, except in special cases. Move a stray UNDEF check in the VTBL

trans function up above the access check.

Message-id: 20201109145324.2859-1-peter.maydell@linaro.org

target/arm/translate-neon.c.inc | 8 ++++----

1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc

--- a/target/arm/translate-neon.c.inc

+++ b/target/arm/translate-neon.c.inc

@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)

return false;

}

- if (!vfp_access_check(s)) {

- return true;

- }

if ((a->vn + a->len + 1) > 32) {

/*

* This is UNPREDICTABLE; we choose to UNDEF to avoid the

@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)

return false;

}

+ if (!vfp_access_check(s)) {

+ return true;

+ }

+

desc = tcg_const_i32((a->vn << 2) | a->len);

def = tcg_temp_new_i64();

if (a->op) {

2.20.1

The nseries machines have a codepath that allows them to load a

secondary bootloader. This code wasn't checking that the

load_image_targphys() succeeded. Check the return value and report

the error to the user.

While we're in the vicinity, fix the comment style of the

comment documenting what this image load is doing.

Fixes: Coverity CID 1192904

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201103114918.11807-1-peter.maydell@linaro.org

---

hw/arm/nseries.c | 15 +++++++++++----

1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c

--- a/hw/arm/nseries.c

+++ b/hw/arm/nseries.c

@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,

/* No, wait, better start at the ROM. */

s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;

- /* This is intended for loading the `secondary.bin' program from

+ /*

+ * This is intended for loading the `secondary.bin' program from

* Nokia images (the NOLO bootloader). The entry point seems

* to be at OMAP2_Q2_BASE + 0x400000.

*

@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,

* for them the entry point needs to be set to OMAP2_SRAM_BASE.

*

* The code above is for loading the `zImage' file from Nokia

- * images. */

- load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,

- machine->ram_size - 0x400000);

+ * images.

+ */

+ if (load_image_targphys(option_rom[0].name,

+ OMAP2_Q2_BASE + 0x400000,

+ machine->ram_size - 0x400000) < 0) {

+ error_report("Failed to load secondary bootloader %s",

+ option_rom[0].name);

+ exit(EXIT_FAILURE);

+ }

n800_setup_nolo_tags(nolo_tags);

cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized

the vector register file for SVE. Since then, the neon dregs

are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit

quantities so that we do not have to call it twice.

Fixes: c39c2b9043e

Reported-by: Ard Biesheuvel <ardb@kernel.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

[PMM: use aa32_vfp_dreg() rather than opencoding]

Message-id: 20201105171126.88014-1-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/helper.h | 2 +-

target/arm/op_helper.c | 23 +++++++++--------

target/arm/translate-neon.c.inc | 44 +++++++++++----------------------

3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h

--- a/target/arm/helper.h

+++ b/target/arm/helper.h

@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)

DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)

DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)

DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)

-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)

+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)

DEF_HELPER_3(shl_cc, i32, env, i32, i32)

DEF_HELPER_3(shr_cc, i32, env, i32, i32)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c

--- a/target/arm/op_helper.c

+++ b/target/arm/op_helper.c

@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,

cpu_loop_exit_restore(cs, ra);

-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,

- uint32_t maxindex)

+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,

+ uint64_t ireg, uint64_t def)

- uint32_t val, shift;

- uint64_t *table = vn;

+ uint64_t tmp, val = 0;

+ uint32_t maxindex = ((desc & 3) + 1) * 8;

+ uint32_t base_reg = desc >> 2;

+ uint32_t shift, index, reg;

- val = 0;

- for (shift = 0; shift < 32; shift += 8) {

- uint32_t index = (ireg >> shift) & 0xff;

+ for (shift = 0; shift < 64; shift += 8) {

+ index = (ireg >> shift) & 0xff;

if (index < maxindex) {

- uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;

- val |= tmp << shift;

+ reg = base_reg + (index >> 3);

+ tmp = *aa32_vfp_dreg(env, reg);

+ tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;

} else {

- val |= def & (0xff << shift);

+ tmp = def & (0xffull << shift);

return val;

}

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc

--- a/target/arm/translate-neon.c.inc

+++ b/target/arm/translate-neon.c.inc

@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)

static bool trans_VTBL(DisasContext *s, arg_VTBL *a)

{

- int n;

- TCGv_i32 tmp, tmp2, tmp3, tmp4;

- TCGv_ptr ptr1;

+ TCGv_i64 val, def;

+ TCGv_i32 desc;

if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {

return false;

@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)

return true;

- n = a->len + 1;

- if ((a->vn + n) > 32) {

+ if ((a->vn + a->len + 1) > 32) {

/*

* This is UNPREDICTABLE; we choose to UNDEF to avoid the

* helper function running off the end of the register file.

