Series comparison

-[Qemu-devel] [PULL 0/9] target-arm queue
+[Qemu-devel] [PULL 00/32] target-arm queue
-ARM bugfixes for rc1...
+Latest run of arm patches -- most of these are Philippe's SD card
 cleanups. I have more in my queue to review, but 32 is enough
 patches to warrant sending out.
+thanks
+-- PMM
-The following changes since commit f291910db61b5812e68f1e76afb3ade41d567bea:
+The following changes since commit ff8689611a1d954897d857b28f7ef404e11cfa2c:
-  Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-11-09' into staging (2017-11-13 13:13:12 +0000)
+  Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging (2018-02-22 11:37:05 +0000)
-are available in the git repository at:
+are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171113
+  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180222
-for you to fetch changes up to d25f2a72272b9ffe0d06710d6217d1169bc2cc7d:
+for you to fetch changes up to 4e5cc6756586e967993187657dfcdde4e00288d9:
-  accel/tcg/translate-all: expand cpu_restore_state addr check (2017-11-13 13:55:27 +0000)
+  sdcard: simplify SD_SEND_OP_COND (ACMD41) (2018-02-22 15:12:54 +0000)
 ----------------------------------------------------------------
-target-arm queue:
+ * New "raspi3" machine emulating RaspberryPi 3
- * translate-a64.c: silence gcc5 warning
+ * Fix bad register definitions for VMIDR and VMPIDR (which caused
- * highbank: validate register offset before access
+   assertions for 64-bit guest CPUs with EL2 on big-endian hosts)
- * MAINTAINERS: Add entries for Smartfusion2
+ * hw/char/stm32f2xx_usart: fix TXE/TC bit handling
- * accel/tcg/translate-all: expand cpu_restore_state addr check
+ * Fix ast2500 protection register emulation
-   (so usermode insn aborts don't crash with an assertion failure)
+ * Lots of SD card emulation cleanups and bugfixes
  * fix TCG initialization of some Arm boards by allowing them
    to specify min/default number of CPUs to create
 ----------------------------------------------------------------
-Alex Bennée (1):
+Hugo Landau (1):
-      accel/tcg/translate-all: expand cpu_restore_state addr check
+      Fix ast2500 protection register emulation
-Alistair Francis (2):
+Pekka Enberg (1):
-      xlnx-zynqmp: Properly support the smp command line option
+      raspi: Add "raspi3" machine type
       xlnx-zcu102: Add an info message deprecating the EP108
-Emilio G. Cota (4):
+Peter Maydell (1):
-      arm/translate-a64: mark path as unreachable to eliminate warning
+      target/arm: Fix register definitions for VMIDR and VMPIDR
       qom: move CPUClass.tcg_initialize to a global
       xlnx-zcu102: Specify the max number of CPUs for the EP108
       hw: add .min_cpus and .default_cpus fields to machine_class
-Prasad J Pandit (1):
+Philippe Mathieu-Daudé (28):
-      highbank: validate register offset before access
+      hw/sd/milkymist-memcard: use qemu_log_mask()
       hw/sd/milkymist-memcard: split realize() out of SysBusDevice init()
       hw/sd/milkymist-memcard: expose a SDBus and connect the SDCard to it
       hw/sd/ssi-sd: use the SDBus API, connect the SDCard to the bus
       sdcard: reorder SDState struct members
       sdcard: replace DPRINTF() by trace events
       sdcard: add a trace event for command responses
       sdcard: replace fprintf() by qemu_hexdump()
       sdcard: add more trace events
       sdcard: define SDMMC_CMD_MAX instead of using the magic '64'
       sdcard: use G_BYTE from cutils
       sdcard: use the registerfields API to access the OCR register
       sdcard: Don't always set the high capacity bit
       sdcard: update the CSD CRC register regardless the CSD structure version
       sdcard: fix the 'maximum data transfer rate' to 25MHz
       sdcard: clean the SCR register and add few comments
       sdcard: remove commands from unsupported old MMC specification
       sdcard: simplify using the ldst API
       sdcard: use the correct masked OCR in the R3 reply
       sdcard: use the registerfields API for the CARD_STATUS register masks
       sdcard: handle CMD54 (SDIO)
       sdcard: handle the Security Specification commands
       sdcard: use a more descriptive label 'unimplemented_spi_cmd'
       sdcard: handles more commands in SPI mode
       sdcard: check the card is in correct state for APP CMD (CMD55)
       sdcard: warn if host uses an incorrect address for APP CMD (CMD55)
       sdcard: simplify SEND_IF_COND (CMD8)
       sdcard: simplify SD_SEND_OP_COND (ACMD41)
-Subbaraya Sundeep (1):
+Richard Braun (1):
-      MAINTAINERS: Add entries for Smartfusion2
+      hw/char/stm32f2xx_usart: fix TXE/TC bit handling
- include/exec/exec-all.h    | 11 ++++++++++
+ hw/sd/sdmmc-internal.h            |  15 ++
- include/hw/boards.h        |  5 +++++
+ include/hw/char/stm32f2xx_usart.h |   7 +-
- include/qom/cpu.h          |  1 -
+ include/hw/sd/sd.h                |   1 -
- accel/tcg/translate-all.c  | 52 ++++++++++++++++++++++++++--------------------
+ hw/arm/raspi.c                    |  23 ++
- exec.c                     |  5 +++--
+ hw/char/stm32f2xx_usart.c         |  12 +-
- hw/arm/exynos4_boards.c    | 12 ++++-------
+ hw/misc/aspeed_scu.c              |   6 +-
- hw/arm/highbank.c          | 17 +++++++++++++--
+ hw/misc/aspeed_sdmc.c             |   8 +-
- hw/arm/raspi.c             |  2 ++
+ hw/sd/milkymist-memcard.c         |  87 +++----
- hw/arm/xlnx-zcu102.c       |  9 +++++++-
+ hw/sd/sd.c                        | 467 +++++++++++++++++++++++---------------
- hw/arm/xlnx-zynqmp.c       | 26 ++++++++++++++---------
+ hw/sd/ssi-sd.c                    |  32 +--
- target/arm/translate-a64.c |  2 ++
+ target/arm/helper.c               |   8 +-
- vl.c                       | 21 ++++++++++++++++---
+ hw/sd/trace-events                |  20 ++
- MAINTAINERS                | 17 +++++++++++++++
+files changed, 446 insertions(+), 240 deletions(-)
- qemu-doc.texi              |  7 +++++++
+ create mode 100644 hw/sd/sdmmc-internal.h
 files changed, 137 insertions(+), 50 deletions(-)

-New patch
+[Qemu-devel] [PULL 01/32] target/arm: Fix register definitions for VMIDR and VMPIDR
+The register definitions for VMIDR and VMPIDR have separate
+reginfo structs for the AArch32 and AArch64 registers. However
+the 32-bit versions are wrong:
+ * they use offsetof instead of offsetoflow32 to mark where
+   the 32-bit value lives in the uint64_t CPU state field
+ * they don't mark themselves as ARM_CP_ALIAS
+In particular this means that if you try to use an Arm guest CPU
+which enables EL2 on a big-endian host it will assert at reset:
+ target/arm/cpu.c:114: cp_reg_check_reset: Assertion `oldvalue == newvalue' failed.
+because the reset of the 32-bit register writes to the top
+half of the uint64_t.
+Correct the errors in the structures.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+---
+This is necessary for 'make check' to pass on big endian
+systems with the 'raspi3' board enabled, which is the
+first board which has an EL2-enabled-by-default CPU.
+---
+ target/arm/helper.c | 8 ++++----
+file changed, 4 insertions(+), 4 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
+             { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
+               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
+               .access = PL2_RW, .accessfn = access_el3_aa32ns,
+-              .resetvalue = cpu->midr,
+-              .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
++              .resetvalue = cpu->midr, .type = ARM_CP_ALIAS,
++              .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) },
+             { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64,
+               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
+               .access = PL2_RW, .resetvalue = cpu->midr,
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
+             { .name = "VMPIDR", .state = ARM_CP_STATE_AA32,
+               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
+               .access = PL2_RW, .accessfn = access_el3_aa32ns,
+-              .resetvalue = vmpidr_def,
+-              .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
++              .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS,
++              .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) },
+             { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64,
+               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
+               .access = PL2_RW,
+--
+.16.1

-[Qemu-devel] [PULL 8/9] hw: add .min_cpus and .default_cpus fields to machine_class
+[Qemu-devel] [PULL 02/32] raspi: Add "raspi3" machine type
-From: "Emilio G. Cota" <cota@braap.org>
+From: Pekka Enberg <penberg@iki.fi>
-max_cpus needs to be an upper bound on the number of vCPUs
+This patch adds a "raspi3" machine type, which can now be selected as
-initialized; otherwise TCG region initialization breaks.
