target/mips: Add definition of nanoMIPS I7200 CPU

Add definition of the first nanoMIPS processor in QEMU.

Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

mips_malta: Fix semihosting argument passing for nanoMIPS bare metal

Fix passing argument for nanoMIPS bare metal related to the
semihosting regime.

Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

mips_malta: Add setting up GT64120 BARs to the nanoMIPS bootloader

Setup the GT64120 BARs in the nanoMIPS bootloader, in the same way that
they are setup in the MIPS32 bootloader. This is necessary for Linux to
be able to access peripherals, including the UART.

Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Paul Burton <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

mips_malta: Add basic nanoMIPS boot code for Malta board

Add basic nanoMIPS boot code for Malta.

Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

elf: Don't check FCR31_NAN2008 bit for nanoMIPS

nanoMIPS is always NaN2008 compliant, and rules for checking
FCR31's NAN2008 bit are obsoleted.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

elf: On elf loading, treat both EM_MIPS and EM_NANOMIPS as legal for MIPS

Modify load_elf32()/load_elf64() to treat EM_NANOMIPS as legal as
EM_MIPS is.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

elf: Relax MIPS' elf_check_arch() to accept EM_NANOMIPS too

Starting from nanoMIPS introduction, machine variant can be
EM_MIPS or EM_NANOMIPS.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

elf: Add EM_NANOMIPS value as a valid one for e_machine field

Value 249 is registered as valid for usage for nanoMIPS executables.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Fix ERET/ERETNC behavior related to ADEL exception

Fix ERET/ERETNC so that ADEL exception can be raised.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add updating BadInstr and BadInstrX for nanoMIPS

Update BadInstr and BadInstrX registers for nanoMIPS. The same
support for pre-nanoMIPS remains unimplemented.

Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add availability control via bit NMS

A set of nanoMIPS instructions is not available if Config5 bit NMS
is set.

Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>

target/mips: Add emulation of DSP ASE for nanoMIPS - part 6

Add emulation of DSP ASE instructions for nanoMIPS - part 6.

Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of DSP ASE for nanoMIPS - part 5

Add emulation of DSP ASE instructions for nanoMIPS - part 5.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of DSP ASE for nanoMIPS - part 4

Add emulation of DSP ASE instructions for nanoMIPS - part 4.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of DSP ASE for nanoMIPS - part 3

Add emulation of DSP ASE instructions for nanoMIPS - part 3.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of DSP ASE for nanoMIPS - part 2

Add emulation of DSP ASE instructions for nanoMIPS - part 2.

Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of DSP ASE for nanoMIPS - part 1

Add emulation of DSP ASE instructions for nanoMIPS - part 1.

Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Implement MT ASE support for nanoMIPS

Add emulation of MT ASE instructions for nanoMIPS.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Fix pre-nanoMIPS MT ASE instructions availability control

Use bits from configuration registers for availability control
of MT ASE instructions, rather than only ISA_MT bit in insn_flags.
This is done by adding a field in hflags for MT bit, and adding
functions check_mt() and check_cp0_mt().

Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of nanoMIPS 32-bit branch instructions

Add emulation of various flavors of nanoMIPS 32-bit branch
instructions.

Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Implement emulation of nanoMIPS LLWP/SCWP pair

Implement support for nanoMIPS LLWP/SCWP instructions. Beside
adding core functionality of these instructions, this patch adds
support for availability control via configuration bit XNP.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Dimitrije Nikolic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add CP0 Config3 and Config5 fields to DisasContext structure

Add CP0_Config3 and CP0_Config5 to DisasContext structure. This is
needed for implementing availability control of various instructions.

Reviewed-by: "Aleksandar Markovic <[email protected]>"
Signed-off-by: "Aleksandar Markovic <[email protected]>"

target/mips: Add emulation of nanoMIPS 32-bit load and store instructions

Add emulation of various nanoMIPS load and store instructions.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Implement emulation of nanoMIPS EXTW instruction

Implement emulation of nanoMIPS EXTW instruction. EXTW instruction
is similar to the MIPS r6 ALIGN instruction, except that it counts
the other way and in bits instead of bytes. We therefore generalise
gen_align() function into a new gen_align_bits() function (which
counts in bits instead of bytes and optimises when bits = size of
the word), and implement gen_align() and a new gen_ext() based on
that. Since we need to know the word size to check for when the
number of bits == the word size, the opc argument is replaced with
a wordsz argument (either 32 or 64).

