target-arm queue: I have a lot more still in my to-review

queue, but my rule of thumb is when I get to 50 patches or

so to send out what I have.

The following changes since commit 9a7beaad3dbba982f7a461d676b55a5c3851d312:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20210304' into staging (2021-03-05 10:47:46 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210305

for you to fetch changes up to 2c669ff88ec6733420a000103a2b8b9e93df4945:

hw/arm/mps2: Update old infocenter.arm.com URLs (2021-03-05 15:17:38 +0000)

* sbsa-ref: remove cortex-a53 from list of supported cpus

* sbsa-ref: add 'max' to list of allowed cpus

* target/arm: Add support for FEAT_SSBS, Speculative Store Bypass Safe

* npcm7xx: add EMC model

* xlnx-zynqmp: Remove obsolete 'has_rpu' property

* target/arm: Speed up aarch64 TBL/TBX

* virtio-mmio: improve virtio-mmio get_dev_path alog

* target/arm: Use TCF0 and TFSRE0 for unprivileged tag checks

* target/arm: Restrict v8M IDAU to TCG

* target/arm/cpu: Update coding style to make checkpatch.pl happy

* musicpal, tc6393xb, omap_lcdc, tcx: drop dead code for non-32-bit-RGB surfaces

* Add new board: mps3-an524

Doug Evans (3):

hw/net: Add npcm7xx emc model

hw/arm: Add npcm7xx emc model

tests/qtests: Add npcm7xx emc model test

Marcin Juszkiewicz (2):

sbsa-ref: remove cortex-a53 from list of supported cpus

sbsa-ref: add 'max' to list of allowed cpus

Peter Collingbourne (1):

target/arm: Use TCF0 and TFSRE0 for unprivileged tag checks

Peter Maydell (34):

hw/arm/musicpal: Remove dead code for non-32-bit-RGB surfaces

hw/display/tc6393xb: Remove dead code for handling non-32bpp surfaces

hw/display/tc6393xb: Expand out macros in template header

hw/display/tc6393xb: Inline tc6393xb_draw_graphic32() at its callsite

hw/display/omap_lcdc: Expand out macros in template header

hw/display/omap_lcdc: Drop broken bigendian ifdef

hw/display/omap_lcdc: Fix coding style issues in template header

hw/display/omap_lcdc: Inline template header into C file

hw/display/omap_lcdc: Delete unnecessary macro

hw/display/tcx: Drop unnecessary code for handling BGR format outputs

hw/arm/mps2-tz: Make SYSCLK frequency board-specific

hw/misc/mps2-scc: Support configurable number of OSCCLK values

hw/arm/mps2-tz: Correct the OSCCLK settings for mps2-an505 and mps2-an511

hw/arm/mps2-tz: Make the OSCCLK settings be configurable per-board

hw/misc/mps2-fpgaio: Make number of LEDs configurable by board

hw/misc/mps2-fpgaio: Support SWITCH register

hw/arm/mps2-tz: Make FPGAIO switch and LED config per-board

hw/arm/mps2-tz: Condition IRQ splitting on number of CPUs, not board type

hw/arm/mps2-tz: Make number of IRQs board-specific

hw/misc/mps2-scc: Implement CFG_REG5 and CFG_REG6 for MPS3 AN524

hw/arm/mps2-tz: Correct wrong interrupt numbers for DMA and SPI

hw/arm/mps2-tz: Allow PPCPortInfo structures to specify device interrupts

hw/arm/mps2-tz: Move device IRQ info to data structures

hw/arm/mps2-tz: Size the uart-irq-orgate based on the number of UARTs

hw/arm/mps2-tz: Allow boards to have different PPCInfo data

hw/arm/mps2-tz: Make RAM arrangement board-specific

hw/arm/mps2-tz: Set MachineClass default_ram info from RAMInfo data

hw/arm/mps2-tz: Support ROMs as well as RAMs

hw/arm/mps2-tz: Get armv7m_load_kernel() size argument from RAMInfo

hw/arm/mps2-tz: Add new mps3-an524 board

hw/arm/mps2-tz: Stub out USB controller for mps3-an524

hw/arm/mps2-tz: Provide PL031 RTC on mps3-an524

docs/system/arm/mps2.rst: Document the new mps3-an524 board

hw/arm/mps2: Update old infocenter.arm.com URLs

Philippe Mathieu-Daudé (4):

hw/arm/xlnx-zynqmp: Remove obsolete 'has_rpu' property

hw/i2c/npcm7xx_smbus: Simplify npcm7xx_smbus_init()

target/arm: Restrict v8M IDAU to TCG

target/arm/cpu: Update coding style to make checkpatch.pl happy

Rebecca Cran (3):

target/arm: Add support for FEAT_SSBS, Speculative Store Bypass Safe

target/arm: Enable FEAT_SSBS for "max" AARCH64 CPU

target/arm: Set ID_PFR2.SSBS to 1 for "max" 32-bit CPU

Richard Henderson (1):

target/arm: Speed up aarch64 TBL/TBX

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We will move this code in the next commit. Clean it up

first to avoid checkpatch.pl errors.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20210221222617.2579610-3-f4bug@amsat.org

target/arm/cpu.c | 12 ++++++++----

1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)