*/

return false;

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use

few of the interrupt lines. Directly call qdev_get_gpio_in()

when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201107193403.436146-6-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

hw/arm/musicpal.c | 25 +++++++++++++------------

1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c

--- a/hw/arm/musicpal.c

+++ b/hw/arm/musicpal.c

@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {

static void musicpal_init(MachineState *machine)

{

ARMCPU *cpu;

- qemu_irq pic[32];

DeviceState *dev;

+ DeviceState *pic;

DeviceState *uart_orgate;

DeviceState *i2c_dev;

DeviceState *lcd_dev;

@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)

&error_fatal);

memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);

- dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,

+ pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,

qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));

- for (i = 0; i < 32; i++) {

- pic[i] = qdev_get_gpio_in(dev, i);

- }

- sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],

- pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],

- pic[MP_TIMER4_IRQ], NULL);

+ sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,

+ qdev_get_gpio_in(pic, MP_TIMER1_IRQ),

+ qdev_get_gpio_in(pic, MP_TIMER2_IRQ),

+ qdev_get_gpio_in(pic, MP_TIMER3_IRQ),

+ qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);

/* Logically OR both UART IRQs together */

uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));

object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);

qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);

- qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);

+ qdev_connect_gpio_out(DEVICE(uart_orgate), 0,

+ qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));

serial_mm_init(address_space_mem, MP_UART1_BASE, 2,

qdev_get_gpio_in(uart_orgate, 0),

@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)

OBJECT(get_system_memory()), &error_fatal);

sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);

sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);

- sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);

+ sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,

+ qdev_get_gpio_in(pic, MP_ETH_IRQ));

sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);

sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);

dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,

- pic[MP_GPIO_IRQ]);

+ qdev_get_gpio_in(pic, MP_GPIO_IRQ));

i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);

i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");

@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)

NULL);

sysbus_realize_and_unref(s, &error_fatal);

sysbus_mmio_map(s, 0, MP_AUDIO_BASE);

- sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);

+ sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));

musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;

arm_load_kernel(cpu, machine, &musicpal_binfo);

2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in

format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>

Signed-off-by: Kai Deng <dengkai1@huawei.com>

Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/translate-a64.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

--- a/target/arm/translate-a64.c

+++ b/target/arm/translate-a64.c

@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)

gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);

break;

default:

- fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",

+ fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",

__func__, insn, fpopcode, s->pc_curr);

g_assert_not_reached();

}

@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)

case 0x7f: /* FSQRT (vector) */

break;

default:

- fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);

+ fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);

g_assert_not_reached();

2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>

Signed-off-by: Kai Deng <dengkai1@huawei.com>

Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/arch_dump.c | 8 ++++----

target/arm/arm-semi.c | 8 ++++----

target/arm/helper.c | 2 +-

3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c

--- a/target/arm/arch_dump.c

+++ b/target/arm/arch_dump.c

@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,

for (i = 0; i < 32; ++i) {

uint64_t *q = aa64_vfp_qreg(env, i);

- note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);

- note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);

+ note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);

+ note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);

if (s->dump_info.d_endian == ELFDATA2MSB) {

@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,

*/

for (i = 0; i < 32; ++i) {

uint64_t tmp = note.vfp.vregs[2*i];

- note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];

- note.vfp.vregs[2*i+1] = tmp;

+ note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];

+ note.vfp.vregs[2 * i + 1] = tmp;

}

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/arm-semi.c

+++ b/target/arm/arm-semi.c

@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)

if (use_gdb_syscalls()) {

arm_semi_open_guestfd = guestfd;

ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,

- (int)arg2+1, gdb_open_modeflags[arg1]);

+ (int)arg2 + 1, gdb_open_modeflags[arg1]);

} else {

ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));

if (ret == (uint32_t)-1) {

@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)

GET_ARG(1);

if (use_gdb_syscalls()) {

ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",

- arg0, (int)arg1+1);

+ arg0, (int)arg1 + 1);

} else {

s = lock_user_string(arg0);

if (!s) {

@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)

GET_ARG(3);

if (use_gdb_syscalls()) {

return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",

- arg0, (int)arg1+1, arg2, (int)arg3+1);

+ arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);

} else {

char *s2;

s = lock_user_string(arg0);

@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)

GET_ARG(1);

if (use_gdb_syscalls()) {

return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",

- arg0, (int)arg1+1);

+ arg0, (int)arg1 + 1);

} else {

s = lock_user_string(arg0);

if (!s) {

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)

uint32_t sum;

sum = do_usad(a, b);

sum += do_usad(a >> 8, b >> 8);

- sum += do_usad(a >> 16, b >>16);

+ sum += do_usad(a >> 16, b >> 16);

sum += do_usad(a >> 24, b >> 24);

return sum;

}

2.20.1

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for

argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>

Signed-off-by: Alex Chen <alex.chen@huawei.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Message-id: 5FA280F5.8060902@huawei.com

hw/ssi/imx_spi.c | 2 +-

hw/ssi/xilinx_spi.c | 2 +-

2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c

--- a/hw/ssi/imx_spi.c

+++ b/hw/ssi/imx_spi.c

@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)

case ECSPI_MSGDATA:

return "ECSPI_MSGDATA";

default:

- sprintf(unknown, "%d ?", reg);

+ sprintf(unknown, "%u ?", reg);

return unknown;

diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/xilinx_spi.c

+++ b/hw/ssi/xilinx_spi.c

@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)

irq chain unless things really changed. */

if (pending != s->irqline) {

s->irqline = pending;

- DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",