[Qemu-commits] [qemu/qemu] f95853: watchdog/aspeed: fix variable type to store reload...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: f958537a0d2037134b998dff597f8ae3cc6611fd
      
https://github.com/qemu/qemu/commit/f958537a0d2037134b998dff597f8ae3cc6611fd
  Author: Cédric Le Goater <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M hw/watchdog/wdt_aspeed.c

  Log Message:
  -----------
  watchdog/aspeed: fix variable type to store reload value

Initially from Anton D. Kachalov" <address@hidden> but the SoB was
missing.

Signed-off-by: Cédric Le Goater <address@hidden>
Acked-by: Andrew Jeffery <address@hidden>
Message-id: address@hidden
[clg: change commit log and subject
      replace UL suffix by ULL ]
Signed-off-by: Cédric Le Goater <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 8602beb7fad4b2abd5341f4303ec3c799fa0217c
      
https://github.com/qemu/qemu/commit/8602beb7fad4b2abd5341f4303ec3c799fa0217c
  Author: Igor Mammedov <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M include/hw/arm/arm.h

  Log Message:
  -----------
  arm: fix armv7m_init() declaration to match definition

s/cpu_model/cpu_type/ that has been forgotten during
conversion (ba1ba5cc), while touching the line also
fixup alignment.

Signed-off-by: Igor Mammedov <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: b9f587d62cebed427206539750ebf59bde4df422
      
https://github.com/qemu/qemu/commit/b9f587d62cebed427206539750ebf59bde4df422
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M target/arm/translate.c

  Log Message:
  -----------
  target/arm: Add M profile secure MMU index values to get_a32_user_mem_index()

Add the M profile secure MMU index values to the switch in
get_a32_user_mem_index() so that LDRT/STRT work correctly
rather than asserting at translate time.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: 333e10c51ef5876ced26f77b61b69ce0f83161a9
      
https://github.com/qemu/qemu/commit/333e10c51ef5876ced26f77b61b69ce0f83161a9
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Implement SG instruction

Implement the SG instruction, which we emulate 'by hand' in the
exception handling code path.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: 3e3fa230e3b8ffe119f14ba57a6bc677a411be57
      
https://github.com/qemu/qemu/commit/3e3fa230e3b8ffe119f14ba57a6bc677a411be57
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M target/arm/helper.c
    M target/arm/helper.h
    M target/arm/internals.h
    M target/arm/translate.c

  Log Message:
  -----------
  target/arm: Implement BLXNS

Implement the BLXNS instruction, which allows secure code to
call non-secure code.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: d02a8698d7ae2bfed3b11fe5b064cb0aa406863b
      
https://github.com/qemu/qemu/commit/d02a8698d7ae2bfed3b11fe5b064cb0aa406863b
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M target/arm/helper.c
    M target/arm/internals.h
    M target/arm/translate.c

  Log Message:
  -----------
  target/arm: Implement secure function return

Secure function return happens when a non-secure function has been
called using BLXNS and so has a particular magic LR value (either
0xfefffffe or 0xfeffffff). The function return via BX behaves
specially when the new PC value is this magic value, in the same
way that exception returns are handled.

Adjust our BX excret guards so that they recognize the function
return magic number as well, and perform the function-return
unstacking in do_v7m_exception_exit().

Signed-off-by: Peter Maydell <address@hidden>
Acked-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: 6b8acf256df09c8a8dd7dcaa79b06eaff4ad63f7
      
https://github.com/qemu/qemu/commit/6b8acf256df09c8a8dd7dcaa79b06eaff4ad63f7
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M target/arm/translate.c

  Log Message:
  -----------
  target-arm: Don't check for "Thumb2 or M profile" for not-Thumb1

The code which implements the Thumb1 split BL/BLX instructions
is guarded by a check on "not M or THUMB2". All we really need
to check here is "not THUMB2" (and we assume that elsewhere too,
eg in the ARCH(6T2) test that UNDEFs the Thumb2 insns).

This doesn't change behaviour because all M profile cores
have Thumb2 and so ARM_FEATURE_M implies ARM_FEATURE_THUMB2.
(v6M implements a very restricted subset of Thumb2, but we
can cross that bridge when we get to it with appropriate
feature bits.)

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: 296e5a0a6c393553079a641c50521ae33ff89324
      
https://github.com/qemu/qemu/commit/296e5a0a6c393553079a641c50521ae33ff89324
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M target/arm/translate.c

  Log Message:
  -----------
  target/arm: Pull Thumb insn word loads up to top level

Refactor the Thumb decode to do the loads of the instruction words at
the top level rather than only loading the second half of a 32-bit
Thumb insn in the middle of the decode.

This is simple apart from the awkward case of Thumb1, where the
BL/BLX prefix and suffix instructions live in what in Thumb2 is the
32-bit insn space.  To handle these we decode enough to identify
whether we're looking at a prefix/suffix that we handle as a 16 bit
insn, or a prefix that we're going to merge with the following suffix
to consider as a 32 bit insn.  The translation of the 16 bit cases
then moves from disas_thumb2_insn() to disas_thumb_insn().

The refactoring has the benefit that we don't need to pass the
CPUARMState* down into the decoder code any more, but the major
reason for doing this is that some Thumb instructions must be always
unconditional regardless of the IT state bits, so we need to know the
whole insn before we emit the "skip this insn if the IT bits and cond
state tell us to" code.  (The always unconditional insns are BKPT,
HLT and SG; the last of these is 32 bits.)