}

static const ARMCPRegInfo cortexa9_cp_reginfo[] = {

- /* power_control should be set to maximum latency. Again,

+ /*

+ * power_control should be set to maximum latency. Again,

* default to 0 and set by private hook

*/

{ .name = "A9_PWRCTL", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0,

@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)

set_feature(&cpu->env, ARM_FEATURE_NEON);

set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);

set_feature(&cpu->env, ARM_FEATURE_EL3);

- /* Note that A9 supports the MP extensions even for

+ /*

+ * Note that A9 supports the MP extensions even for

* A9UP and single-core A9MP (which are both different

* and valid configurations; we don't model A9UP).

*/

@@ -XXX,XX +XXX,XX @@ static uint64_t a15_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)

{

MachineState *ms = MACHINE(qdev_get_machine());

- /* Linux wants the number of processors from here.

+ /*

+ * Linux wants the number of processors from here.

* Might as well set the interrupt-controller bit too.

*/

return ((ms->smp.cpus - 1) << 24) | (1 << 23);

@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)

cpu->isar.id_mmfr1 = 0x40000000;

cpu->isar.id_mmfr2 = 0x01240000;

cpu->isar.id_mmfr3 = 0x02102211;

- /* a7_mpcore_r0p5_trm, page 4-4 gives 0x01101110; but

+ /*

+ * a7_mpcore_r0p5_trm, page 4-4 gives 0x01101110; but

* table 4-41 gives 0x02101110, which includes the arm div insns.

*/

cpu->isar.id_isar0 = 0x02101110;

Update old infocenter.arm.com URLs to the equivalent developer.arm.com

ones (the old URLs should redirect, but we might as well avoid the

redirection notice, and the new URLs are pleasantly shorter).

This commit covers the links to the MPS2 board TRM, the various

Application Notes, the IoTKit and SSE-200 documents.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20210215115138.20465-25-peter.maydell@linaro.org

include/hw/arm/armsse.h | 4 ++--

include/hw/misc/armsse-cpuid.h | 2 +-

include/hw/misc/armsse-mhu.h | 2 +-

include/hw/misc/iotkit-secctl.h | 2 +-

include/hw/misc/iotkit-sysctl.h | 2 +-

include/hw/misc/iotkit-sysinfo.h | 2 +-

include/hw/misc/mps2-fpgaio.h | 2 +-

hw/arm/mps2-tz.c | 11 +++++------

hw/misc/armsse-cpuid.c | 2 +-

hw/misc/armsse-mhu.c | 2 +-

hw/misc/iotkit-sysctl.c | 2 +-

hw/misc/iotkit-sysinfo.c | 2 +-

hw/misc/mps2-fpgaio.c | 2 +-

hw/misc/mps2-scc.c | 2 +-

14 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h

--- a/include/hw/arm/armsse.h

+++ b/include/hw/arm/armsse.h

@@ -XXX,XX +XXX,XX @@

* hardware, which include the IoT Kit and the SSE-050, SSE-100 and

* SSE-200. Currently we model:

* - the Arm IoT Kit which is documented in

- * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html

+ * https://developer.arm.com/documentation/ecm0601256/latest

* - the SSE-200 which is documented in

- * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf

+ * https://developer.arm.com/documentation/101104/latest/

*

* The IoTKit contains:

* a Cortex-M33

diff --git a/include/hw/misc/armsse-cpuid.h b/include/hw/misc/armsse-cpuid.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/misc/armsse-cpuid.h

+++ b/include/hw/misc/armsse-cpuid.h

@@ -XXX,XX +XXX,XX @@

/*

* This is a model of the "CPU_IDENTITY" register block which is part of the

* Arm SSE-200 and documented in

- * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf

+ * https://developer.arm.com/documentation/101104/latest/

*

* QEMU interface:

* + QOM property "CPUID": the value to use for the CPUID register

diff --git a/include/hw/misc/armsse-mhu.h b/include/hw/misc/armsse-mhu.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/misc/armsse-mhu.h

+++ b/include/hw/misc/armsse-mhu.h

@@ -XXX,XX +XXX,XX @@

/*

* This is a model of the Message Handling Unit (MHU) which is part of the

* Arm SSE-200 and documented in

- * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf

+ * https://developer.arm.com/documentation/101104/latest/

*

* QEMU interface:

* + sysbus MMIO region 0: the system information register bank

diff --git a/include/hw/misc/iotkit-secctl.h b/include/hw/misc/iotkit-secctl.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/misc/iotkit-secctl.h

+++ b/include/hw/misc/iotkit-secctl.h

@@ -XXX,XX +XXX,XX @@

/* This is a model of the security controller which is part of the

* Arm IoT Kit and documented in

- * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html

+ * https://developer.arm.com/documentation/ecm0601256/latest

*

* QEMU interface:

* + sysbus MMIO region 0 is the "secure privilege control block" registers

diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/misc/iotkit-sysctl.h

+++ b/include/hw/misc/iotkit-sysctl.h

@@ -XXX,XX +XXX,XX @@

/*

* This is a model of the "system control element" which is part of the

* Arm IoTKit and documented in

- * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html

+ * https://developer.arm.com/documentation/ecm0601256/latest

* Specifically, it implements the "system information block" and

* "system control register" blocks.