Signed-off-by: James Hogan <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>

target/mips: Implement emulation of nanoMIPS ROTX instruction

Added a helper for ROTX based on the pseudocode from the
architecture spec. This instraction was not present in previous
MIPS instruction sets.

Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>

target/mips: Add emulation of misc nanoMIPS instructions (p_lsx)

Add emulation of nanoMIPS instructions situated in pool p_lsx, and
emulation of LSA instruction as well.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of misc nanoMIPS instructions (pool32axf)

Add emulation of misc nanoMIPS instructions situated in pool32axf.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of misc nanoMIPS instructions (pool32a0)

Add emulation of nanoMIPS instructions that are situated in pool32a0.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of nanoMIPS FP instructions

Add emulation of basic floating point arithmetic for nanoMIPS.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of nanoMIPS 48-bit instructions

Add emulation of LI48, ADDIU48, ADDIUGP48, ADDIUPC48, LWPC48, and
SWPC48 instructions.

Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of nanoMIPS instructions MOVE.P and MOVE.PREV

Add emulation of nanoMIPS instructions MOVE.P and MOVE.PREV.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of some common nanoMIPS 32-bit instructions

Add emulation of SIGRIE, SYSCALL, BREAK, SDBBP, ADDIU, ADDIUPC,
ADDIUGP.W, LWGP, SWGP, ORI, XORI, ANDI, and other instructions.

Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of nanoMIPS 16-bit save and restore instructions

Add emulation of SAVE16 and RESTORE.JRC16 instructions. Routines
gen_save(), gen_restore(), and gen_adjust_sp() are provided to support
this feature.

This patch at the same time provides function gen_op_addr_addi(). This
function will be used in emulation of some other nanoMIPS instructions.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of nanoMIPS 16-bit logic instructions

Add emulation of NOT16, AND16, XOR16, OR16 instructions.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of nanoMIPS 16-bit load and store instructions

Add emulation of LWXS16, LB16, SB16, LBU16, LH16, SH16, LHU16, LW16, LWSP16,
LW4X4, SW4X4, LWGP16, SWSP16, SW16, and SWGP16 instructions.

Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>
Reviewed-by: Aleksandar Markovic <[email protected]>

target/mips: Add emulation of nanoMIPS 16-bit misc instructions

Add emulation of misc nanoMIPS 16-bit instructions.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of nanoMIPS 16-bit shift instructions

Add emulation of nanoMIPS 16-bit shift instructions.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of nanoMIPS 16-bit branch instructions

Add emulation of nanoMIPS 16-bit branch instructions.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add emulation of nanoMIPS 16-bit arithmetic instructions

Add emulation of nanoMIPS 16-bit arithmetic instructions.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add nanoMIPS decoding and extraction utilities

Add some basic utility functions and macros for nanoMIPS decoding
engine.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add placeholder and invocation of decode_nanomips_opc()

Add empty body and invocation of decode_nanomips_opc() if the bit
ISA_NANOMIPS32 is set in ctx->insn_flags.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Prevent switching mode related to Config3 ISA bit for nanoMIPS

Only if Config3.ISA is 3 (microMIPS), the mode should be switched in
cpu_state_reset(). Config3.ISA is 1 for nanoMIPS processors, and no mode
change should happen.

Reviewed-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>

target/mips: Add nanoMIPS DSP ASE opcodes

Add nanoMIPS opcodes for DSP ASE instruction pools and instructions.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add nanoMIPS base instruction set opcodes

Add nanoMIPS opcodes. nanoMIPS instruction are organized by so-called
instruction pools. Each pool contains a set of opcodes, that in turn
can be instruction opcodes or instruction pool opcodes.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

target/mips: Add preprocessor constants for nanoMIPS

Add ISA_NANOMIPS32 and CPU_NANOMIPS32 preprocessor constants.

