Nothing too exciting, but does include the last bits of v8.1M support work.

The following changes since commit e79de63ab1bd1f6550e7b915e433bec1ad1a870a:

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210107' into staging (2021-01-07 20:34:05 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210108

for you to fetch changes up to c9f8511ea8d2b80723af0fea1f716d752c1b5208:

docs/system: arm: Add sabrelite board description (2021-01-08 15:13:39 +0000)

* intc/arm_gic: Fix gic_irq_signaling_enabled() for vCPUs

* target/arm: Fix MTE0_ACTIVE

* target/arm: Implement v8.1M and Cortex-M55 model

* hw/arm/highbank: Drop dead KVM support code

* util/qemu-timer: Make timer_free() imply timer_del()

* various devices: Use ptimer_free() in finalize function

* docs/system: arm: Add sabrelite board description

* sabrelite: Minor fixes to allow booting U-Boot

Andrew Jones (1):

hw/arm/virt: Remove virt machine state 'smp_cpus'

Bin Meng (4):

hw/misc: imx6_ccm: Update PMU_MISC0 reset value

hw/msic: imx6_ccm: Correct register value for silicon type

hw/arm: sabrelite: Connect the Ethernet PHY at address 6

docs/system: arm: Add sabrelite board description

Edgar E. Iglesias (1):

intc/arm_gic: Fix gic_irq_signaling_enabled() for vCPUs

Gan Qixin (7):

digic-timer: Use ptimer_free() in the finalize function to avoid memleaks

allwinner-a10-pit: Use ptimer_free() in the finalize function to avoid memleaks

exynos4210_rtc: Use ptimer_free() in the finalize function to avoid memleaks

exynos4210_pwm: Use ptimer_free() in the finalize function to avoid memleaks

mss-timer: Use ptimer_free() in the finalize function to avoid memleaks

musicpal: Use ptimer_free() in the finalize function to avoid memleaks

exynos4210_mct: Use ptimer_free() in the finalize function to avoid memleaks

Peter Maydell (9):

hw/intc/armv7m_nvic: Correct handling of CCR.BFHFNMIGN

target/arm: Correct store of FPSCR value via FPCXT_S

target/arm: Implement FPCXT_NS fp system register

target/arm: Implement Cortex-M55 model

hw/arm/highbank: Drop dead KVM support code

util/qemu-timer: Make timer_free() imply timer_del()

scripts/coccinelle: New script to remove unnecessary timer_del() calls

Remove superfluous timer_del() calls

target/arm: Remove timer_del()/timer_deinit() before timer_free()