*

diff --git a/include/hw/misc/iotkit-sysinfo.h b/include/hw/misc/iotkit-sysinfo.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/misc/iotkit-sysinfo.h

+++ b/include/hw/misc/iotkit-sysinfo.h

@@ -XXX,XX +XXX,XX @@

/*

* This is a model of the "system information block" which is part of the

* Arm IoTKit and documented in

- * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html

+ * https://developer.arm.com/documentation/ecm0601256/latest

* QEMU interface:

* + QOM property "SYS_VERSION": value to use for SYS_VERSION register

* + QOM property "SYS_CONFIG": value to use for SYS_CONFIG register

diff --git a/include/hw/misc/mps2-fpgaio.h b/include/hw/misc/mps2-fpgaio.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/misc/mps2-fpgaio.h

+++ b/include/hw/misc/mps2-fpgaio.h

@@ -XXX,XX +XXX,XX @@

/* This is a model of the FPGAIO register block in the AN505

* FPGA image for the MPS2 dev board; it is documented in the

* application note:

- * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html

+ * https://developer.arm.com/documentation/dai0505/latest/

*

* QEMU interface:

* + sysbus MMIO region 0: the register bank

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/mps2-tz.c

+++ b/hw/arm/mps2-tz.c

@@ -XXX,XX +XXX,XX @@

* https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2

*

* Board TRM:

- * http://infocenter.arm.com/help/topic/com.arm.doc.100112_0200_06_en/versatile_express_cortex_m_prototyping_systems_v2m_mps2_and_v2m_mps2plus_technical_reference_100112_0200_06_en.pdf

+ * https://developer.arm.com/documentation/100112/latest/

* Application Note AN505:

- * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html

+ * https://developer.arm.com/documentation/dai0505/latest/

* Application Note AN521:

- * http://infocenter.arm.com/help/topic/com.arm.doc.dai0521c/index.html

+ * https://developer.arm.com/documentation/dai0521/latest/

* Application Note AN524:

* https://developer.arm.com/documentation/dai0524/latest/

*

* The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide

* (ARM ECM0601256) for the details of some of the device layout:

- * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html

+ * https://developer.arm.com/documentation/ecm0601256/latest

* Similarly, the AN521 and AN524 use the SSE-200, and the SSE-200 TRM defines

* most of the device layout:

- * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf

- *

+ * https://developer.arm.com/documentation/101104/latest/

*/

#include "qemu/osdep.h"

diff --git a/hw/misc/armsse-cpuid.c b/hw/misc/armsse-cpuid.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/misc/armsse-cpuid.c

+++ b/hw/misc/armsse-cpuid.c

@@ -XXX,XX +XXX,XX @@

/*

* This is a model of the "CPU_IDENTITY" register block which is part of the

* Arm SSE-200 and documented in

- * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf

+ * https://developer.arm.com/documentation/101104/latest/

*

* It consists of one read-only CPUID register (set by QOM property), plus the

* usual ID registers.

diff --git a/hw/misc/armsse-mhu.c b/hw/misc/armsse-mhu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/misc/armsse-mhu.c

+++ b/hw/misc/armsse-mhu.c

@@ -XXX,XX +XXX,XX @@

/*

* This is a model of the Message Handling Unit (MHU) which is part of the

* Arm SSE-200 and documented in

- * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf

+ * https://developer.arm.com/documentation/101104/latest/

*/

#include "qemu/osdep.h"

diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/misc/iotkit-sysctl.c

+++ b/hw/misc/iotkit-sysctl.c

@@ -XXX,XX +XXX,XX @@

/*

* This is a model of the "system control element" which is part of the

* Arm IoTKit and documented in

- * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html

+ * https://developer.arm.com/documentation/ecm0601256/latest

* Specifically, it implements the "system control register" blocks.

*/

diff --git a/hw/misc/iotkit-sysinfo.c b/hw/misc/iotkit-sysinfo.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/misc/iotkit-sysinfo.c

+++ b/hw/misc/iotkit-sysinfo.c

@@ -XXX,XX +XXX,XX @@

/*

* This is a model of the "system information block" which is part of the

* Arm IoTKit and documented in

- * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ecm0601256/index.html

+ * https://developer.arm.com/documentation/ecm0601256/latest

* It consists of 2 read-only version/config registers, plus the

* usual ID registers.