+the machine to run on by users via the "-M" command line option to QEMU.
-Some boards initialize a hard-coded number of vCPUs, which is not
+The machine type does *not* ignore memory transaction failures so we
-captured by the global max_cpus and therefore breaks TCG initialization.
+likely need to add some dummy devices later when people run something
-Fix it by adding the .min_cpus field to machine_class.
+more complicated than what I'm using for testing.
-This commit also changes some user-facing behaviour: we now die if
+Signed-off-by: Pekka Enberg <penberg@iki.fi>
--smp is below this hard-coded vCPU minimum instead of silently
+[PMM: added #ifdef TARGET_AARCH64 so we don't provide the 64-bit
-ignoring the passed -smp value (sometimes announcing this by printing
+ board in the 32-bit only arm-softmmu build.]
-a warning). However, the introduction of .default_cpus lessens the
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-likelihood that users will notice this: if -smp isn't set, we now
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 assign the value in .default_cpus to both smp_cpus and max_cpus. IOW,
 if a user does not set -smp, they always get a correct number of vCPUs.
 This change fixes 3468b59 ("tcg: enable multiple TCG contexts in
 softmmu", 2017-10-24), which broke TCG initialization for some
 ARM boards.
 Fixes: 3468b59e18b179bc63c7ce934de912dfa9596122
 Reported-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
 Signed-off-by: Emilio G. Cota <cota@braap.org>
 Message-id: 1510343626-25861-6-git-send-email-cota@braap.org
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Emilio G. Cota <cota@braap.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/boards.h     |  5 +++++
+ hw/arm/raspi.c | 23 +++++++++++++++++++++++
- hw/arm/exynos4_boards.c | 12 ++++--------
+file changed, 23 insertions(+)
  hw/arm/raspi.c          |  2 ++
  hw/arm/xlnx-zcu102.c    |  2 ++
  vl.c                    | 21 ++++++++++++++++++---
 files changed, 31 insertions(+), 11 deletions(-)
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- /**
-  * MachineClass:
-+ * @max_cpus: maximum number of CPUs supported. Default: 1
-+ * @min_cpus: minimum number of CPUs supported. Default: 1
-+ * @default_cpus: number of CPUs instantiated if none are specified. Default: 1
-  * @get_hotplug_handler: this function is called during bus-less
-  *    device hotplug. If defined it returns pointer to an instance
-  *    of HotplugHandler object, which handles hotplug operation
-@@ -XXX,XX +XXX,XX @@ struct MachineClass {
-     BlockInterfaceType block_default_type;
-     int units_per_default_bus;
-     int max_cpus;
-+    int min_cpus;
-+    int default_cpus;
-     unsigned int no_serial:1,
-         no_parallel:1,
-         use_virtcon:1,
-diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4_boards.c
-+++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu-common.h"
- #include "cpu.h"
- #include "sysemu/sysemu.h"
--#include "sysemu/qtest.h"
- #include "hw/sysbus.h"
- #include "net/net.h"
- #include "hw/arm/arm.h"
-@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
-                            Exynos4BoardType board_type)
- {
-     Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
--    MachineClass *mc = MACHINE_GET_CLASS(machine);
--
--    if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
--        error_report("%s board supports only %d CPU cores, ignoring smp_cpus"
--                     " value",
--                     mc->name, EXYNOS4210_NCPUS);
--    }
-     exynos4_board_binfo.ram_size = exynos4_board_ram_size[board_type];
-     exynos4_board_binfo.board_id = exynos4_board_id[board_type];
-@@ -XXX,XX +XXX,XX @@ static void nuri_class_init(ObjectClass *oc, void *data)
-     mc->desc = "Samsung NURI board (Exynos4210)";
-     mc->init = nuri_init;
-     mc->max_cpus = EXYNOS4210_NCPUS;
-+    mc->min_cpus = EXYNOS4210_NCPUS;
-+    mc->default_cpus = EXYNOS4210_NCPUS;
-     mc->ignore_memory_transaction_failures = true;
- }
-@@ -XXX,XX +XXX,XX @@ static void smdkc210_class_init(ObjectClass *oc, void *data)
-     mc->desc = "Samsung SMDKC210 board (Exynos4210)";
-     mc->init = smdkc210_init;
-     mc->max_cpus = EXYNOS4210_NCPUS;
-+    mc->min_cpus = EXYNOS4210_NCPUS;
-+    mc->default_cpus = EXYNOS4210_NCPUS;
-     mc->ignore_memory_transaction_failures = true;
- }
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
 @@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
-     mc->no_floppy = 1;
+     mc->ignore_memory_transaction_failures = true;
-     mc->no_cdrom = 1;
+ };
-     mc->max_cpus = BCM2836_NCPUS;
+ DEFINE_MACHINE("raspi2", raspi2_machine_init)
 +
 +#ifdef TARGET_AARCH64
 +static void raspi3_init(MachineState *machine)
 +{
 +    raspi_init(machine, 3);
 +}
 +
 +static void raspi3_machine_init(MachineClass *mc)
 +{
 +    mc->desc = "Raspberry Pi 3";
 +    mc->init = raspi3_init;
 +    mc->block_default_type = IF_SD;
 +    mc->no_parallel = 1;
 +    mc->no_floppy = 1;
 +    mc->no_cdrom = 1;
 +    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
 +    mc->max_cpus = BCM2836_NCPUS;
 +    mc->min_cpus = BCM2836_NCPUS;
 +    mc->default_cpus = BCM2836_NCPUS;
-     mc->default_ram_size = 1024 * 1024 * 1024;
++    mc->default_ram_size = 1024 * 1024 * 1024;
-     mc->ignore_memory_transaction_failures = true;
++}
- };
++DEFINE_MACHINE("raspi3", raspi3_machine_init)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
++#endif
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zcu102.c
 +++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
      mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
 +    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
  }
  static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
      mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
 +    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
  }
  static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
 diff --git a/vl.c b/vl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/vl.c
 +++ b/vl.c
@@ -XXX,XX +XXX,XX @@ Chardev *virtcon_hds[MAX_VIRTIO_CONSOLES];
  Chardev *sclp_hds[MAX_SCLP_CONSOLES];
  int win2k_install_hack = 0;
  int singlestep = 0;
 -int smp_cpus = 1;
 -unsigned int max_cpus = 1;
 +int smp_cpus;
 +unsigned int max_cpus;
  int smp_cores = 1;
  int smp_threads = 1;
  int acpi_enabled = 1;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
          exit(0);
      }
 +    /* machine_class: default to UP */
 +    machine_class->max_cpus = machine_class->max_cpus ?: 1;
 +    machine_class->min_cpus = machine_class->min_cpus ?: 1;
 +    machine_class->default_cpus = machine_class->default_cpus ?: 1;
 +
 +    /* default to machine_class->default_cpus */
 +    smp_cpus = machine_class->default_cpus;
 +    max_cpus = machine_class->default_cpus;
 +
      smp_parse(qemu_opts_find(qemu_find_opts("smp-opts"), NULL));
 -    machine_class->max_cpus = machine_class->max_cpus ?: 1; /* Default to UP */
 +    /* sanity-check smp_cpus and max_cpus against machine_class */
 +    if (smp_cpus < machine_class->min_cpus) {
 +        error_report("Invalid SMP CPUs %d. The min CPUs "
 +                     "supported by machine '%s' is %d", smp_cpus,
 +                     machine_class->name, machine_class->min_cpus);
 +        exit(1);
 +    }
      if (max_cpus > machine_class->max_cpus) {
          error_report("Invalid SMP CPUs %d. The max CPUs "
                       "supported by machine '%s' is %d", max_cpus,
 --
-.7.4
+.16.1

-New patch
+[Qemu-devel] [PULL 03/32] hw/char/stm32f2xx_usart: fix TXE/TC bit handling
+From: Richard Braun <rbraun@sceen.net>
+I/O currently being synchronous, there is no reason to ever clear the
+SR_TXE bit. However the SR_TC bit may be cleared by software writing
+to the SR register, so set it on each write.
+In addition, fix the reset value of the USART status register.