Reviewed-by: Richard Henderson <[email protected]>
Signed-off-by: Yongbok Kim <[email protected]>
Signed-off-by: Aleksandar Markovic <[email protected]>
Signed-off-by: Stefan Markovic <[email protected]>

Merge remote-tracking branch 'remotes/juanquintela/tags/check/20180822' into staging

check/next for 20180822

# gpg: Signature made Wed 22 Aug 2018 09:03:40 BST
# gpg:                using RSA key F487EF185872D723
# gpg: Good signature from "Juan Quintela <[email protected]>"
# gpg:                 aka "Juan Quintela <[email protected]>"
# Primary key fingerprint: 1899 FF8E DEBF 58CC EE03  4B82 F487 EF18 5872 D723

* remotes/juanquintela/tags/check/20180822:
  check: Only test tpm devices when they are compiled in
  check: Only test usb-ehci when it is compiled in
  check: Only test usb-uhci devices when they are compiled in
  check: Only test usb-ohci when it is compiled in
  check: Only test nvme when it is compiled in
  check: Only test pvpanic when it is compiled in
  check: Only test wdt_ib700 when it is compiled in
  check: Only test sdhci when it is compiled in
  check: Only test i82801b11 when it is compiled in
  check: Only test ioh3420 when it is compiled in
  check: Only test ipack when it is compiled in
  check: Only test hda when it is compiled in
  check: Only test ac97 when it is compiled in
  check: Only test es1370 when it is compiled in
  check: Only test rtl8139 when it is compiled in
  check: Only test pcnet when it is compiled in
  check: Only test eepro100 when it is compiled in
  check: Only test ne2000 when it is compiled in
  check: Only test vmxnet3 when it is compiled in

Signed-off-by: Peter Maydell <[email protected]>

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20180824-1' into staging

target-arm queue:
 * Fix rounding errors in scaling float-to-int and int-to-float operations
 * Connect virtualization-related IRQs and memory regions of GICv2
   in boards that use Cortex-A7 or Cortex-A15
 * Support taking exceptions to AArch32 Hyp mode
 * Clear CPSR.IL and CPSR.J on 32-bit exception entry
   (a minor bug fix that won't affect non-buggy guest code)
 * mps2-an505: Implement various missing devices:
   dual timer, watchdogs, counters in the FPGAIO registers,
   some missing ID/control registers, TrustZone Master Security
   Controllers, PL081 DMA controllers, PL022 SPI controllers
 * correct ID register values for mps2-an385, -an511, -an505
 * fix some hardcoded tabs in untouched backwaters of the
   target/arm codebase
 * raspi: Refactor framebuffer property handling code and implement
   support for the virtual framebuffer/viewport

# gpg: Signature made Fri 24 Aug 2018 13:19:04 BST
# gpg:                using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <[email protected]>"
# gpg:                 aka "Peter Maydell <[email protected]>"
# gpg:                 aka "Peter Maydell <[email protected]>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20180824-1: (52 commits)
  hw/arm/mps2: Fix ID register errors on AN511 and AN385
  hw/display/bcm2835_fb: Validate bcm2835_fb_mbox_push() config
  hw/display/bcm2835_fb: Validate config settings
  hw/display/bcm2835_fb: Fix handling of virtual framebuffer
  hw/display/bcm2835_fb: Abstract out calculation of pitch, size
  hw/display/bcm2835_fb: Reset resolution, etc correctly
  hw/display/bcm2835_fb: Drop unused size and pitch fields
  hw/misc/bcm2835_property: Track fb settings using BCM2835FBConfig
  hw/misc/bcm2835_fb: Move config fields to their own struct
  target/arm: Remove a handful of stray tabs
  target/arm: Untabify iwmmxt_helper.c
  target/arm: Untabify translate.c
  hw/arm/mps2-tz: Fix MPS2 SCC config register values
  hw/arm/mps2-tz: Instantiate SPI controllers
  hw/ssi/pl022: Correct wrong DMACR and ICR handling
  hw/ssi/pl022: Correct wrong value for PL022_INT_RT
  hw/ssi/pl022: Use DeviceState::realize rather than SysBusDevice::init
  hw/ssi/pl022: Don't directly call vmstate_register()
  hw/ssi/pl022: Set up reset function in class init
  hw/ssi/pl022: Allow use as embedded-struct device
  ...

Signed-off-by: Peter Maydell <[email protected]>

hw/arm/mps2: Fix ID register errors on AN511 and AN385

Fix MPS2 SCC config register values for the mps2-an511
and mps2-an385 boards:
 * the SCC_AID bits [23:20] specify the FPGA build target board revision,
   and the SCC_CFG4 register specifies the actual board revision, so
   these should have matching values. Claim to be board revision C,
   consistently -- we had the revision in the wrong part of SCC_AID.
 * SCC_ID bits [15:4] should be the board number in hex, not decimal

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180823175225[email protected]

hw/display/bcm2835_fb: Validate bcm2835_fb_mbox_push() config

Refactor bcm2835_fb_mbox_push() to work by calling
bcm2835_fb_validate_config() and bcm2835_fb_reconfigure(),
so that config set this way is also validated.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180814144436[email protected]

hw/display/bcm2835_fb: Validate config settings

Validate the config settings that the guest tries to set.