target/arm: Fix MTE0_ACTIVE

docs/system/arm/sabrelite.rst | 119 ++++++++++++++++++++++++++

docs/system/target-arm.rst | 1 +

scripts/coccinelle/timer-del-timer-free.cocci | 18 ++++

include/hw/arm/virt.h | 3 +-

include/qemu/timer.h | 24 +++---

block/iscsi.c | 2 -

block/nbd.c | 1 -

block/qcow2.c | 1 -

hw/arm/highbank.c | 14 +--

hw/arm/musicpal.c | 12 +++

hw/arm/sabrelite.c | 4 +

hw/arm/virt-acpi-build.c | 9 +-

hw/arm/virt.c | 21 +++--

hw/block/nvme.c | 2 -

hw/char/serial.c | 2 -

hw/char/virtio-serial-bus.c | 2 -

hw/ide/core.c | 1 -

hw/input/hid.c | 1 -

hw/intc/apic.c | 1 -

hw/intc/arm_gic.c | 4 +-

hw/intc/armv7m_nvic.c | 15 ++++

hw/intc/ioapic.c | 1 -

hw/ipmi/ipmi_bmc_extern.c | 1 -

hw/misc/imx6_ccm.c | 4 +-

hw/net/e1000.c | 3 -

hw/net/e1000e_core.c | 8 --

hw/net/pcnet-pci.c | 1 -

hw/net/rtl8139.c | 1 -

hw/net/spapr_llan.c | 1 -

hw/net/virtio-net.c | 2 -

hw/rtc/exynos4210_rtc.c | 9 ++

hw/s390x/s390-pci-inst.c | 1 -

hw/sd/sd.c | 1 -

hw/sd/sdhci.c | 2 -

hw/timer/allwinner-a10-pit.c | 11 +++

hw/timer/digic-timer.c | 8 ++

hw/timer/exynos4210_mct.c | 14 +++

hw/timer/exynos4210_pwm.c | 11 +++

hw/timer/mss-timer.c | 13 +++

hw/usb/dev-hub.c | 1 -

hw/usb/hcd-ehci.c | 1 -

hw/usb/hcd-ohci-pci.c | 1 -

hw/usb/hcd-uhci.c | 1 -

hw/usb/hcd-xhci.c | 1 -

hw/usb/redirect.c | 1 -

hw/vfio/display.c | 1 -

hw/virtio/vhost-vsock-common.c | 1 -

hw/virtio/virtio-balloon.c | 1 -

hw/virtio/virtio-rng.c | 1 -

hw/watchdog/wdt_diag288.c | 1 -

hw/watchdog/wdt_i6300esb.c | 1 -

migration/colo.c | 1 -

monitor/hmp-cmds.c | 1 -

net/announce.c | 1 -

net/colo-compare.c | 1 -

net/slirp.c | 1 -

replay/replay-debugging.c | 1 -

target/arm/cpu.c | 2 -

target/arm/cpu_tcg.c | 42 +++++++++

target/arm/helper.c | 2 +-

target/s390x/cpu.c | 2 -

ui/console.c | 1 -

ui/spice-core.c | 1 -

util/throttle.c | 1 -

target/arm/translate-vfp.c.inc | 114 ++++++++++++++++++++++--

65 files changed, 421 insertions(+), 111 deletions(-)

create mode 100644 docs/system/arm/sabrelite.rst

create mode 100644 scripts/coccinelle/timer-del-timer-free.cocci

In 50244cc76abc we updated mte_check_fail to match the ARM

pseudocode, using the correct EL to select the TCF field.

But we failed to update MTE0_ACTIVE the same way, which led

to g_assert_not_reached().

Cc: qemu-stable@nongnu.org

Buglink: https://bugs.launchpad.net/bugs/1907137

Message-id: 20201221204426.88514-1-richard.henderson@linaro.org

target/arm/helper.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ static uint32_t rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,

if (FIELD_EX32(flags, TBFLAG_A64, UNPRIV)

&& tbid

&& !(env->pstate & PSTATE_TCO)

- && (sctlr & SCTLR_TCF0)

+ && (sctlr & SCTLR_TCF)

&& allocation_tag_access_enabled(env, 0, sctlr)) {

flags = FIELD_DP32(flags, TBFLAG_A64, MTE0_ACTIVE, 1);

}

From: Bin Meng <bin.meng@windriver.com>

hw/misc/imx6_ccm.c | 2 +-

diff --git a/hw/misc/imx6_ccm.c b/hw/misc/imx6_ccm.c

--- a/hw/misc/imx6_ccm.c

+++ b/hw/misc/imx6_ccm.c

@@ -XXX,XX +XXX,XX @@ static void imx6_ccm_reset(DeviceState *dev)

s->analog[USB_ANALOG_USB2_VBUS_DETECT] = 0x00000004;

s->analog[USB_ANALOG_USB2_CHRG_DETECT] = 0x00000000;

s->analog[USB_ANALOG_USB2_MISC] = 0x00000002;

- s->analog[USB_ANALOG_DIGPROG] = 0x00000000;

+ s->analog[USB_ANALOG_DIGPROG] = 0x00630000;

/* all PLLs need to be locked */

s->analog[CCM_ANALOG_PLL_ARM] |= CCM_ANALOG_PLL_LOCK;

From: Bin Meng <bin.meng@windriver.com>

U-Boot expects PMU_MISC0 register bit 7 is set (see init_bandgap()

in arch/arm/mach-imx/mx6/soc.c) during boot. This bit indicates the

bandgap has stabilized.

With this change, the latest upstream U-Boot (v2021.01-rc3) for imx6

sabrelite board (mx6qsabrelite_defconfig), with a slight change made

by switching CONFIG_OF_SEPARATE to CONFIG_OF_EMBED, boots to U-Boot

shell on QEMU with the following command:

$ qemu-system-arm -M sabrelite -smp 4 -m 1G -kernel u-boot \

-display none -serial null -serial stdio

Boot log below:

U-Boot 2021.01-rc3 (Dec 12 2020 - 17:40:02 +0800)

CPU: Freescale i.MX?? rev1.0 at 792 MHz

Reset cause: POR

Model: Freescale i.MX6 Quad SABRE Lite Board

Board: SABRE Lite

I2C: ready

DRAM: 1 GiB

force_idle_bus: sda=0 scl=0 sda.gp=0x5c scl.gp=0x55

force_idle_bus: failed to clear bus, sda=0 scl=0

force_idle_bus: sda=0 scl=0 sda.gp=0x6d scl.gp=0x6c

force_idle_bus: failed to clear bus, sda=0 scl=0

force_idle_bus: sda=0 scl=0 sda.gp=0xcb scl.gp=0x5

force_idle_bus: failed to clear bus, sda=0 scl=0

MMC: FSL_SDHC: 0, FSL_SDHC: 1

Loading Environment from MMC... *** Warning - No block device, using default environment

In: serial

Out: serial

Err: serial

Net: Board Net Initialization Failed

No ethernet found.

starting USB...