+Signed-off-by: Richard Braun <rbraun@sceen.net>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+[PMM: removed XXX tag from comment, since it isn't something
+ we need to come back and fix in QEMU]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/char/stm32f2xx_usart.h |  7 ++++++-
+ hw/char/stm32f2xx_usart.c         | 12 ++++++++----
+files changed, 14 insertions(+), 5 deletions(-)
+diff --git a/include/hw/char/stm32f2xx_usart.h b/include/hw/char/stm32f2xx_usart.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/char/stm32f2xx_usart.h
++++ b/include/hw/char/stm32f2xx_usart.h
+@@ -XXX,XX +XXX,XX @@
+ #define USART_CR3  0x14
+ #define USART_GTPR 0x18
+-#define USART_SR_RESET 0x00C00000
++/*
++ * NB: The reset value mentioned in "24.6.1 Status register" seems bogus.
++ * Looking at "Table 98 USART register map and reset values", it seems it
++ * should be 0xc0, and that's how real hardware behaves.
++ */
++#define USART_SR_RESET (USART_SR_TXE | USART_SR_TC)
+ #define USART_SR_TXE  (1 << 7)
+ #define USART_SR_TC   (1 << 6)
+diff --git a/hw/char/stm32f2xx_usart.c b/hw/char/stm32f2xx_usart.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/char/stm32f2xx_usart.c
++++ b/hw/char/stm32f2xx_usart.c
+@@ -XXX,XX +XXX,XX @@ static uint64_t stm32f2xx_usart_read(void *opaque, hwaddr addr,
+     switch (addr) {
+     case USART_SR:
+         retvalue = s->usart_sr;
+-        s->usart_sr &= ~USART_SR_TC;
+         qemu_chr_fe_accept_input(&s->chr);
+         return retvalue;
+     case USART_DR:
+         DB_PRINT("Value: 0x%" PRIx32 ", %c\n", s->usart_dr, (char) s->usart_dr);
+-        s->usart_sr |= USART_SR_TXE;
+         s->usart_sr &= ~USART_SR_RXNE;
+         qemu_chr_fe_accept_input(&s->chr);
+         qemu_set_irq(s->irq, 0);
+@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_usart_write(void *opaque, hwaddr addr,
+     switch (addr) {
+     case USART_SR:
+         if (value <= 0x3FF) {
+-            s->usart_sr = value;
++            /* I/O being synchronous, TXE is always set. In addition, it may
++               only be set by hardware, so keep it set here. */
++            s->usart_sr = value | USART_SR_TXE;
+         } else {
+             s->usart_sr &= value;
+         }
+@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_usart_write(void *opaque, hwaddr addr,
+             /* XXX this blocks entire thread. Rewrite to use
+              * qemu_chr_fe_write and background I/O callbacks */
+             qemu_chr_fe_write_all(&s->chr, &ch, 1);
++            /* XXX I/O are currently synchronous, making it impossible for
++               software to observe transient states where TXE or TC aren't
++               set. Unlike TXE however, which is read-only, software may
++               clear TC by writing 0 to the SR register, so set it again
++               on each write. */
+             s->usart_sr |= USART_SR_TC;
+-            s->usart_sr &= ~USART_SR_TXE;
+         }
+         return;
+     case USART_BRR:
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 04/32] Fix ast2500 protection register emulation
+From: Hugo Landau <hlandau@devever.net>
+Some register blocks of the ast2500 are protected by protection key
+registers which require the right magic value to be written to those
+registers to allow those registers to be mutated.
+Register manuals indicate that writing the correct magic value to these
+registers should cause subsequent reads from those values to return 1,
+and writing any other value should cause subsequent reads to return 0.
+Previously, qemu implemented these registers incorrectly: the registers
+were handled as simple memory, meaning that writing some value x to a
+protection key register would result in subsequent reads from that
+register returning the same value x. The protection was implemented by
+ensuring that the current value of that register equaled the magic
+value.
+This modifies qemu to have the correct behaviour: attempts to write to a
+ast2500 protection register results in a transition to 1 or 0 depending
+on whether the written value is the correct magic. The protection logic
+is updated to ensure that the value of the register is nonzero.
+This bug caused deadlocks with u-boot HEAD: when u-boot is done with a
+protectable register block, it attempts to lock it by writing the
+bitwise inverse of the correct magic value, and then spinning forever
+until the register reads as zero. Since qemu implemented writes to these
+registers as ordinary memory writes, writing the inverse of the magic
+value resulted in subsequent reads returning that value, leading to
+u-boot spinning forever.
+Signed-off-by: Hugo Landau <hlandau@devever.net>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Acked-by: Andrew Jeffery <andrew@aj.id.au>
+Message-id: 20180220132627.4163-1-hlandau@devever.net
+[PMM: fixed incorrect code indentation]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/misc/aspeed_scu.c  | 6 +++++-
+ hw/misc/aspeed_sdmc.c | 8 +++++++-
+files changed, 12 insertions(+), 2 deletions(-)
+diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/aspeed_scu.c
++++ b/hw/misc/aspeed_scu.c
+@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
+     }
+     if (reg > PROT_KEY && reg < CPU2_BASE_SEG1 &&
+-            s->regs[PROT_KEY] != ASPEED_SCU_PROT_KEY) {
++            !s->regs[PROT_KEY]) {
+         qemu_log_mask(LOG_GUEST_ERROR, "%s: SCU is locked!\n", __func__);
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
+     trace_aspeed_scu_write(offset, size, data);
+     switch (reg) {
++    case PROT_KEY:
++        s->regs[reg] = (data == ASPEED_SCU_PROT_KEY) ? 1 : 0;
++        return;
++
+     case FREQ_CNTR_EVAL:
+     case VGA_SCRATCH1 ... VGA_SCRATCH8:
+     case RNG_DATA:
+diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/aspeed_sdmc.c
++++ b/hw/misc/aspeed_sdmc.c
+@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,
+         return;
+     }
+-    if (addr != R_PROT && s->regs[R_PROT] != PROT_KEY_UNLOCK) {
++    if (addr == R_PROT) {
++        s->regs[addr] = (data == PROT_KEY_UNLOCK) ? 1 : 0;
++        return;
++    }
++
++    if (!s->regs[R_PROT]) {
+         qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,
+             data &= ~ASPEED_SDMC_READONLY_MASK;
+             break;
+         case AST2500_A0_SILICON_REV:
++        case AST2500_A1_SILICON_REV:
+             data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
+             break;
+         default:
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 05/32] hw/sd/milkymist-memcard: use qemu_log_mask()
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Acked-by: Michael Walle <michael@walle.cc>
+Message-id: 20180216022933.10945-2-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/milkymist-memcard.c | 17 ++++++++++-------
+file changed, 10 insertions(+), 7 deletions(-)
+diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/milkymist-memcard.c
++++ b/hw/sd/milkymist-memcard.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
++#include "qemu/log.h"
+ #include "hw/hw.h"
+ #include "hw/sysbus.h"
+ #include "sysemu/sysemu.h"
+ #include "trace.h"
+-#include "qemu/error-report.h"
++#include "include/qapi/error.h"
+ #include "sysemu/block-backend.h"
+ #include "sysemu/blockdev.h"
+ #include "hw/sd/sd.h"
+@@ -XXX,XX +XXX,XX @@ static uint64_t memcard_read(void *opaque, hwaddr addr,
+         } else {
+             r = s->response[s->response_read_ptr++];
+             if (s->response_read_ptr > s->response_len) {
+-                error_report("milkymist_memcard: "
+-                        "read more cmd bytes than available. Clipping.");
++                qemu_log_mask(LOG_GUEST_ERROR, "milkymist_memcard: "
++                              "read more cmd bytes than available. Clipping.");
+                 s->response_read_ptr = 0;
+             }
+         }
+@@ -XXX,XX +XXX,XX @@ static uint64_t memcard_read(void *opaque, hwaddr addr,
+         break;
+     default:
+-        error_report("milkymist_memcard: read access to unknown register 0x"
+-                TARGET_FMT_plx, addr << 2);
++        qemu_log_mask(LOG_UNIMP, "milkymist_memcard: "
++                      "read access to unknown register 0x%" HWADDR_PRIx "\n",
++                      addr << 2);
+         break;
+     }
+@@ -XXX,XX +XXX,XX @@ static void memcard_write(void *opaque, hwaddr addr, uint64_t value,
+         break;
+     default:
+-        error_report("milkymist_memcard: write access to unknown register 0x"
+-                TARGET_FMT_plx, addr << 2);
++        qemu_log_mask(LOG_UNIMP, "milkymist_memcard: "
++                      "write access to unknown register 0x%" HWADDR_PRIx " "
++                      "(value 0x%" PRIx64 ")\n", addr << 2, value);
+         break;
+     }
+ }
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 06/32] hw/sd/milkymist-memcard: split realize() out of SysBusDevice init()
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Create the SDCard in the realize() function.