The wiki page documentation is not really accurate here:
generally rather than failing requests to set bad parameters,
the hardware will just clip them to something sensible.

Validate the most important parameters: sizes and
the viewport offsets. This prevents the framebuffer
code from trying to read out-of-range memory.

In the property handling code, we validate the new parameters every
time we encounter a tag that sets them. This means we validate the
config multiple times if the request includes multiple config-setting
tags, but the code would require significant restructuring to do a
validation only once but still return the clipped settings for
get-parameter tags and the buffer allocation tag.

Validation of settings made via the older bcm2835_fb_mbox_push()
function will be done in the next commit.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180814144436[email protected]

hw/display/bcm2835_fb: Fix handling of virtual framebuffer

The raspi framebuffir in bcm2835_fb supports the definition
of a virtual "viewport", which is smaller than the full
physical framebuffer size and at an adjustable offset within
it. Only the viewport area is sent to the screen. This allows
the guest to do things like double buffering, or scrolling
by adjusting the viewport origin. Currently QEMU doesn't
implement this at all.

Add support for this feature:
 * the property mailbox code needs to distinguish the
   virtual width/height from the physical width/height
 * the framebuffer code needs to do something with the
   virtual width/height/origin information

Note that the wiki documentation on the semantics of the
virtual and physical height and width has it the wrong way
around -- the virtual size is the size of the allocated
buffer, and the physical size is the size of the display,
so the virtual size is always the same as or larger than
the physical.

If the viewport size is set smaller than the physical
screen size, we ignore the viewport settings completely
and just display the physical screen area.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180814144436[email protected]

hw/display/bcm2835_fb: Abstract out calculation of pitch, size

Abstract out the calculation of the pitch and size of the
framebuffer into functions that operate on the BCM2835FBConfig
struct -- these are about to get a little more complicated
when we add support for virtual and physical sizes differing.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180814144436[email protected]

hw/display/bcm2835_fb: Reset resolution, etc correctly

The bcm2835_fb's initial resolution and other parameters are set
via QOM properties. We should reset to those initial values on
device reset, which means we need to save the QOM property
values somewhere that they are not overwritten by guest
changes to the framebuffer configuration.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180814144436[email protected]

hw/display/bcm2835_fb: Drop unused size and pitch fields

The BCM2835FBState struct has a 'pitch' field which is a
cached copy of xres * (bpp >> 3), and a 'size' field which is
a cached copy of pitch * yres. However we don't actually do
anything with these fields; delete them. We retain the
now-unused slots in the VMState struct for migration
compatibility.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180814144436[email protected]

hw/misc/bcm2835_property: Track fb settings using BCM2835FBConfig

Refactor the fb property setting code so that rather than
using a set of pointers to local variables to track
whether a config value has been updated in the current
mbox and if so what its new value is, we just copy
all the current settings of the fb at the start, and
then update that copy as we go along, before asking
the fb to switch to it at the end.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180814144436[email protected]

hw/misc/bcm2835_fb: Move config fields to their own struct

The handling of framebuffer properties in the bcm2835_property code
is a bit clumsy, because for each of the many fb related properties
we try to track the value we're about to set and whether we're going
to be setting a value, and then we hand all the new values off
to the framebuffer via a function which takes them all as separate
arguments. It would be simpler if the property code could easily
copy all the framebuffer's current settings, update them with
the new specified values and then ask the framebuffer to switch
to the new set.

As the first part of this refactoring, pull all the fb config
settings fields in BCM2835FBState out into their own struct.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180814144436[email protected]

target/arm: Remove a handful of stray tabs

Following the bulk conversion of the iwMMXt code, there are
just a handful of hard coded tabs in target/arm; fix them.
This is a whitespace-only patch.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 20180821165215[email protected]

target/arm: Untabify iwmmxt_helper.c

Untabify the arm iwmmxt_helper.c.  This affects only the iwMMXt code.
We've never touched that code in years, so it's not going to get
fixed up by our "change when touched" process, and a bulk change is
not going to be too disruptive.