Bus usb@2184000: usb dr_mode not found

USB EHCI 1.00

Bus usb@2184200: USB EHCI 1.00

scanning bus usb@2184000 for devices... 1 USB Device(s) found

scanning bus usb@2184200 for devices... 1 USB Device(s) found

scanning usb for storage devices... 0 Storage Device(s) found

scanning usb for ethernet devices... 0 Ethernet Device(s) found

Hit any key to stop autoboot: 0

=>

Signed-off-by: Bin Meng <bin.meng@windriver.com>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20210106063504.10841-2-bmeng.cn@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/misc/imx6_ccm.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/imx6_ccm.c b/hw/misc/imx6_ccm.c

--- a/hw/misc/imx6_ccm.c

+++ b/hw/misc/imx6_ccm.c

@@ -XXX,XX +XXX,XX @@ static void imx6_ccm_reset(DeviceState *dev)

s->analog[PMU_REG_3P0] = 0x00000F74;

s->analog[PMU_REG_2P5] = 0x00005071;

s->analog[PMU_REG_CORE] = 0x00402010;

- s->analog[PMU_MISC0] = 0x04000000;

+ s->analog[PMU_MISC0] = 0x04000080;

s->analog[PMU_MISC1] = 0x00000000;

s->analog[PMU_MISC2] = 0x00272727;

Implement the v8.1M FPCXT_NS floating-point system register. This is

a little more complicated than FPCXT_S, because it has specific

handling for "current FP state is inactive", and it only wants to do

PreserveFPState(), not the full set of actions done by

ExecuteFPCheck() which vfp_access_check() implements.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20201210201433.26262-4-peter.maydell@linaro.org

target/arm/translate-vfp.c.inc | 102 ++++++++++++++++++++++++++++++++-

1 file changed, 99 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc

--- a/target/arm/translate-vfp.c.inc

+++ b/target/arm/translate-vfp.c.inc

@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)

}

break;

case ARM_VFP_FPCXT_S:

+ case ARM_VFP_FPCXT_NS:

if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {

return false;

}

@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)

return FPSysRegCheckFailed;

}

- if (!vfp_access_check(s)) {

+ /*

+ * FPCXT_NS is a special case: it has specific handling for

+ * "current FP state is inactive", and must do the PreserveFPState()

+ * but not the usual full set of actions done by ExecuteFPCheck().

+ * So we don't call vfp_access_check() and the callers must handle this.

+ */

+ if (regno != ARM_VFP_FPCXT_NS && !vfp_access_check(s)) {

return FPSysRegCheckDone;

}

return FPSysRegCheckContinue;

}

+static void gen_branch_fpInactive(DisasContext *s, TCGCond cond,

+ TCGLabel *label)

+{

+ /*

+ * FPCXT_NS is a special case: it has specific handling for

+ * "current FP state is inactive", and must do the PreserveFPState()

+ * but not the usual full set of actions done by ExecuteFPCheck().

+ * We don't have a TB flag that matches the fpInactive check, so we

+ * do it at runtime as we don't expect FPCXT_NS accesses to be frequent.

+ *

+ * Emit code that checks fpInactive and does a conditional

+ * branch to label based on it:

+ * if cond is TCG_COND_NE then branch if fpInactive != 0 (ie if inactive)

+ * if cond is TCG_COND_EQ then branch if fpInactive == 0 (ie if active)

+ */

+ assert(cond == TCG_COND_EQ || cond == TCG_COND_NE);

+

+ /* fpInactive = FPCCR_NS.ASPEN == 1 && CONTROL.FPCA == 0 */

+ TCGv_i32 aspen, fpca;

+ aspen = load_cpu_field(v7m.fpccr[M_REG_NS]);

+ fpca = load_cpu_field(v7m.control[M_REG_S]);

+ tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);

+ tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);