+Suggested-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Acked-by: Michael Walle <michael@walle.cc>
+Message-id: 20180216022933.10945-3-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/milkymist-memcard.c | 28 ++++++++++++++++------------
+file changed, 16 insertions(+), 12 deletions(-)
+diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/milkymist-memcard.c
++++ b/hw/sd/milkymist-memcard.c
+@@ -XXX,XX +XXX,XX @@ static void milkymist_memcard_reset(DeviceState *d)
+     device_reset(DEVICE(s->card));
+ }
+-static int milkymist_memcard_init(SysBusDevice *dev)
++static void milkymist_memcard_init(Object *obj)
++{
++    MilkymistMemcardState *s = MILKYMIST_MEMCARD(obj);
++    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
++
++    memory_region_init_io(&s->regs_region, OBJECT(s), &memcard_mmio_ops, s,
++            "milkymist-memcard", R_MAX * 4);
++    sysbus_init_mmio(dev, &s->regs_region);
++}
++
++static void milkymist_memcard_realize(DeviceState *dev, Error **errp)
+ {
+     MilkymistMemcardState *s = MILKYMIST_MEMCARD(dev);
+-    DriveInfo *dinfo;
+     BlockBackend *blk;
++    DriveInfo *dinfo;
+     /* FIXME use a qdev drive property instead of drive_get_next() */
+     dinfo = drive_get_next(IF_SD);
+     blk = dinfo ? blk_by_legacy_dinfo(dinfo) : NULL;
+     s->card = sd_init(blk, false);
+     if (s->card == NULL) {
+-        return -1;
++        error_setg(errp, "failed to init SD card");
++        return;
+     }
+-
+     s->enabled = blk && blk_is_inserted(blk);
+-
+-    memory_region_init_io(&s->regs_region, OBJECT(s), &memcard_mmio_ops, s,
+-            "milkymist-memcard", R_MAX * 4);
+-    sysbus_init_mmio(dev, &s->regs_region);
+-
+-    return 0;
+ }
+ static const VMStateDescription vmstate_milkymist_memcard = {
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_milkymist_memcard = {
+ static void milkymist_memcard_class_init(ObjectClass *klass, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(klass);
+-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+-    k->init = milkymist_memcard_init;
++    dc->realize = milkymist_memcard_realize;
+     dc->reset = milkymist_memcard_reset;
+     dc->vmsd = &vmstate_milkymist_memcard;
+     /* Reason: init() method uses drive_get_next() */
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo milkymist_memcard_info = {
+     .name          = TYPE_MILKYMIST_MEMCARD,
+     .parent        = TYPE_SYS_BUS_DEVICE,
+     .instance_size = sizeof(MilkymistMemcardState),
++    .instance_init = milkymist_memcard_init,
+     .class_init    = milkymist_memcard_class_init,
+ };
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 07/32] hw/sd/milkymist-memcard: expose a SDBus and connect the SDCard to it
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+using the sdbus_*() API.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Acked-by: Michael Walle <michael@walle.cc>
+Message-id: 20180216022933.10945-4-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/milkymist-memcard.c | 38 +++++++++++++++++++++-----------------
+file changed, 21 insertions(+), 17 deletions(-)
+diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/milkymist-memcard.c
++++ b/hw/sd/milkymist-memcard.c
+@@ -XXX,XX +XXX,XX @@ struct MilkymistMemcardState {
+     SysBusDevice parent_obj;
+     MemoryRegion regs_region;
+-    SDState *card;
++    SDBus sdbus;
+     int command_write_ptr;
+     int response_read_ptr;
+@@ -XXX,XX +XXX,XX @@ static void memcard_sd_command(MilkymistMemcardState *s)
+     req.crc = s->command[5];
+     s->response[0] = req.cmd;
+-    s->response_len = sd_do_command(s->card, &req, s->response+1);
++    s->response_len = sdbus_do_command(&s->sdbus, &req, s->response + 1);
+     s->response_read_ptr = 0;
+     if (s->response_len == 16) {
+@@ -XXX,XX +XXX,XX @@ static uint64_t memcard_read(void *opaque, hwaddr addr,
+             r = 0xffffffff;
+         } else {
+             r = 0;
+-            r |= sd_read_data(s->card) << 24;
+-            r |= sd_read_data(s->card) << 16;
+-            r |= sd_read_data(s->card) << 8;
+-            r |= sd_read_data(s->card);
++            r |= sdbus_read_data(&s->sdbus) << 24;
++            r |= sdbus_read_data(&s->sdbus) << 16;
++            r |= sdbus_read_data(&s->sdbus) << 8;
++            r |= sdbus_read_data(&s->sdbus);
+         }
+         break;
+     case R_CLK2XDIV:
+@@ -XXX,XX +XXX,XX @@ static void memcard_write(void *opaque, hwaddr addr, uint64_t value,
+         if (!s->enabled) {
+             break;
+         }
+-        sd_write_data(s->card, (value >> 24) & 0xff);
+-        sd_write_data(s->card, (value >> 16) & 0xff);
+-        sd_write_data(s->card, (value >> 8) & 0xff);
+-        sd_write_data(s->card, value & 0xff);
++        sdbus_write_data(&s->sdbus, (value >> 24) & 0xff);
++        sdbus_write_data(&s->sdbus, (value >> 16) & 0xff);
++        sdbus_write_data(&s->sdbus, (value >> 8) & 0xff);
++        sdbus_write_data(&s->sdbus, value & 0xff);
+         break;
+     case R_ENABLE:
+         s->regs[addr] = value;
+@@ -XXX,XX +XXX,XX @@ static void milkymist_memcard_reset(DeviceState *d)
+     for (i = 0; i < R_MAX; i++) {
+         s->regs[i] = 0;
+     }
+-    /* Since we're still using the legacy SD API the card is not plugged
+-     * into any bus, and we must reset it manually.
+-     */
+-    device_reset(DEVICE(s->card));
+ }
+ static void milkymist_memcard_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void milkymist_memcard_init(Object *obj)
+ static void milkymist_memcard_realize(DeviceState *dev, Error **errp)
+ {
+     MilkymistMemcardState *s = MILKYMIST_MEMCARD(dev);
++    DeviceState *carddev;
+     BlockBackend *blk;
+     DriveInfo *dinfo;
++    Error *err = NULL;
++    qbus_create_inplace(&s->sdbus, sizeof(s->sdbus), TYPE_SD_BUS,
++                        dev, "sd-bus");
++
++    /* Create and plug in the sd card */
+     /* FIXME use a qdev drive property instead of drive_get_next() */
+     dinfo = drive_get_next(IF_SD);
+     blk = dinfo ? blk_by_legacy_dinfo(dinfo) : NULL;
+-    s->card = sd_init(blk, false);
+-    if (s->card == NULL) {
+-        error_setg(errp, "failed to init SD card");
++    carddev = qdev_create(&s->sdbus.qbus, TYPE_SD_CARD);
++    qdev_prop_set_drive(carddev, "drive", blk, &err);
++    object_property_set_bool(OBJECT(carddev), true, "realized", &err);
++    if (err) {
++        error_setg(errp, "failed to init SD card: %s", error_get_pretty(err));
+         return;
+     }
+     s->enabled = blk && blk_is_inserted(blk);
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 08/32] hw/sd/ssi-sd: use the SDBus API, connect the SDCard to the bus
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+On reset the bus will reset the card,
+we can now drop the device_reset() call.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180216022933.10945-5-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/ssi-sd.c | 32 +++++++++++++++++++-------------
+file changed, 19 insertions(+), 13 deletions(-)
+diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/ssi-sd.c
++++ b/hw/sd/ssi-sd.c
+@@ -XXX,XX +XXX,XX @@ typedef struct {
+     int32_t arglen;
+     int32_t response_pos;
+     int32_t stopping;
+-    SDState *sd;
++    SDBus sdbus;
+ } ssi_sd_state;
+ #define TYPE_SSI_SD "ssi-sd"
+@@ -XXX,XX +XXX,XX @@ static uint32_t ssi_sd_transfer(SSISlave *dev, uint32_t val)
+             request.arg = (s->cmdarg[0] << 24) | (s->cmdarg[1] << 16)
+                            | (s->cmdarg[2] << 8) | s->cmdarg[3];
+             DPRINTF("CMD%d arg 0x%08x\n", s->cmd, request.arg);
+-            s->arglen = sd_do_command(s->sd, &request, longresp);
++            s->arglen = sdbus_do_command(&s->sdbus, &request, longresp);
+             if (s->arglen <= 0) {
+                 s->arglen = 1;
+                 s->response[0] = 4;
+@@ -XXX,XX +XXX,XX @@ static uint32_t ssi_sd_transfer(SSISlave *dev, uint32_t val)
+             DPRINTF("Response 0x%02x\n", s->response[s->response_pos]);
+             return s->response[s->response_pos++];
+         }
+-        if (sd_data_ready(s->sd)) {
++        if (sdbus_data_ready(&s->sdbus)) {
+             DPRINTF("Data read\n");
+             s->mode = SSI_SD_DATA_START;
+         } else {
+@@ -XXX,XX +XXX,XX @@ static uint32_t ssi_sd_transfer(SSISlave *dev, uint32_t val)
+         s->mode = SSI_SD_DATA_READ;
+         return 0xfe;
+     case SSI_SD_DATA_READ:
+-        val = sd_read_data(s->sd);
+-        if (!sd_data_ready(s->sd)) {
++        val = sdbus_read_data(&s->sdbus);
++        if (!sdbus_data_ready(&s->sdbus)) {
+             DPRINTF("Data read end\n");
+             s->mode = SSI_SD_CMD;
+         }