This commit was produced using Emacs "untabify" (plus one
by-hand removal of a space to fix a checkpatch nit); it is
a whitespace-only change.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 20180821165215[email protected]

target/arm: Untabify translate.c

Untabify the arm translate.c. This affects only some lines,
mostly comments, in the iwMMXt code. We've never touched
that code in years, so it's not going to get fixed up
by our "change when touched" process, and a bulk change
is not going to be too disruptive.

This commit was produced using Emacs "untabify"; it is
a whitespace-only change.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 20180821165215[email protected]

hw/arm/mps2-tz: Fix MPS2 SCC config register values

Some of the config register values we were setting for the MPS2 SCC
weren't correct:
 * the SCC_AID bits [23:20] specify the FPGA build target board revision,
   and the SCC_CFG4 register specifies the actual board revision, so
   these should have matching values. Claim to be board revision C,
   consistently -- we had the revision in the wrong part of SCC_AID.
 * SCC_ID bits [15:4] should be 0x505, not decimal 505

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/arm/mps2-tz: Instantiate SPI controllers

The SPI controllers in the MPS2 AN505 board are PL022s.
We have a model of the PL022, so create these devices.

We don't currently model the LCD controller that sits behind
one of the PL022s; the others are intended to control devices
that sit on the FPGA's general purpose SPI connector or
"shield" expansion connectors.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/ssi/pl022: Correct wrong DMACR and ICR handling

In the PL022, register offset 0x20 is the ICR, a write-only
interrupt-clear register.  Register offset 0x24 is DMACR, the DMA
control register.  We were incorrectly implementing (a stub version
of) DMACR at 0x20, and not implementing anything at 0x24.  Fix this
bug.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/ssi/pl022: Correct wrong value for PL022_INT_RT

The PL022 interrupt registers have bits allocated as:
 0: ROR (receive overrun)
 1: RT (receive timeout)
 2: RX (receive FIFO half full or less)
 3: TX (transmit FIFO half full or less)

A cut and paste error meant we had the wrong value for
the PL022_INT_RT constant. This bug doesn't affect device
behaviour, because we don't implement the receive timeout
feature and so never set that interrupt bit.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/ssi/pl022: Use DeviceState::realize rather than SysBusDevice::init

Move from the legacy SysBusDevice::init method to using
DeviceState::realize.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/ssi/pl022: Don't directly call vmstate_register()

Use the DeviceState vmsd pointer rather than calling vmstate_register()
directly.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/ssi/pl022: Set up reset function in class init

Currently the PL022 calls pl022_reset() from its class init
function. Make it register a DeviceState reset method instead,
so that we reset the device on system reset.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/ssi/pl022: Allow use as embedded-struct device

Create a new include file for the pl022's device struct,
type macros, etc, so that it can be instantiated using
the "embedded struct" coding style.

While we're adding the new file to MAINTAINERS, add
also the .c file, which was missing an entry.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/arm/mps2-tz: Create PL081s and MSCs

The AN505 FPGA image includes four PL081 DMA controllers, each
of which is gated by a Master Security Controller that allows
the guest to prevent a non-secure DMA controller from accessing
memory that is used by secure guest code. Create and wire
up these devices.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/arm/iotkit: Wire up the lines for MSCs

The IoTKit doesn't have any MSCs itself but it does need
some wiring to connect the external signals from MSCs
in the outer board model up to the registers and the
NVIC IRQ line.

We also need to expose a MemoryRegion corresponding to
the AHB bus, so that MSCs in the outer board model can
use that as their downstream port. (In the FPGA this is
the "AHB Slave Expansion" ports shown in the block
diagram in the AN505 documentation.)

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/misc/iotkit-secctl: Wire up registers for controlling MSCs

The IoTKit does not have any Master Security Contollers itself,
but it does provide registers in the secure privilege control
block which allow control of MSCs in the external system.
Add support for these registers.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/misc/tz-msc: Model TrustZone Master Security Controller

Implement a model of the TrustZone Master Securtiy Controller,
as documented in the Arm CoreLink SIE-200 System IP for
Embedded TRM  (DDI0571G):
  https://developer.arm.com/products/architecture/m-profile/docs/ddi0571/g

The MSC is intended to sit in front of a device which can
be a bus master (eg a DMA controller) and programmably gate
its transactions. This allows a bus-mastering device to be
controlled by non-secure code but still restricted from
making accesses to addresses which are secure-only.