*/

diff --git a/hw/misc/mps2-fpgaio.c b/hw/misc/mps2-fpgaio.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/misc/mps2-fpgaio.c

+++ b/hw/misc/mps2-fpgaio.c

@@ -XXX,XX +XXX,XX @@

/* This is a model of the "FPGA system control and I/O" block found

* in the AN505 FPGA image for the MPS2 devboard.

* It is documented in AN505:

- * http://infocenter.arm.com/help/topic/com.arm.doc.dai0505b/index.html

+ * https://developer.arm.com/documentation/dai0505/latest/

*/

#include "qemu/osdep.h"

diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/misc/mps2-scc.c

+++ b/hw/misc/mps2-scc.c

@@ -XXX,XX +XXX,XX @@

* found in the FPGA images of MPS2 development boards.

*

* Documentation of it can be found in the MPS2 TRM:

- * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.100112_0100_03_en/index.html

+ * https://developer.arm.com/documentation/100112/latest/

* and also in the Application Notes documenting individual FPGA images.

*/

The AN524 version of the SCC interface has different behaviour for

some of the CFG registers; implement it.

Each board in this family can have minor differences in the meaning

of the CFG registers, so rather than trying to specify all the

possible semantics via individual device properties, we make the

behaviour conditional on the part-number field of the SCC_ID register

which the board code already passes us.

For the AN524, the differences are:

* CFG3 is reserved rather than being board switches

* CFG5 is a new register ("ACLK Frequency in Hz")

* CFG6 is a new register ("Clock divider for BRAM")

We implement both of the new registers as reads-as-written.

Message-id: 20210215115138.20465-11-peter.maydell@linaro.org

include/hw/misc/mps2-scc.h | 3 ++

hw/misc/mps2-scc.c | 71 ++++++++++++++++++++++++++++++++++++--

2 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/include/hw/misc/mps2-scc.h b/include/hw/misc/mps2-scc.h

--- a/include/hw/misc/mps2-scc.h

+++ b/include/hw/misc/mps2-scc.h

@@ -XXX,XX +XXX,XX @@ struct MPS2SCC {

uint32_t cfg0;

uint32_t cfg1;

+ uint32_t cfg2;

uint32_t cfg4;

+ uint32_t cfg5;

+ uint32_t cfg6;

uint32_t cfgdata_rtn;

uint32_t cfgdata_out;

uint32_t cfgctrl;

diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c

--- a/hw/misc/mps2-scc.c

+++ b/hw/misc/mps2-scc.c

@@ -XXX,XX +XXX,XX @@

REG32(CFG0, 0)

REG32(CFG1, 4)

+REG32(CFG2, 8)

REG32(CFG3, 0xc)

REG32(CFG4, 0x10)

+REG32(CFG5, 0x14)

+REG32(CFG6, 0x18)

REG32(CFGDATA_RTN, 0xa0)

REG32(CFGDATA_OUT, 0xa4)

REG32(CFGCTRL, 0xa8)

@@ -XXX,XX +XXX,XX @@ REG32(DLL, 0x100)

REG32(AID, 0xFF8)

REG32(ID, 0xFFC)

+static int scc_partno(MPS2SCC *s)

+{

+ /* Return the partno field of the SCC_ID (0x524, 0x511, etc) */

+ return extract32(s->id, 4, 8);

+}

/* Handle a write via the SYS_CFG channel to the specified function/device.

* Return false on error (reported to guest via SYS_CFGCTRL ERROR bit).

*/

@@ -XXX,XX +XXX,XX @@ static uint64_t mps2_scc_read(void *opaque, hwaddr offset, unsigned size)

case A_CFG1:

r = s->cfg1;

+ case A_CFG2:

+ if (scc_partno(s) != 0x524) {

+ /* CFG2 reserved on other boards */

+ goto bad_offset;

+ }

+ r = s->cfg2;

+ break;

case A_CFG3:

+ if (scc_partno(s) == 0x524) {

+ /* CFG3 reserved on AN524 */

+ goto bad_offset;

+ }

/* These are user-settable DIP switches on the board. We don't

* model that, so just return zeroes.

*/

@@ -XXX,XX +XXX,XX @@ static uint64_t mps2_scc_read(void *opaque, hwaddr offset, unsigned size)

case A_CFG4:

r = s->cfg4;

break;

+ case A_CFG5:

+ if (scc_partno(s) != 0x524) {

+ /* CFG5 reserved on other boards */

+ goto bad_offset;

+ }

+ r = s->cfg5;

+ break;

+ case A_CFG6:

+ if (scc_partno(s) != 0x524) {

+ /* CFG6 reserved on other boards */

+ goto bad_offset;

+ }

+ r = s->cfg6;

+ break;

case A_CFGDATA_RTN:

r = s->cfgdata_rtn;

break;

@@ -XXX,XX +XXX,XX @@ static uint64_t mps2_scc_read(void *opaque, hwaddr offset, unsigned size)

r = s->id;

break;

default:

+ bad_offset:

qemu_log_mask(LOG_GUEST_ERROR,

"MPS2 SCC read: bad offset %x\n", (int) offset);

r = 0;