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_ssi_sd = {
+ static void ssi_sd_realize(SSISlave *d, Error **errp)
+ {
+     ssi_sd_state *s = FROM_SSI_SLAVE(ssi_sd_state, d);
++    DeviceState *carddev;
+     DriveInfo *dinfo;
++    Error *err = NULL;
++    qbus_create_inplace(&s->sdbus, sizeof(s->sdbus), TYPE_SD_BUS,
++                        DEVICE(d), "sd-bus");
++
++    /* Create and plug in the sd card */
+     /* FIXME use a qdev drive property instead of drive_get_next() */
+     dinfo = drive_get_next(IF_SD);
+-    s->sd = sd_init(dinfo ? blk_by_legacy_dinfo(dinfo) : NULL, true);
+-    if (s->sd == NULL) {
+-        error_setg(errp, "Device initialization failed.");
++    carddev = qdev_create(&s->sdbus.qbus, TYPE_SD_CARD);
++    if (dinfo) {
++        qdev_prop_set_drive(carddev, "drive", blk_by_legacy_dinfo(dinfo), &err);
++    }
++    object_property_set_bool(OBJECT(carddev), true, "spi", &err);
++    object_property_set_bool(OBJECT(carddev), true, "realized", &err);
++    if (err) {
++        error_setg(errp, "failed to init SD card: %s", error_get_pretty(err));
+         return;
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void ssi_sd_reset(DeviceState *dev)
+     s->arglen = 0;
+     s->response_pos = 0;
+     s->stopping = 0;
+-
+-    /* Since we're still using the legacy SD API the card is not plugged
+-     * into any bus, and we must reset it manually.
+-     */
+-    device_reset(DEVICE(s->sd));
+ }
+ static void ssi_sd_class_init(ObjectClass *klass, void *data)
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 09/32] sdcard: reorder SDState struct members
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+place card registers first, this will ease further code movements.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215220540.6556-2-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 16 +++++++++-------
+file changed, 9 insertions(+), 7 deletions(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ enum SDCardStates {
+ struct SDState {
+     DeviceState parent_obj;
+-    uint32_t mode;    /* current card mode, one of SDCardModes */
+-    int32_t state;    /* current card state, one of SDCardStates */
++    /* SD Memory Card Registers */
+     uint32_t ocr;
+-    QEMUTimer *ocr_power_timer;
+     uint8_t scr[8];
+     uint8_t cid[16];
+     uint8_t csd[16];
+     uint16_t rca;
+     uint32_t card_status;
+     uint8_t sd_status[64];
++
++    /* Configurable properties */
++    BlockBackend *blk;
++    bool spi;
++
++    uint32_t mode;    /* current card mode, one of SDCardModes */
++    int32_t state;    /* current card state, one of SDCardStates */
+     uint32_t vhs;
+     bool wp_switch;
+     unsigned long *wp_groups;
+@@ -XXX,XX +XXX,XX @@ struct SDState {
+     uint8_t pwd[16];
+     uint32_t pwd_len;
+     uint8_t function_group[6];
+-
+-    bool spi;
+     uint8_t current_cmd;
+     /* True if we will handle the next command as an ACMD. Note that this does
+      * *not* track the APP_CMD status bit!
+@@ -XXX,XX +XXX,XX @@ struct SDState {
+     uint8_t data[512];
+     qemu_irq readonly_cb;
+     qemu_irq inserted_cb;
+-    BlockBackend *blk;
+-
++    QEMUTimer *ocr_power_timer;
+     bool enable;
+     uint8_t dat_lines;
+     bool cmd_line;
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 10/32] sdcard: replace DPRINTF() by trace events
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215220540.6556-3-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c         | 32 ++++++++++++++++++++++++++------
+ hw/sd/trace-events |  6 ++++++
+files changed, 32 insertions(+), 6 deletions(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/error-report.h"
+ #include "qemu/timer.h"
+ #include "qemu/log.h"
++#include "trace.h"
+ //#define DEBUG_SD 1
+@@ -XXX,XX +XXX,XX @@ struct SDState {
+     bool cmd_line;
+ };
++static const char *sd_state_name(enum SDCardStates state)
++{
++    static const char *state_name[] = {
++        [sd_idle_state]             = "idle",
++        [sd_ready_state]            = "ready",
++        [sd_identification_state]   = "identification",
++        [sd_standby_state]          = "standby",
++        [sd_transfer_state]         = "transfer",
++        [sd_sendingdata_state]      = "sendingdata",
++        [sd_receivingdata_state]    = "receivingdata",
++        [sd_programming_state]      = "programming",
++        [sd_disconnect_state]       = "disconnect",
++    };
++    if (state == sd_inactive_state) {
++        return "inactive";
++    }
++    assert(state <= ARRAY_SIZE(state_name));
++    return state_name[state];
++}
++
+ static uint8_t sd_get_dat_lines(SDState *sd)
+ {
+     return sd->enable ? sd->dat_lines : 0;
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+     uint32_t rca = 0x0000;
+     uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 : req.arg;
++    trace_sdcard_normal_command(req.cmd, req.arg, sd_state_name(sd->state));
++
+     /* Not interpreting this as an app command */
+     sd->card_status &= ~APP_CMD;
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+         sd->multi_blk_cnt = 0;
+     }
+-    DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state);
+     switch (req.cmd) {
+     /* Basic commands (Class 0 and Class 1) */
+     case 0:    /* CMD0:   GO_IDLE_STATE */
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+         return sd_r1;
+     case 56:    /* CMD56:  GEN_CMD */
+-        fprintf(stderr, "SD: GEN_CMD 0x%08x\n", req.arg);
+-
+         switch (sd->state) {
+         case sd_transfer_state:
+             sd->data_offset = 0;
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+ static sd_rsp_type_t sd_app_command(SDState *sd,
+                                     SDRequest req)
+ {
+-    DPRINTF("ACMD%d 0x%08x\n", req.cmd, req.arg);
++    trace_sdcard_app_command(req.cmd, req.arg);
+     sd->card_status |= APP_CMD;
+     switch (req.cmd) {
+     case 6:    /* ACMD6:  SET_BUS_WIDTH */
+@@ -XXX,XX +XXX,XX @@ send_response:
+ static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
+ {
+-    DPRINTF("sd_blk_read: addr = 0x%08llx, len = %d\n",
+-            (unsigned long long) addr, len);
++    trace_sdcard_read_block(addr, len);
+     if (!sd->blk || blk_pread(sd->blk, addr, sd->data, len) < 0) {
+         fprintf(stderr, "sd_blk_read: read error on host side\n");
+     }
+@@ -XXX,XX +XXX,XX @@ static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
+ static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
+ {
++    trace_sdcard_write_block(addr, len);
+     if (!sd->blk || blk_pwrite(sd->blk, addr, sd->data, len, 0) < 0) {
+         fprintf(stderr, "sd_blk_write: write error on host side\n");
+     }
+diff --git a/hw/sd/trace-events b/hw/sd/trace-events
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/trace-events
++++ b/hw/sd/trace-events
+@@ -XXX,XX +XXX,XX @@ sdhci_read_dataport(uint16_t data_count) "all %u bytes of data have been read fr
+ sdhci_write_dataport(uint16_t data_count) "write buffer filled with %u bytes of data"
+ sdhci_capareg(const char *desc, uint16_t val) "%s: %u"
++# hw/sd/sd.c
++sdcard_normal_command(uint8_t cmd, uint32_t arg, const char *state) "CMD%d arg 0x%08x (state %s)"
++sdcard_app_command(uint8_t acmd, uint32_t arg) "ACMD%d arg 0x%08x"
++sdcard_read_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
++sdcard_write_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
++
+ # hw/sd/milkymist-memcard.c
+ milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
+ milkymist_memcard_memory_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
+--
+.16.1

-[Qemu-devel] [PULL 1/9] arm/translate-a64: mark path as unreachable to eliminate warning
+[Qemu-devel] [PULL 11/32] sdcard: add a trace event for command responses
-From: "Emilio G. Cota" <cota@braap.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Fixes the following warning when compiling with gcc 5.4.0 with -O1
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-optimizations and --enable-debug:
+Message-id: 20180215220540.6556-4-f4bug@amsat.org
 target/arm/translate-a64.c: In function ‘aarch64_tr_translate_insn’:
 target/arm/translate-a64.c:2361:8: error: ‘post_index’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
      if (!post_index) {
         ^
 target/arm/translate-a64.c:2307:10: note: ‘post_index’ was declared here
      bool post_index;
           ^
 target/arm/translate-a64.c:2386:8: error: ‘writeback’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
      if (writeback) {
         ^
 target/arm/translate-a64.c:2308:10: note: ‘writeback’ was declared here
      bool writeback;
           ^
 Note that idx comes from selecting 2 bits, and therefore its value
 can be at most 3.