+ tcg_gen_andi_i32(fpca, fpca, R_V7M_CONTROL_FPCA_MASK);

+ tcg_gen_or_i32(fpca, fpca, aspen);

+ tcg_gen_brcondi_i32(tcg_invert_cond(cond), fpca, 0, label);

+ tcg_temp_free_i32(aspen);

+ tcg_temp_free_i32(fpca);

+}

+

static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

fp_sysreg_loadfn *loadfn,

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

{

/* Do a write to an M-profile floating point system register */

TCGv_i32 tmp;

+ TCGLabel *lab_end = NULL;

switch (fp_sysreg_checks(s, regno)) {

case FPSysRegCheckFailed:

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

tcg_temp_free_i32(tmp);

break;

}

+ case ARM_VFP_FPCXT_NS:

+ lab_end = gen_new_label();

+ /* fpInactive case: write is a NOP, so branch to end */

+ gen_branch_fpInactive(s, TCG_COND_NE, lab_end);

+ /* !fpInactive: PreserveFPState(), and reads same as FPCXT_S */

+ gen_preserve_fp_state(s);

+ /* fall through */

case ARM_VFP_FPCXT_S:

{

TCGv_i32 sfpa, control;

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

default:

g_assert_not_reached();

}

+ if (lab_end) {

+ gen_set_label(lab_end);

+ }

return true;

}

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,

{

/* Do a read from an M-profile floating point system register */

TCGv_i32 tmp;

+ TCGLabel *lab_end = NULL;

+ bool lookup_tb = false;

switch (fp_sysreg_checks(s, regno)) {

case FPSysRegCheckFailed:

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,

fpscr = load_cpu_field(v7m.fpdscr[M_REG_NS]);

gen_helper_vfp_set_fpscr(cpu_env, fpscr);

tcg_temp_free_i32(fpscr);

- gen_lookup_tb(s);

+ lookup_tb = true;

+ break;

+ }

+ case ARM_VFP_FPCXT_NS:

+ {

+ TCGv_i32 control, sfpa, fpscr, fpdscr, zero;

+ TCGLabel *lab_active = gen_new_label();

+

+ lookup_tb = true;

+

+ gen_branch_fpInactive(s, TCG_COND_EQ, lab_active);

+ /* fpInactive case: reads as FPDSCR_NS */

+ TCGv_i32 tmp = load_cpu_field(v7m.fpdscr[M_REG_NS]);

+ storefn(s, opaque, tmp);

+ lab_end = gen_new_label();

+ tcg_gen_br(lab_end);

+

+ gen_set_label(lab_active);

+ /* !fpInactive: Reads the same as FPCXT_S, but side effects differ */

+ gen_preserve_fp_state(s);

+ tmp = tcg_temp_new_i32();

+ sfpa = tcg_temp_new_i32();

+ fpscr = tcg_temp_new_i32();

+ gen_helper_vfp_get_fpscr(fpscr, cpu_env);

+ tcg_gen_andi_i32(tmp, fpscr, ~FPCR_NZCV_MASK);

+ control = load_cpu_field(v7m.control[M_REG_S]);

+ tcg_gen_andi_i32(sfpa, control, R_V7M_CONTROL_SFPA_MASK);

+ tcg_gen_shli_i32(sfpa, sfpa, 31 - R_V7M_CONTROL_SFPA_SHIFT);

+ tcg_gen_or_i32(tmp, tmp, sfpa);

+ tcg_temp_free_i32(control);

+ /* Store result before updating FPSCR, in case it faults */

+ storefn(s, opaque, tmp);

+ /* If SFPA is zero then set FPSCR from FPDSCR_NS */

+ fpdscr = load_cpu_field(v7m.fpdscr[M_REG_NS]);

+ zero = tcg_const_i32(0);

+ tcg_gen_movcond_i32(TCG_COND_EQ, fpscr, sfpa, zero, fpdscr, fpscr);

+ gen_helper_vfp_set_fpscr(cpu_env, fpscr);

+ tcg_temp_free_i32(zero);

+ tcg_temp_free_i32(sfpa);

+ tcg_temp_free_i32(fpdscr);

+ tcg_temp_free_i32(fpscr);

break;

}

default:

g_assert_not_reached();

}

+

+ if (lab_end) {

+ gen_set_label(lab_end);

+ }

+ if (lookup_tb) {

+ gen_lookup_tb(s);

+ }

return true;

}

The Arm CPU finalize function uses a sequence of timer_del(), timer_deinit(),

timer_free() to free the timer. The timer_deinit() step in this was always

unnecessary, and now the timer_del() is implied by timer_free(), so we can

collapse this down to simply calling timer_free().