@@ -XXX,XX +XXX,XX @@ static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value,

led_set_state(s->led[i], extract32(value, i, 1));

+ case A_CFG2:

+ if (scc_partno(s) != 0x524) {

+ /* CFG2 reserved on other boards */

+ goto bad_offset;

+ }

+ /* AN524: QSPI Select signal */

+ s->cfg2 = value;

+ break;

+ case A_CFG5:

+ if (scc_partno(s) != 0x524) {

+ /* CFG5 reserved on other boards */

+ goto bad_offset;

+ }

+ /* AN524: ACLK frequency in Hz */

+ s->cfg5 = value;

+ break;

+ case A_CFG6:

+ if (scc_partno(s) != 0x524) {

+ /* CFG6 reserved on other boards */

+ goto bad_offset;

+ }

+ /* AN524: Clock divider for BRAM */

+ s->cfg6 = value;

+ break;

case A_CFGDATA_OUT:

s->cfgdata_out = value;

@@ -XXX,XX +XXX,XX @@ static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value,

s->dll = deposit32(s->dll, 24, 8, extract32(value, 24, 8));

break;

default:

+ bad_offset:

qemu_log_mask(LOG_GUEST_ERROR,

"MPS2 SCC write: bad offset 0x%x\n", (int) offset);

break;

@@ -XXX,XX +XXX,XX @@ static void mps2_scc_reset(DeviceState *dev)

trace_mps2_scc_reset();

s->cfg0 = 0;

s->cfg1 = 0;

+ s->cfg2 = 0;

+ s->cfg5 = 0;

+ s->cfg6 = 0;

s->cfgdata_rtn = 0;

s->cfgdata_out = 0;

s->cfgctrl = 0x100000;

@@ -XXX,XX +XXX,XX @@ static void mps2_scc_realize(DeviceState *dev, Error **errp)

static const VMStateDescription mps2_scc_vmstate = {

.name = "mps2-scc",

- .version_id = 2,

- .minimum_version_id = 2,

+ .version_id = 3,

+ .minimum_version_id = 3,

.fields = (VMStateField[]) {

VMSTATE_UINT32(cfg0, MPS2SCC),

VMSTATE_UINT32(cfg1, MPS2SCC),

+ VMSTATE_UINT32(cfg2, MPS2SCC),

+ /* cfg3, cfg4 are read-only so need not be migrated */

+ VMSTATE_UINT32(cfg5, MPS2SCC),

+ VMSTATE_UINT32(cfg6, MPS2SCC),

VMSTATE_UINT32(cfgdata_rtn, MPS2SCC),

VMSTATE_UINT32(cfgdata_out, MPS2SCC),

VMSTATE_UINT32(cfgctrl, MPS2SCC),

The AN505 and AN521 have the same device layout, but the AN524 is

somewhat different. Allow for more than one PPCInfo array, which can

be selected based on the board type.

Message-id: 20210215115138.20465-16-peter.maydell@linaro.org

hw/arm/mps2-tz.c | 16 ++++++++++++++--

1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c

--- a/hw/arm/mps2-tz.c

+++ b/hw/arm/mps2-tz.c

@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)

MemoryRegion *system_memory = get_system_memory();

DeviceState *iotkitdev;

DeviceState *dev_splitter;

+ const PPCInfo *ppcs;

+ int num_ppcs;

int i;

if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {

@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)

* + wire up the PPC's control lines to the IoTKit object

*/

- const PPCInfo ppcs[] = { {

+ const PPCInfo an505_ppcs[] = { {

.name = "apb_ppcexp0",

.ports = {

{ "ssram-0", make_mpc, &mms->ssram_mpc[0], 0x58007000, 0x1000 },

@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)

},

};

- for (i = 0; i < ARRAY_SIZE(ppcs); i++) {

+ switch (mmc->fpga_type) {

+ case FPGA_AN505:

+ case FPGA_AN521:

+ ppcs = an505_ppcs;

+ num_ppcs = ARRAY_SIZE(an505_ppcs);

+ break;

+ default:

+ g_assert_not_reached();

+ }

+

+ for (i = 0; i < num_ppcs; i++) {

const PPCInfo *ppcinfo = &ppcs[i];

TZPPC *ppc = &mms->ppc[i];

DeviceState *ppcdev;

The AN505 and AN521 don't have any read-only memory, but the AN524

does; add a flag to ROMInfo to mark a region as ROM.