 Signed-off-by: Emilio G. Cota <cota@braap.org>
 Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 1510087611-1851-1-git-send-email-cota@braap.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 2 ++
+ hw/sd/sd.c         | 27 ++++++++++++++++++++++++---
-file changed, 2 insertions(+)
+ hw/sd/trace-events |  1 +
 files changed, 25 insertions(+), 3 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/sd/sd.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
+@@ -XXX,XX +XXX,XX @@ static const char *sd_state_name(enum SDCardStates state)
-         post_index = false;
+     return state_name[state];
-         writeback = true;
+ }
 +static const char *sd_response_name(sd_rsp_type_t rsp)
 +{
 +    static const char *response_name[] = {
 +        [sd_r0]     = "RESP#0 (no response)",
 +        [sd_r1]     = "RESP#1 (normal cmd)",
 +        [sd_r2_i]   = "RESP#2 (CID reg)",
 +        [sd_r2_s]   = "RESP#2 (CSD reg)",
 +        [sd_r3]     = "RESP#3 (OCR reg)",
 +        [sd_r6]     = "RESP#6 (RCA)",
 +        [sd_r7]     = "RESP#7 (operating voltage)",
 +    };
 +    if (rsp == sd_illegal) {
 +        return "ILLEGAL RESP";
 +    }
 +    if (rsp == sd_r1b) {
 +        rsp = sd_r1;
 +    }
 +    assert(rsp <= ARRAY_SIZE(response_name));
 +    return response_name[rsp];
 +}
 +
  static uint8_t sd_get_dat_lines(SDState *sd)
  {
      return sd->enable ? sd->dat_lines : 0;
@@ -XXX,XX +XXX,XX @@ send_response:
      case sd_r0:
      case sd_illegal:
 -    default:
          rsplen = 0;
          break;
 +    default:
 +        g_assert_not_reached();
      }
++    trace_sdcard_response(sd_response_name(rtype), rsplen);
-     if (rn == 31) {
      if (rtype != sd_illegal) {
          /* Clear the "clear on valid command" status bits now we've
@@ -XXX,XX +XXX,XX @@ send_response:
              DPRINTF(" %02x", response[i]);
          }
          DPRINTF(" state %d\n", sd->state);
 -    } else {
 -        DPRINTF("No response %d\n", sd->state);
      }
  #endif
 diff --git a/hw/sd/trace-events b/hw/sd/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sd/trace-events
 +++ b/hw/sd/trace-events
@@ -XXX,XX +XXX,XX @@ sdhci_capareg(const char *desc, uint16_t val) "%s: %u"
  # hw/sd/sd.c
  sdcard_normal_command(uint8_t cmd, uint32_t arg, const char *state) "CMD%d arg 0x%08x (state %s)"
  sdcard_app_command(uint8_t acmd, uint32_t arg) "ACMD%d arg 0x%08x"
 +sdcard_response(const char *rspdesc, int rsplen) "%s (sz:%d)"
  sdcard_read_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
  sdcard_write_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
 --
-.7.4
+.16.1

-New patch
+[Qemu-devel] [PULL 12/32] sdcard: replace fprintf() by qemu_hexdump()
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215220540.6556-5-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 16 +---------------
+file changed, 1 insertion(+), 15 deletions(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@
+ //#define DEBUG_SD 1
+-#ifdef DEBUG_SD
+-#define DPRINTF(fmt, ...) \
+-do { fprintf(stderr, "SD: " fmt , ## __VA_ARGS__); } while (0)
+-#else
+-#define DPRINTF(fmt, ...) do {} while(0)
+-#endif
+-
+ #define ACMD41_ENQUIRY_MASK     0x00ffffff
+ #define OCR_POWER_UP            0x80000000
+ #define OCR_POWER_DELAY_NS      500000 /* 0.5ms */
+@@ -XXX,XX +XXX,XX @@ send_response:
+     }
+ #ifdef DEBUG_SD
+-    if (rsplen) {
+-        int i;
+-        DPRINTF("Response:");
+-        for (i = 0; i < rsplen; i++) {
+-            DPRINTF(" %02x", response[i]);
+-        }
+-        DPRINTF(" state %d\n", sd->state);
+-    }
++    qemu_hexdump((const char *)response, stderr, "Response", rsplen);
+ #endif
+     return rsplen;
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 13/32] sdcard: add more trace events
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Acked-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215220540.6556-6-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c         | 32 ++++++++++++++++++++++++++------
+ hw/sd/trace-events | 13 +++++++++++++
+files changed, 39 insertions(+), 6 deletions(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static bool sd_get_cmd_line(SDState *sd)
+ static void sd_set_voltage(SDState *sd, uint16_t millivolts)
+ {
++    trace_sdcard_set_voltage(millivolts);
++
+     switch (millivolts) {
+     case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
+     case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
+@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
+ {
+     SDState *sd = opaque;
++    trace_sdcard_powerup();
+     /* Set powered up bit in OCR */
+     assert(!(sd->ocr & OCR_POWER_UP));
+     sd->ocr |= OCR_POWER_UP;
+@@ -XXX,XX +XXX,XX @@ static void sd_reset(DeviceState *dev)
+     uint64_t size;
+     uint64_t sect;
++    trace_sdcard_reset();
+     if (sd->blk) {
+         blk_get_geometry(sd->blk, &sect);
+     } else {
+@@ -XXX,XX +XXX,XX @@ static void sd_cardchange(void *opaque, bool load, Error **errp)
+     bool readonly = sd_get_readonly(sd);
+     if (inserted) {
++        trace_sdcard_inserted(readonly);
+         sd_reset(dev);
++    } else {
++        trace_sdcard_ejected();
+     }
+     /* The IRQ notification is for legacy non-QOM SD controller devices;
+@@ -XXX,XX +XXX,XX @@ static void sd_erase(SDState *sd)
+     uint64_t erase_start = sd->erase_start;
+     uint64_t erase_end = sd->erase_end;
++    trace_sdcard_erase();
+     if (!sd->erase_start || !sd->erase_end) {
+         sd->card_status |= ERASE_SEQ_ERROR;
+         return;
+@@ -XXX,XX +XXX,XX @@ static void sd_lock_command(SDState *sd)
+     else
+         pwd_len = 0;
++    if (lock) {
++        trace_sdcard_lock();
++    } else {
++        trace_sdcard_unlock();
++    }
+     if (erase) {
+         if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
+                         set_pwd || clr_pwd || lock || sd->wp_switch ||
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+     case 16:    /* CMD16:  SET_BLOCKLEN */
+         switch (sd->state) {
+         case sd_transfer_state:
+-            if (req.arg > (1 << HWBLOCK_SHIFT))
++            if (req.arg > (1 << HWBLOCK_SHIFT)) {
+                 sd->card_status |= BLOCK_LEN_ERROR;
+-            else
++            } else {
++                trace_sdcard_set_blocklen(req.arg);
+                 sd->blk_len = req.arg;
++            }
+             return sd_r1;
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
+                 if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
+                     timer_del(sd->ocr_power_timer);
+                     sd_ocr_powerup(sd);
+-                } else if (!timer_pending(sd->ocr_power_timer)) {
+-                    timer_mod_ns(sd->ocr_power_timer,
+-                                 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
+-                                  + OCR_POWER_DELAY_NS));
++                } else {
++                    trace_sdcard_inquiry_cmd41();
++                    if (!timer_pending(sd->ocr_power_timer)) {
++                        timer_mod_ns(sd->ocr_power_timer,
++                                     (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
++                                      + OCR_POWER_DELAY_NS));
++                    }
+                 }
+             }
+@@ -XXX,XX +XXX,XX @@ void sd_write_data(SDState *sd, uint8_t value)
+     if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
+         return;
++    trace_sdcard_write_data(sd->current_cmd, value);
+     switch (sd->current_cmd) {
+     case 24:    /* CMD24:  WRITE_SINGLE_BLOCK */
+         sd->data[sd->data_offset ++] = value;
+@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
+     io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len;