Signed-off-by: Peter Maydell <[email protected]>
Message-id: 20180820141116[email protected]
Reviewed-by: Richard Henderson <[email protected]>

hw/misc/iotkit: Wire up the sysctl and sysinfo register blocks

Wire up the system control element's register banks
(sysctl and sysinfo).

This is the last of the previously completely unimplemented
components in the IoTKit.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180820141116[email protected]

hw/misc/iotkit-sysinfo: Implement IoTKit system information block

Implement the IoTKit system control element's system information
block; this is just a pair of read-only version/config registers,
plus the usual PID/CID ID registers.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180820141116[email protected]

hw/misc/iotkit-sysctl: Implement IoTKit system control element

The Arm IoTKit includes a system control element which
provides a block of read-only ID registers and a block
of read-write control registers. Implement a minimal
version of this.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180820141116[email protected]

hw/arm/iotkit: Wire up the S32KTIMER

The IoTKit has a CMSDK timer device that runs on the S32KCLK.
Create this and wire it up.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180820141116[email protected]

hw/arm/iotkit: Wire up the watchdogs

The IoTKit includes three different instances of the
CMSDK APB watchdog; create and wire them up.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180820141116[email protected]

hw/arm/mps2: Wire up dual-timer in mps2-an385 and mps2-an511

The MPS2 FPGA images for the Cortex-M3 (mps2-an385 and mps2-511)
both include a CMSDK dual-timer module. Wire this up.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180820141116[email protected]

hw/arm/iotkit: Wire up the dualtimer

Now we have a model of the CMSDK dual timer, we can wire it
up in the IoTKit.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180820141116[email protected]

hw/timer/cmsdk-apb-dualtimer: Implement CMSDK dual timer module

The Arm Cortex-M System Design Kit includes a "dual-input timer module"
which combines two programmable down-counters. Implement a model
of this device.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180820141116[email protected]

hw/misc/mps2-fpgaio: Implement PSCNTR and COUNTER

In the MPS2 FPGAIO, PSCNTR is a free-running downcounter with
a reload value configured via the PRESCALE register, and
COUNTER counts up by 1 every time PSCNTR reaches zero.
Implement these counters.

We can just increment the counters migration subsection's
version ID because we only added it in the previous commit,
so no released QEMU versions will be using it.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Alistair Francis <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180820141116[email protected]

hw/misc/mps2-fpgaio: Implement 1Hz and 100Hz counters

The MPS2 FPGAIO block includes some simple free-running counters.
Implement these.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Message-id: 20180820141116[email protected]

hw/arm/boot: AArch32 kernels should be started in Hyp mode if available

The kernel booting specification for an AArch32 kernel requires that
it is booted in Hyp mode if available; otherwise the kernel can't
enable KVM. We were incorrectly leaving the kernel in SVC mode.
If we're booting an AArch32 kernel in the Nonsecure state and Hyp
mode is available, start in it.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180820153020[email protected]

target/arm: Clear CPSR.IL and CPSR.J on 32-bit exception entry

On 32-bit exception entry, CPSR.J must always be set to 0
(see v7A Arm ARM DDI0406C.c B1.8.5). CPSR.IL must also
be cleared on 32-bit exception entry (see v8A Arm ARM
DDI0487C.a G1.10).

Clear these bits. (This fixes a bug which will never be noticed
by non-buggy guests.)

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180820153020[email protected]

target/arm: Implement support for taking exceptions to Hyp mode

Implement the necessary support code for taking exceptions
to Hyp mode in AArch32.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180820153020[email protected]

target/arm: Factor out code for taking an AArch32 exception

Factor out the code which changes the CPU state so as to
actually take an exception to AArch32. We're going to want
to use this for handling exception entry to Hyp mode.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180820153020[email protected]

target/arm: Implement AArch32 HCR and HCR2

The AArch32 HCR and HCR2 registers alias HCR_EL2
bits [31:0] and [63:32]; implement them.

Since HCR2 exists in ARMv8 but not ARMv7, we need new
regdef arrays for "we have EL3, not EL2, we're ARMv8"
and "we have EL2, we're ARMv8" to hold the definitions.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180820153020[email protected]

target/arm: Implement RAZ/WI HACTLR2

The v8 AArch32 HACTLR2 register maps to bits [63:32] of ACTLR_EL2.
We implement ACTLR_EL2 as RAZ/WI, so make HACTLR2 also RAZ/WI.
(We put the regdef next to ACTLR_EL2 as a reminder in case we
ever make ACTLR_EL2 something other than RAZ/WI).