Message-id: 20210215115138.20465-19-peter.maydell@linaro.org

hw/arm/mps2-tz.c | 6 ++++++

1 file changed, 6 insertions(+)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c

--- a/hw/arm/mps2-tz.c

+++ b/hw/arm/mps2-tz.c

@@ -XXX,XX +XXX,XX @@ typedef struct RAMInfo {

* Flag values:

* IS_ALIAS: this RAM area is an alias to the upstream end of the

* MPC specified by its .mpc value

+ * IS_ROM: this RAM area is read-only

*/

#define IS_ALIAS 1

+#define IS_ROM 2

struct MPS2TZMachineClass {

MachineClass parent;

@@ -XXX,XX +XXX,XX @@ static MemoryRegion *mr_for_raminfo(MPS2TZMachineState *mms,

if (raminfo->mrindex < 0) {

/* Means this RAMInfo is for QEMU's "system memory" */

MachineState *machine = MACHINE(mms);

+ assert(!(raminfo->flags & IS_ROM));

return machine->ram;

}

@@ -XXX,XX +XXX,XX @@ static MemoryRegion *mr_for_raminfo(MPS2TZMachineState *mms,

memory_region_init_ram(ram, NULL, raminfo->name,

raminfo->size, &error_fatal);

+ if (raminfo->flags & IS_ROM) {

+ memory_region_set_readonly(ram, true);

+ }

return ram;

}

Instead of hardcoding the MachineClass default_ram_size and

default_ram_id fields, set them on class creation by finding the

entry in the RAMInfo array which is marked as being the QEMU system

RAM.

Message-id: 20210215115138.20465-18-peter.maydell@linaro.org

hw/arm/mps2-tz.c | 24 ++++++++++++++++++++++--

1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c

--- a/hw/arm/mps2-tz.c

+++ b/hw/arm/mps2-tz.c

@@ -XXX,XX +XXX,XX @@ static void mps2tz_class_init(ObjectClass *oc, void *data)

mc->init = mps2tz_common_init;

iic->check = mps2_tz_idau_check;

- mc->default_ram_size = 16 * MiB;

- mc->default_ram_id = "mps.ram";

+}

+

+static void mps2tz_set_default_ram_info(MPS2TZMachineClass *mmc)

+{

+ * Set mc->default_ram_size and default_ram_id from the

+ * information in mmc->raminfo.

+ */

+ MachineClass *mc = MACHINE_CLASS(mmc);

+ const RAMInfo *p;

+

+ for (p = mmc->raminfo; p->name; p++) {

+ if (p->mrindex < 0) {

+ /* Found the entry for "system memory" */

+ mc->default_ram_size = p->size;

+ mc->default_ram_id = p->name;

+ return;

+ }

+ }

+ g_assert_not_reached();

}

static void mps2tz_an505_class_init(ObjectClass *oc, void *data)

@@ -XXX,XX +XXX,XX @@ static void mps2tz_an505_class_init(ObjectClass *oc, void *data)

mmc->numirq = 92;

mmc->raminfo = an505_raminfo;

mmc->armsse_type = TYPE_IOTKIT;

+ mps2tz_set_default_ram_info(mmc);

}

static void mps2tz_an521_class_init(ObjectClass *oc, void *data)

@@ -XXX,XX +XXX,XX @@ static void mps2tz_an521_class_init(ObjectClass *oc, void *data)

mmc->numirq = 92;

mmc->raminfo = an505_raminfo; /* AN521 is the same as AN505 here */

mmc->armsse_type = TYPE_SSE200;

+ mps2tz_set_default_ram_info(mmc);

}

static const TypeInfo mps2tz_info = {

The AN505 and AN521 have the same layout of RAM; the AN524 does not.

Replace the current hard-coding of where the RAM is and which parts

of it are behind which MPCs with a data-driven approach.

Message-id: 20210215115138.20465-17-peter.maydell@linaro.org

hw/arm/mps2-tz.c | 175 +++++++++++++++++++++++++++++++++++++----------

1 file changed, 138 insertions(+), 37 deletions(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c

--- a/hw/arm/mps2-tz.c

+++ b/hw/arm/mps2-tz.c

@@ -XXX,XX +XXX,XX @@

#include "qom/object.h"

#define MPS2TZ_NUMIRQ_MAX 92

+#define MPS2TZ_RAM_MAX 4

typedef enum MPS2TZFPGAType {

FPGA_AN505,

FPGA_AN521,

} MPS2TZFPGAType;

+/*

+ * Define the layout of RAM in a board, including which parts are

+ * behind which MPCs.

+ * mrindex specifies the index into mms->ram[] to use for the backing RAM;

+ * -1 means "use the system RAM".

+ */

+typedef struct RAMInfo {

+ const char *name;

+ uint32_t base;

+ uint32_t size;

+ int mpc; /* MPC number, -1 for "not behind an MPC" */

+ int mrindex;

+ int flags;

+} RAMInfo;

+

+/*

+ * Flag values:

+ * IS_ALIAS: this RAM area is an alias to the upstream end of the

+ * MPC specified by its .mpc value

+ */

+#define IS_ALIAS 1

+

struct MPS2TZMachineClass {

MachineClass parent;

MPS2TZFPGAType fpga_type;

@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineClass {

uint32_t fpgaio_num_leds; /* Number of LEDs in FPGAIO LED0 register */

bool fpgaio_has_switches; /* Does FPGAIO have SWITCH register? */

int numirq; /* Number of external interrupts */

+ const RAMInfo *raminfo;

const char *armsse_type;

};

@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState {

MachineState parent;