++    trace_sdcard_read_data(sd->current_cmd, io_len);
+     switch (sd->current_cmd) {
+     case 6:    /* CMD6:   SWITCH_FUNCTION */
+         ret = sd->data[sd->data_offset ++];
+diff --git a/hw/sd/trace-events b/hw/sd/trace-events
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/trace-events
++++ b/hw/sd/trace-events
+@@ -XXX,XX +XXX,XX @@ sdhci_capareg(const char *desc, uint16_t val) "%s: %u"
+ sdcard_normal_command(uint8_t cmd, uint32_t arg, const char *state) "CMD%d arg 0x%08x (state %s)"
+ sdcard_app_command(uint8_t acmd, uint32_t arg) "ACMD%d arg 0x%08x"
+ sdcard_response(const char *rspdesc, int rsplen) "%s (sz:%d)"
++sdcard_powerup(void) ""
++sdcard_inquiry_cmd41(void) ""
++sdcard_set_enable(bool current_state, bool new_state) "%u -> %u"
++sdcard_reset(void) ""
++sdcard_set_blocklen(uint16_t length) "0x%04x"
++sdcard_inserted(bool readonly) "read_only: %u"
++sdcard_ejected(void) ""
++sdcard_erase(void) ""
++sdcard_lock(void) ""
++sdcard_unlock(void) ""
+ sdcard_read_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
+ sdcard_write_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
++sdcard_write_data(uint8_t cmd, uint8_t value) "CMD%02d value 0x%02x"
++sdcard_read_data(uint8_t cmd, int length) "CMD%02d len %d"
++sdcard_set_voltage(uint16_t millivolts) "%u mV"
+ # hw/sd/milkymist-memcard.c
+ milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
+--
+.16.1

-[Qemu-devel] [PULL 5/9] xlnx-zynqmp: Properly support the smp command line option
+[Qemu-devel] [PULL 14/32] sdcard: define SDMMC_CMD_MAX instead of using the magic '64'
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Allow the -smp command line option to control the number of CPUs we
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-create.
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215220540.6556-8-f4bug@amsat.org
 Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
 Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
 Reviewed-by: Emilio G. Cota <cota@braap.org>
 Tested-by: Emilio G. Cota <cota@braap.org>
 Message-id: 1510343626-25861-3-git-send-email-cota@braap.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-zcu102.c |  3 ++-
+ hw/sd/sdmmc-internal.h | 15 +++++++++++++++
- hw/arm/xlnx-zynqmp.c | 26 ++++++++++++++++----------
+ hw/sd/sd.c             | 22 ++++++++++++++++------
-files changed, 18 insertions(+), 11 deletions(-)
+files changed, 31 insertions(+), 6 deletions(-)
  create mode 100644 hw/sd/sdmmc-internal.h
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/hw/sd/sdmmc-internal.h b/hw/sd/sdmmc-internal.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/sd/sdmmc-internal.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * SD/MMC cards common
 + *
 + * Copyright (c) 2018  Philippe Mathieu-Daudé <f4bug@amsat.org>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +#ifndef SD_INTERNAL_H
 +#define SD_INTERNAL_H
 +
 +#define SDMMC_CMD_MAX 64
 +
 +#endif
 diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/hw/sd/sd.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@
- {
+ #include "qemu/error-report.h"
-     MachineClass *mc = MACHINE_CLASS(oc);
+ #include "qemu/timer.h"
+ #include "qemu/log.h"
--    mc->desc = "Xilinx ZynqMP ZCU102 board";
++#include "sdmmc-internal.h"
-+    mc->desc = "Xilinx ZynqMP ZCU102 board with 4xA53s and 2xR5s based on " \
+ #include "trace.h"
-+               "the value of smp";
-     mc->init = xlnx_zcu102_init;
+ //#define DEBUG_SD 1
-     mc->block_default_type = IF_IDE;
+@@ -XXX,XX +XXX,XX @@ static void sd_set_mode(SDState *sd)
      mc->units_per_default_bus = 1;
 diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zynqmp.c
 +++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(XlnxZynqMPState *s, const char *boot_cpu,
  {
      Error *err = NULL;
      int i;
 +    int num_rpus = MIN(smp_cpus - XLNX_ZYNQMP_NUM_APU_CPUS, XLNX_ZYNQMP_NUM_RPU_CPUS);
 -    for (i = 0; i < XLNX_ZYNQMP_NUM_RPU_CPUS; i++) {
 +    for (i = 0; i < num_rpus; i++) {
          char *name;
          object_initialize(&s->rpu_cpu[i], sizeof(s->rpu_cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(Object *obj)
  {
      XlnxZynqMPState *s = XLNX_ZYNQMP(obj);
      int i;
 +    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
 -    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
 +    for (i = 0; i < num_apus; i++) {
          object_initialize(&s->apu_cpu[i], sizeof(s->apu_cpu[i]),
                            "cortex-a53-" TYPE_ARM_CPU);
          object_property_add_child(obj, "apu-cpu[*]", OBJECT(&s->apu_cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
      MemoryRegion *system_memory = get_system_memory();
      uint8_t i;
      uint64_t ram_size;
 +    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
      const char *boot_cpu = s->boot_cpu ? s->boot_cpu : "apu-cpu[0]";
      ram_addr_t ddr_low_size, ddr_high_size;
      qemu_irq gic_spi[GIC_NUM_SPI_INTR];
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
      qdev_prop_set_uint32(DEVICE(&s->gic), "num-irq", GIC_NUM_SPI_INTR + 32);
      qdev_prop_set_uint32(DEVICE(&s->gic), "revision", 2);
 -    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", XLNX_ZYNQMP_NUM_APU_CPUS);
 +    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", num_apus);
      /* Realize APUs before realizing the GIC. KVM requires this.  */
 -    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
 +    for (i = 0; i < num_apus; i++) {
          char *name;
          object_property_set_int(OBJECT(&s->apu_cpu[i]), QEMU_PSCI_CONDUIT_SMC,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
          }
      }
+ }
--    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
-+    for (i = 0; i < num_apus; i++) {
+-static const sd_cmd_type_t sd_cmd_type[64] = {
-         qemu_irq irq;
++static const sd_cmd_type_t sd_cmd_type[SDMMC_CMD_MAX] = {
+     sd_bc,   sd_none, sd_bcr,  sd_bcr,  sd_none, sd_none, sd_none, sd_ac,
-         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i,
+     sd_bcr,  sd_ac,   sd_ac,   sd_adtc, sd_ac,   sd_ac,   sd_none, sd_ac,
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
++    /* 16 */
      sd_ac,   sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,
      sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac,   sd_ac,   sd_adtc, sd_none,
 +    /* 32 */
      sd_ac,   sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,
      sd_none, sd_none, sd_bc,   sd_none, sd_none, sd_none, sd_none, sd_none,
 +    /* 48 */
      sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,
      sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
  };
 -static const int sd_cmd_class[64] = {
 +static const int sd_cmd_class[SDMMC_CMD_MAX] = {
 ,  0,  0,  0,  0,  9, 10,  0,  0,  0,  0,  1,  0,  0,  0,  0,
 ,  2,  2,  2,  3,  3,  3,  3,  4,  4,  4,  4,  6,  6,  6,  6,
 ,  5, 10, 10, 10, 10,  5,  9,  9,  9,  7,  7,  7,  7,  7,  7,
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
      /* Not interpreting this as an app command */
      sd->card_status &= ~APP_CMD;
 -    if (sd_cmd_type[req.cmd & 0x3F] == sd_ac
 -        || sd_cmd_type[req.cmd & 0x3F] == sd_adtc) {
 +    if (sd_cmd_type[req.cmd] == sd_ac
 +        || sd_cmd_type[req.cmd] == sd_adtc) {
          rca = req.arg >> 16;
      }
-     if (s->has_rpu) {
+@@ -XXX,XX +XXX,XX @@ static int cmd_valid_while_locked(SDState *sd, SDRequest *req)
--        xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
+     if (req->cmd == 16 || req->cmd == 55) {
--        if (err) {
+         return 1;
--            error_propagate(errp, err);
+     }
--            return;
+-    return sd_cmd_class[req->cmd & 0x3F] == 0
--        }
+-            || sd_cmd_class[req->cmd & 0x3F] == 7;