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20201215154107.3255-5-peter.maydell@linaro.org

target/arm/cpu.c | 2 --

1 file changed, 2 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_finalizefn(Object *obj)

}

#ifndef CONFIG_USER_ONLY

if (cpu->pmu_timer) {

- timer_del(cpu->pmu_timer);

- timer_deinit(cpu->pmu_timer);

timer_free(cpu->pmu_timer);

}

#endif

From: Gan Qixin <ganqixin@huawei.com>

When running device-introspect-test, a memory leak occurred in the

mss_timer_init function, so use ptimer_free() in the finalize function to avoid

ASAN shows memory leak stack:

Indirect leak of 192 byte(s) in 2 object(s) allocated from:

#0 0xffffab97e1f0 in __interceptor_calloc (/lib64/libasan.so.5+0xee1f0)

#1 0xffffab256800 in g_malloc0 (/lib64/libglib-2.0.so.0+0x56800)

#2 0xaaabf555db78 in ptimer_init /qemu/hw/core/ptimer.c:432

#3 0xaaabf58a0010 in mss_timer_init /qemu/hw/timer/mss-timer.c:235

#4 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515

#5 0xaaabf633ca04 in object_initialize_child_with_propsv /qemu/qom/object.c:564

#6 0xaaabf633cc08 in object_initialize_child_with_props /qemu/qom/object.c:547

#7 0xaaabf5b8316c in m2sxxx_soc_initfn /qemu/hw/arm/msf2-soc.c:70

#8 0xaaabf6339f6c in object_initialize_with_type /qemu/qom/object.c:515

#9 0xaaabf633a1e0 in object_new_with_type /qemu/qom/object.c:729

#10 0xaaabf6375e40 in qmp_device_list_properties /qemu/qom/qom-qmp-cmds.c:153

#11 0xaaabf653d8ec in qmp_marshal_device_list_properties /qemu/qapi/qapi-commands-qdev.c:59

#12 0xaaabf6587d08 in do_qmp_dispatch_bh /qemu/qapi/qmp-dispatch.c:110

Reported-by: Euler Robot <euler.robot@huawei.com>

Signed-off-by: Gan Qixin <ganqixin@huawei.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/timer/mss-timer.c | 13 +++++++++++++

1 file changed, 13 insertions(+)

diff --git a/hw/timer/mss-timer.c b/hw/timer/mss-timer.c

--- a/hw/timer/mss-timer.c

+++ b/hw/timer/mss-timer.c

@@ -XXX,XX +XXX,XX @@ static void mss_timer_init(Object *obj)

sysbus_init_mmio(SYS_BUS_DEVICE(obj), &t->mmio);

}

+static void mss_timer_finalize(Object *obj)

+{

+ MSSTimerState *t = MSS_TIMER(obj);

+ int i;

+ for (i = 0; i < NUM_TIMERS; i++) {

+ struct Msf2Timer *st = &t->timers[i];

+ ptimer_free(st->ptimer);

+ }

+}

static const VMStateDescription vmstate_timers = {

.name = "mss-timer-block",

.version_id = 1,

@@ -XXX,XX +XXX,XX @@ static const TypeInfo mss_timer_info = {

.parent = TYPE_SYS_BUS_DEVICE,

.instance_size = sizeof(MSSTimerState),

.instance_init = mss_timer_init,

+ .instance_finalize = mss_timer_finalize,

.class_init = mss_timer_class_init,

};

Now that timer_free() implicitly calls timer_del(), sequences

timer_del(mytimer);

timer_free(mytimer);

can be simplified to just

timer_free(mytimer);

Add a Coccinelle script to do this transformation.

Acked-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20201215154107.3255-3-peter.maydell@linaro.org

scripts/coccinelle/timer-del-timer-free.cocci | 18 ++++++++++++++++++

1 file changed, 18 insertions(+)

create mode 100644 scripts/coccinelle/timer-del-timer-free.cocci

diff --git a/scripts/coccinelle/timer-del-timer-free.cocci b/scripts/coccinelle/timer-del-timer-free.cocci

+++ b/scripts/coccinelle/timer-del-timer-free.cocci

+// Remove superfluous timer_del() calls

+//

+// Copyright Linaro Limited 2020

+// This work is licensed under the terms of the GNU GPLv2 or later.