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: 5b8d7289e9e92a0d7bcecb93cd189e245fef10cd
      
https://github.com/qemu/qemu/commit/5b8d7289e9e92a0d7bcecb93cd189e245fef10cd
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M target/arm/translate.c

  Log Message:
  -----------
  target-arm: Simplify insn_crosses_page()

Recent changes have left insn_crosses_page() more complicated
than it needed to be:
 * it's only called from thumb_tr_translate_insn() so we know
   for certain that we're looking at a Thumb insn
 * the caller's check for dc->pc >= dc->next_page_start - 3
   means that dc->pc can't possibly be 4 aligned, so there's
   no need to check that (the check was partly there to ensure
   that we didn't treat an ARM insn as Thumb, I think)
 * we now have thumb_insn_is_16bit() which lets us do a precise
   check of the length of the next insn, rather than opencoding
   an inaccurate check

Simplify it down to just loading the first half of the insn
and calling thumb_insn_is_16bit() on it.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: dcf14dfb704519846f396a376339ebdb93eaf049
      
https://github.com/qemu/qemu/commit/dcf14dfb704519846f396a376339ebdb93eaf049
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M target/arm/translate.c

  Log Message:
  -----------
  target/arm: Support some Thumb insns being always unconditional

A few Thumb instructions are always unconditional even inside an
IT block (as opposed to being UNPREDICTABLE if used inside an
IT block): BKPT, the v8M SG instruction, and the A profile
HLT (debug halt) instruction.

This means we need to suppress the jump-over-instruction-on-condfail
code generation (though the IT state still advances as usual and
subsequent insns in the IT block may be conditional).

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: 76eff04d166b8fe747adbe82de8b7e060e668ff9
      
https://github.com/qemu/qemu/commit/76eff04d166b8fe747adbe82de8b7e060e668ff9
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M target/arm/translate.c

  Log Message:
  -----------
  target/arm: Implement SG instruction corner cases

The common situation of the SG instruction is that it is
executed from S&NSC memory by a CPU in NS state. That case
is handled by v7m_handle_execute_nsc(). However the instruction
also has defined behaviour in a couple of other cases:
 * SG instruction in NS memory (behaves as a NOP)
 * SG in S memory but CPU already secure (clears IT bits and
   does nothing else)
 * SG instruction in v8M without Security Extension (NOP)

These can be implemented in translate.c.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: a94bb9cd586c50d13b68e5fa4628cc36e29805c4
      
https://github.com/qemu/qemu/commit/a94bb9cd586c50d13b68e5fa4628cc36e29805c4
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M hw/intc/armv7m_nvic.c

  Log Message:
  -----------
  nvic: Add missing 'break'

Coverity points out that we forgot the 'break' for
the SAU_CTRL write case (CID1381683). This has
no actual visible consequences because it happens
that the following case is effectively a no-op.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden
Reviewed-by: Richard Henderson <address@hidden>


  Commit: cf5f7937b05c84d5565134f058c00cd48304a117
      
https://github.com/qemu/qemu/commit/cf5f7937b05c84d5565134f058c00cd48304a117
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M hw/intc/armv7m_nvic.c

  Log Message:
  -----------
  nvic: Fix miscalculation of offsets into ITNS array

This calculation of the first exception vector in
the ITNS<n> register being accessed:
  int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;

is incorrect, because offset is in bytes, so we only want
to multiply by 8.

Spotted by Coverity (CID 1381484, CID 1381488), though it is
not correct that it actually overflows the buffer, because
we have a 'startvec + i < s->num_irq' guard.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: f90ea7ba7c5ae7010ee0ce062207ae42530f57d6
      
https://github.com/qemu/qemu/commit/f90ea7ba7c5ae7010ee0ce062207ae42530f57d6
  Author: Peter Maydell <address@hidden>
  Date:   2017-10-12 (Thu, 12 Oct 2017)

  Changed paths:
    M hw/intc/armv7m_nvic.c
    M hw/watchdog/wdt_aspeed.c
    M include/hw/arm/arm.h
    M target/arm/helper.c
    M target/arm/helper.h
    M target/arm/internals.h
    M target/arm/translate.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20171012' 
into staging

target-arm queue:
 * v8M: SG, BLXNS, secure-return
 * v8M: fixes for coverity issues in previous patches
 * arm: fix armv7m_init() declaration to match definition
 * watchdog/aspeed: fix variable type to store reload value

# gpg: Signature made Thu 12 Oct 2017 17:02:49 BST
# gpg:                using RSA key 0x3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <address@hidden>"
# gpg:                 aka "Peter Maydell <address@hidden>"
# gpg:                 aka "Peter Maydell <address@hidden>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20171012:
  nvic: Fix miscalculation of offsets into ITNS array
  nvic: Add missing 'break'
  target/arm: Implement SG instruction corner cases
  target/arm: Support some Thumb insns being always unconditional
  target-arm: Simplify insn_crosses_page()
  target/arm: Pull Thumb insn word loads up to top level
  target-arm: Don't check for "Thumb2 or M profile" for not-Thumb1
  target/arm: Implement secure function return
  target/arm: Implement BLXNS
  target/arm: Implement SG instruction
  target/arm: Add M profile secure MMU index values to get_a32_user_mem_index()
  arm: fix armv7m_init() declaration to match definition
  watchdog/aspeed: fix variable type to store reload value

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/a0b261db8c03...f90ea7ba7c5a