ARMSSE iotkit;

- MemoryRegion ssram[3];

- MemoryRegion ssram1_m;

+ MemoryRegion ram[MPS2TZ_RAM_MAX];

MPS2SCC scc;

MPS2FPGAIO fpgaio;

TZPPC ppc[5];

- TZMPC ssram_mpc[3];

+ TZMPC mpc[3];

PL022State spi[5];

ArmSbconI2CState i2c[4];

UnimplementedDeviceState i2s_audio;

@@ -XXX,XX +XXX,XX @@ static const uint32_t an505_oscclk[] = {

25000000,

};

+static const RAMInfo an505_raminfo[] = { {

+ .name = "ssram-0",

+ .base = 0x00000000,

+ .size = 0x00400000,

+ .mpc = 0,

+ .mrindex = 0,

+ }, {

+ .name = "ssram-1",

+ .base = 0x28000000,

+ .size = 0x00200000,

+ .mpc = 1,

+ .mrindex = 1,

+ }, {

+ .name = "ssram-2",

+ .base = 0x28200000,

+ .size = 0x00200000,

+ .mpc = 2,

+ .mrindex = 2,

+ }, {

+ .name = "ssram-0-alias",

+ .base = 0x00400000,

+ .size = 0x00400000,

+ .mpc = 0,

+ .mrindex = 3,

+ .flags = IS_ALIAS,

+ }, {

+ /* Use the largest bit of contiguous RAM as our "system memory" */

+ .name = "mps.ram",

+ .base = 0x80000000,

+ .size = 16 * MiB,

+ .mpc = -1,

+ .mrindex = -1,

+ }, {

+ .name = NULL,

+ },

+};

+

+static const RAMInfo *find_raminfo_for_mpc(MPS2TZMachineState *mms, int mpc)

+{

+ MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);

+ const RAMInfo *p;

+

+ for (p = mmc->raminfo; p->name; p++) {

+ if (p->mpc == mpc && !(p->flags & IS_ALIAS)) {

+ return p;

+ }

+ }

+ /* if raminfo array doesn't have an entry for each MPC this is a bug */

+ g_assert_not_reached();

+}

+

+static MemoryRegion *mr_for_raminfo(MPS2TZMachineState *mms,

+ const RAMInfo *raminfo)

+{

+ /* Return an initialized MemoryRegion for the RAMInfo. */

+ MemoryRegion *ram;

+

+ if (raminfo->mrindex < 0) {

+ /* Means this RAMInfo is for QEMU's "system memory" */

+ MachineState *machine = MACHINE(mms);

+ return machine->ram;

+ }

+

+ assert(raminfo->mrindex < MPS2TZ_RAM_MAX);

+ ram = &mms->ram[raminfo->mrindex];

+

+ memory_region_init_ram(ram, NULL, raminfo->name,

+ raminfo->size, &error_fatal);

+ return ram;

+}

+

/* Create an alias of an entire original MemoryRegion @orig

* located at @base in the memory map.

*/

@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,

const int *irqs)

{

TZMPC *mpc = opaque;

- int i = mpc - &mms->ssram_mpc[0];

- MemoryRegion *ssram = &mms->ssram[i];

+ int i = mpc - &mms->mpc[0];

MemoryRegion *upstream;

- char *mpcname = g_strdup_printf("%s-mpc", name);

- static uint32_t ramsize[] = { 0x00400000, 0x00200000, 0x00200000 };

- static uint32_t rambase[] = { 0x00000000, 0x28000000, 0x28200000 };

+ const RAMInfo *raminfo = find_raminfo_for_mpc(mms, i);

+ MemoryRegion *ram = mr_for_raminfo(mms, raminfo);

- memory_region_init_ram(ssram, NULL, name, ramsize[i], &error_fatal);

-

- object_initialize_child(OBJECT(mms), mpcname, mpc, TYPE_TZ_MPC);

- object_property_set_link(OBJECT(mpc), "downstream", OBJECT(ssram),

+ object_initialize_child(OBJECT(mms), name, mpc, TYPE_TZ_MPC);

+ object_property_set_link(OBJECT(mpc), "downstream", OBJECT(ram),

&error_fatal);

sysbus_realize(SYS_BUS_DEVICE(mpc), &error_fatal);

/* Map the upstream end of the MPC into system memory */

upstream = sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 1);

- memory_region_add_subregion(get_system_memory(), rambase[i], upstream);

+ memory_region_add_subregion(get_system_memory(), raminfo->base, upstream);

/* and connect its interrupt to the IoTKit */

qdev_connect_gpio_out_named(DEVICE(mpc), "irq", 0,

qdev_get_gpio_in_named(DEVICE(&mms->iotkit),

"mpcexp_status", i));

- /* The first SSRAM is a special case as it has an alias; accesses to

- * the alias region at 0x00400000 must also go to the MPC upstream.