+//

+// spatch --macro-file scripts/cocci-macro-file.h \

+// --sp-file scripts/coccinelle/timer-del-timer-free.cocci \

+// --in-place --dir .

+//

+// The timer_free() function now implicitly calls timer_del()

+// for you, so calls to timer_del() immediately before the

+// timer_free() of the same timer can be deleted.

+@@

+expression T;

+@@

+-timer_del(T);

+ timer_free(T);

The CCR is a register most of whose bits are banked between security

states but where BFHFNMIGN is not, and we keep it in the non-secure

entry of the v7m.ccr[] array. The logic which tries to handle this

bit fails to implement the "RAZ/WI from Nonsecure if AIRCR.BFHFNMINS

is zero" requirement; correct the omission.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20201210201433.26262-2-peter.maydell@linaro.org

hw/intc/armv7m_nvic.c | 15 +++++++++++++++

1 file changed, 15 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)

*/

val = cpu->env.v7m.ccr[attrs.secure];

val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;

+ /* BFHFNMIGN is RAZ/WI from NS if AIRCR.BFHFNMINS is 0 */

+ if (!attrs.secure) {

+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {

+ val &= ~R_V7M_CCR_BFHFNMIGN_MASK;

+ }

+ }

return val;

case 0xd24: /* System Handler Control and State (SHCSR) */

if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {

@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,

(cpu->env.v7m.ccr[M_REG_NS] & ~R_V7M_CCR_BFHFNMIGN_MASK)

| (value & R_V7M_CCR_BFHFNMIGN_MASK);

value &= ~R_V7M_CCR_BFHFNMIGN_MASK;

+ } else {

+ /*

+ * BFHFNMIGN is RAZ/WI from NS if AIRCR.BFHFNMINS is 0, so

+ * preserve the state currently in the NS element of the array

+ */

+ if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {

+ value &= ~R_V7M_CCR_BFHFNMIGN_MASK;

+ value |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;

+ }

}

cpu->env.v7m.ccr[attrs.secure] = value;

In commit 64f863baeedc8659 we implemented the v8.1M FPCXT_S register,

but we got the write behaviour wrong. On read, this register reads

bits [27:0] of FPSCR plus the CONTROL.SFPA bit. On write, it doesn't

just write back those bits -- it writes a value to the whole FPSCR,

whose upper 4 bits are zeroes.

We also incorrectly implemented the write-to-FPSCR as a simple store

to vfp.xregs; this skips the "update the softfloat flags" part of

the vfp_set_fpscr helper so the value would read back correctly but

not actually take effect.

Fix both of these things by doing a complete write to the FPSCR

using the helper function.

Message-id: 20201210201433.26262-3-peter.maydell@linaro.org

target/arm/translate-vfp.c.inc | 12 ++++++------

1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc

--- a/target/arm/translate-vfp.c.inc

+++ b/target/arm/translate-vfp.c.inc

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

}

case ARM_VFP_FPCXT_S:

{

- TCGv_i32 sfpa, control, fpscr;

- /* Set FPSCR[27:0] and CONTROL.SFPA from value */

+ TCGv_i32 sfpa, control;

+ /*

+ * Set FPSCR and CONTROL.SFPA from value; the new FPSCR takes

+ * bits [27:0] from value and zeroes bits [31:28].

+ */

tmp = loadfn(s, opaque);

sfpa = tcg_temp_new_i32();

tcg_gen_shri_i32(sfpa, tmp, 31);

@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,

tcg_gen_deposit_i32(control, control, sfpa,

R_V7M_CONTROL_SFPA_SHIFT, 1);

store_cpu_field(control, v7m.control[M_REG_S]);

- fpscr = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);

- tcg_gen_andi_i32(fpscr, fpscr, FPCR_NZCV_MASK);

tcg_gen_andi_i32(tmp, tmp, ~FPCR_NZCV_MASK);

- tcg_gen_or_i32(fpscr, fpscr, tmp);

- store_cpu_field(fpscr, vfp.xregs[ARM_VFP_FPSCR]);

+ gen_helper_vfp_set_fpscr(cpu_env, tmp);

tcg_temp_free_i32(tmp);

tcg_temp_free_i32(sfpa);

break;

From: Bin Meng <bin.meng@windriver.com>

This adds the target guide for SABRE Lite board, and documents how

to boot a Linux kernel and U-Boot bootloader.

Signed-off-by: Bin Meng <bin.meng@windriver.com>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20210106063504.10841-5-bmeng.cn@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>