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Richard Henderson <[email protected]>
Reviewed-by: Edgar E. Iglesias <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180820153020[email protected]

hw/arm/vexpress: Add "virtualization" property controlling presence of EL2

Add a "virtualization" property to the vexpress-a15 board,
controlling presence of EL2. As with EL3, we default to
enabling it, but the user can disable it if they have an
older guest which can't cope with it being present.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180821132811[email protected]

hw/arm/vexpress: Don't set info->secure_boot if CPU doesn't have EL3

Don't request that the arm_load_kernel() code should boot in secure
state if the CPU doesn't have a secure state. Currently this
doesn't make a difference because the boot.c code only examines
the secure_boot flag in code guarded by an ARM_FEATURE_EL3 check,
but upcoming changes for supporting booting into Hyp mode will
change that.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180821132811[email protected]

hw/cpu/a15mpcore: If CPU has EL2, enable it on the GIC and wire it up

For the A15MPCore internal peripheral object, we handle GIC
security extensions support by checking whether the CPUs
have EL3 enabled; if so then we enable it also on the GIC.
Handle the virtualization extensions in the same way: if the
CPU has EL2 then enable it on the GIC and wire up the
virtualization-specific memory regions and the maintenance
interrupt.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180821132811[email protected]

hw/arm/fsl-imx6ul: Connect VIRQ and VFIQ

Connect the VIRQ and VFIQ lines from the GIC to the CPU;
these exist always for both CPU and GIC whether the
virtualization extensions are enabled or not, so we
can just unconditionally connect them.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180821132811[email protected]

hw/arm/fsl-imx6ul: Connect VIRQ and VFIQ

Connect the VIRQ and VFIQ lines from the GIC to the CPU;
these exist always for both CPU and GIC whether the
virtualization extensions are enabled or not, so we
can just unconditionally connect them.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180821132811[email protected]

hw/arm/highbank: Connect VIRQ and VFIQ

Connect the VIRQ and VFIQ lines from the GIC to the CPU;
these exist always for both CPU and GIC whether the
virtualization extensions are enabled or not, so we
can just unconditionally connect them.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180821132811[email protected]

hw/arm/vexpress: Connect VIRQ and VFIQ

Connect the VIRQ and VFIQ lines from the GIC to the CPU;
these exist always for both CPU and GIC whether the
virtualization extensions are enabled or not, so we
can just unconditionally connect them.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180821132811[email protected]

hw/intc/arm_gic: Make per-cpu GICH memory regions 0x200 bytes large

Reduce the size of the per-cpu GICH memory regions from 0x1000
to 0x200. The registers only cover 0x200 bytes, and the Cortex-A15
wants to map them at a spacing of 0x200 bytes apart. Having the
region be too large interferes with mapping them like that, so
reduce it.

Signed-off-by: Peter Maydell <[email protected]>
Reviewed-by: Luc Michel <[email protected]>
Message-id: 20180821132811[email protected]

target/arm: Use the float-to-int-scale softfloat routines

Signed-off-by: Richard Henderson <[email protected]>
Message-id: 20180814002653[email protected]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>

target/arm: Use the int-to-float-scale softfloat routines

Signed-off-by: Richard Henderson <[email protected]>
Message-id: 20180814002653[email protected]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>

softfloat: Add scaling float-to-int routines

Signed-off-by: Richard Henderson <[email protected]>
Message-id: 20180814002653[email protected]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>

softfloat: Add scaling int-to-float routines

Signed-off-by: Richard Henderson <[email protected]>
Message-id: 20180814002653[email protected]
Reviewed-by: Peter Maydell <[email protected]>
Signed-off-by: Peter Maydell <[email protected]>

tests/vm: Increase timeout waiting for VM to boot to 5 minutes

The VM tests currently have a timeout of 2 minutes for trying
to connect to ssh. Since the guest VM has to boot from cold
to the point of accepting inbound ssh during this time, if the
host machine is heavily loaded it can spuriously time out.
Increase the timeout from 2 to 5 minutes.

Signed-off-by: Peter Maydell <[email protected]>
Acked-by: Fam Zheng <[email protected]>
Message-id: 20180823112153[email protected]