- */

- if (i == 0) {

- make_ram_alias(&mms->ssram1_m, "mps.ssram1_m", upstream, 0x00400000);

- }

-

- g_free(mpcname);

/* Return the register interface MR for our caller to map behind the PPC */

return sysbus_mmio_get_region(SYS_BUS_DEVICE(mpc), 0);

}

@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,

return sysbus_mmio_get_region(s, 0);

}

+static void create_non_mpc_ram(MPS2TZMachineState *mms)

+{

+ /*

+ * Handle the RAMs which are either not behind MPCs or which are

+ * aliases to another MPC.

+ */

+ const RAMInfo *p;

+ MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);

+

+ for (p = mmc->raminfo; p->name; p++) {

+ if (p->flags & IS_ALIAS) {

+ SysBusDevice *mpc_sbd = SYS_BUS_DEVICE(&mms->mpc[p->mpc]);

+ MemoryRegion *upstream = sysbus_mmio_get_region(mpc_sbd, 1);

+ make_ram_alias(&mms->ram[p->mrindex], p->name, upstream, p->base);

+ } else if (p->mpc == -1) {

+ /* RAM not behind an MPC */

+ MemoryRegion *mr = mr_for_raminfo(mms, p);

+ memory_region_add_subregion(get_system_memory(), p->base, mr);

+ }

+ }

+}

+

static void mps2tz_common_init(MachineState *machine)

{

MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);

@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)

qdev_connect_gpio_out_named(iotkitdev, "sec_resp_cfg", 0,

qdev_get_gpio_in(dev_splitter, 0));

- /* The IoTKit sets up much of the memory layout, including

+ /*

+ * The IoTKit sets up much of the memory layout, including

* the aliases between secure and non-secure regions in the

- * address space. The FPGA itself contains:

- *

- * 0x00000000..0x003fffff SSRAM1

- * 0x00400000..0x007fffff alias of SSRAM1

- * 0x28000000..0x283fffff 4MB SSRAM2 + SSRAM3

- * 0x40100000..0x4fffffff AHB Master Expansion 1 interface devices

- * 0x80000000..0x80ffffff 16MB PSRAM

- */

-

- /* The FPGA images have an odd combination of different RAMs,

+ * address space, and also most of the devices in the system.

+ * The FPGA itself contains various RAMs and some additional devices.

+ * The FPGA images have an odd combination of different RAMs,

* because in hardware they are different implementations and

* connected to different buses, giving varying performance/size

* tradeoffs. For QEMU they're all just RAM, though. We arbitrarily

- * call the 16MB our "system memory", as it's the largest lump.

+ * call the largest lump our "system memory".

*/

- memory_region_add_subregion(system_memory, 0x80000000, machine->ram);

/*

* The overflow IRQs for all UARTs are ORed together.

@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)

const PPCInfo an505_ppcs[] = { {

.name = "apb_ppcexp0",

.ports = {

- { "ssram-0", make_mpc, &mms->ssram_mpc[0], 0x58007000, 0x1000 },

- { "ssram-1", make_mpc, &mms->ssram_mpc[1], 0x58008000, 0x1000 },

- { "ssram-2", make_mpc, &mms->ssram_mpc[2], 0x58009000, 0x1000 },

+ { "ssram-0-mpc", make_mpc, &mms->mpc[0], 0x58007000, 0x1000 },

+ { "ssram-1-mpc", make_mpc, &mms->mpc[1], 0x58008000, 0x1000 },

+ { "ssram-2-mpc", make_mpc, &mms->mpc[2], 0x58009000, 0x1000 },

},

}, {

.name = "apb_ppcexp1",

@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)

create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000);

+ create_non_mpc_ram(mms);

+

armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0x400000);

}

@@ -XXX,XX +XXX,XX @@ static void mps2tz_an505_class_init(ObjectClass *oc, void *data)

mmc->fpgaio_num_leds = 2;

mmc->fpgaio_has_switches = false;

mmc->numirq = 92;

+ mmc->raminfo = an505_raminfo;

mmc->armsse_type = TYPE_IOTKIT;

}

@@ -XXX,XX +XXX,XX @@ static void mps2tz_an521_class_init(ObjectClass *oc, void *data)

mmc->fpgaio_num_leds = 2;

mmc->fpgaio_has_switches = false;

mmc->numirq = 92;

+ mmc->raminfo = an505_raminfo; /* AN521 is the same as AN505 here */

mmc->armsse_type = TYPE_SSE200;

}

Add support for the mps3-an524 board; this is an SSE-200 based FPGA

image, like the existing mps2-an521. It has a usefully larger amount

of RAM, and a PL031 RTC, as well as some more minor differences.

In real hardware this image runs on a newer generation of the FPGA

board, the MPS3 rather than the older MPS2. Architecturally the two

boards are similar, so we implement the MPS3 boards in the mps2-tz.c

file as variations of the existing MPS2 boards.

Message-id: 20210215115138.20465-21-peter.maydell@linaro.org

hw/arm/mps2-tz.c | 139 +++++++++++++++++++++++++++++++++++++++++++++--

1 file changed, 135 insertions(+), 4 deletions(-)