-+        info_report("The 'has_rpu' property is no longer required, to use the "
++    return sd_cmd_class[req->cmd] == 0
-+                    "RPUs just use -smp 6.");
++            || sd_cmd_class[req->cmd] == 7;
  }
  int sd_do_command(SDState *sd, SDRequest *req,
@@ -XXX,XX +XXX,XX @@ int sd_do_command(SDState *sd, SDRequest *req,
          goto send_response;
      }
 +    if (req->cmd >= SDMMC_CMD_MAX) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "SD: incorrect command 0x%02x\n",
 +                      req->cmd);
 +        req->cmd &= 0x3f;
 +    }
 +
-+    xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
+     if (sd->card_status & CARD_IS_LOCKED) {
-+    if (err) {
+         if (!cmd_valid_while_locked(sd, req)) {
-+        error_propagate(errp, err);
+             sd->card_status |= ILLEGAL_COMMAND;
 +        return;
      }
      if (!s->boot_cpu_ptr) {
 --
-.7.4
+.16.1

-New patch
+[Qemu-devel] [PULL 15/32] sdcard: use G_BYTE from cutils
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+code is now easier to read.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215220540.6556-11-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 3 ++-
+file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sd/sd.h"
+ #include "qapi/error.h"
+ #include "qemu/bitmap.h"
++#include "qemu/cutils.h"
+ #include "hw/qdev-properties.h"
+ #include "qemu/error-report.h"
+ #include "qemu/timer.h"
+@@ -XXX,XX +XXX,XX @@ static void sd_set_csd(SDState *sd, uint64_t size)
+     uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
+     uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
+-    if (size <= 0x40000000) {    /* Standard Capacity SD */
++    if (size <= 1 * G_BYTE) { /* Standard Capacity SD */
+         sd->csd[0] = 0x00;    /* CSD structure */
+         sd->csd[1] = 0x26;    /* Data read access-time-1 */
+         sd->csd[2] = 0x00;    /* Data read access-time-2 */
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 16/32] sdcard: use the registerfields API to access the OCR register
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215220540.6556-12-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/sd/sd.h |  1 -
+ hw/sd/sd.c         | 21 +++++++++++++--------
+files changed, 13 insertions(+), 9 deletions(-)
+diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/sd/sd.h
++++ b/include/hw/sd/sd.h
+@@ -XXX,XX +XXX,XX @@
+ #define READY_FOR_DATA        (1 << 8)
+ #define APP_CMD            (1 << 5)
+ #define AKE_SEQ_ERROR        (1 << 3)
+-#define OCR_CCS_BITN        30
+ typedef enum {
+     SD_VOLTAGE_0_4V     = 400,  /* currently not supported */
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "hw/qdev.h"
+ #include "hw/hw.h"
++#include "hw/registerfields.h"
+ #include "sysemu/block-backend.h"
+ #include "hw/sd/sd.h"
+ #include "qapi/error.h"
+@@ -XXX,XX +XXX,XX @@
+ //#define DEBUG_SD 1
+ #define ACMD41_ENQUIRY_MASK     0x00ffffff
+-#define OCR_POWER_UP            0x80000000
+-#define OCR_POWER_DELAY_NS      500000 /* 0.5ms */
+ typedef enum {
+     sd_r0 = 0,    /* no response */
+@@ -XXX,XX +XXX,XX @@ static uint16_t sd_crc16(void *message, size_t width)
+     return shift_reg;
+ }
++#define OCR_POWER_DELAY_NS      500000 /* 0.5ms */
++
++FIELD(OCR, CARD_CAPACITY,              30,  1) /* 0:SDSC, 1:SDHC/SDXC */
++FIELD(OCR, CARD_POWER_UP,              31,  1)
++
+ static void sd_set_ocr(SDState *sd)
+ {
+     /* All voltages OK, Standard Capacity SD Memory Card, not yet powered up */
+@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
+     SDState *sd = opaque;
+     trace_sdcard_powerup();
+-    /* Set powered up bit in OCR */
+-    assert(!(sd->ocr & OCR_POWER_UP));
+-    sd->ocr |= OCR_POWER_UP;
++    assert(!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP));
++
++    /* card power-up OK */
++    sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_POWER_UP, 1);
+ }
+ static void sd_set_scr(SDState *sd)
+@@ -XXX,XX +XXX,XX @@ static bool sd_ocr_vmstate_needed(void *opaque)
+     SDState *sd = opaque;
+     /* Include the OCR state (and timer) if it is not yet powered up */
+-    return !(sd->ocr & OCR_POWER_UP);
++    return !FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP);
+ }
+ static const VMStateDescription sd_ocr_vmstate = {
+@@ -XXX,XX +XXX,XX @@ static void sd_erase(SDState *sd)
+         return;
+     }
+-    if (extract32(sd->ocr, OCR_CCS_BITN, 1)) {
++    if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
+         /* High capacity memory card: erase units are 512 byte blocks */
+         erase_start *= 512;
+         erase_end *= 512;
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
+              * UEFI, which sends an initial enquiry ACMD41, but
+              * assumes that the card is in ready state as soon as it
+              * sees the power up bit set. */
+-            if (!(sd->ocr & OCR_POWER_UP)) {
++            if (!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP)) {
+                 if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
+                     timer_del(sd->ocr_power_timer);
+                     sd_ocr_powerup(sd);
+--
+.16.1

-[Qemu-devel] [PULL 6/9] xlnx-zcu102: Add an info message deprecating the EP108
+[Qemu-devel] [PULL 17/32] sdcard: Don't always set the high capacity bit
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The EP108 was an early access development board that is no longer used.
+Don't set the high capacity bit by default as it will be set if required
-Add an info message to convert any users to the ZCU102 instead. On QEMU
+in the sd_set_csd() function.
 they are both identical.
-This patch also updated the qemu-doc.texi file to indicate that the
+[based on a patch from Alistair Francis <alistair.francis@xilinx.com>
-EP108 has been deprecated.
+ and Peter Ogden <ogden@xilinx.com> from qemu/xilinx tag xilinx-v2015.4]
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Emilio G. Cota <cota@braap.org>
+Message-id: 20180215221325.7611-2-f4bug@amsat.org
 Message-id: 1510343626-25861-4-git-send-email-cota@braap.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-zcu102.c | 3 +++
+ hw/sd/sd.c | 5 ++++-
- qemu-doc.texi        | 7 +++++++
+file changed, 4 insertions(+), 1 deletion(-)
 files changed, 10 insertions(+)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/hw/sd/sd.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
- {
-     XlnxZCU102 *s = EP108_MACHINE(machine);
+     /* card power-up OK */
+     sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_POWER_UP, 1);
 +    info_report("The Xilinx EP108 machine is deprecated, please use the "
 +                "ZCU102 machine instead. It has the same features supported.");
 +
-     xlnx_zynqmp_init(s, machine);
++    if (sd->size > 1 * G_BYTE) {
 +        sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_CAPACITY, 1);
 +    }
  }
-diff --git a/qemu-doc.texi b/qemu-doc.texi
+ static void sd_set_scr(SDState *sd)
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void sd_set_csd(SDState *sd, uint64_t size)
---- a/qemu-doc.texi
+         sd->csd[13] = 0x40;
-+++ b/qemu-doc.texi
+         sd->csd[14] = 0x00;
-@@ -XXX,XX +XXX,XX @@ or ``ivshmem-doorbell`` device types.
+         sd->csd[15] = 0x00;
- The ``spapr-pci-vfio-host-bridge'' device type is replaced by
+-        sd->ocr |= 1 << 30;     /* High Capacity SD Memory Card */
- the ``spapr-pci-host-bridge'' device type.
+     }
+ }
 +@section System emulator machines
 +
 +@subsection Xilinx EP108 (since 2.11.0)
 +
 +The ``xlnx-ep108'' machine has been replaced by the ``xlnx-zcu102'' machine.
 +The ``xlnx-zcu102'' machine has the same features and capabilites in QEMU.
 +
  @node License
  @appendix License
 --
-.7.4
+.16.1

-New patch
+[Qemu-devel] [PULL 18/32] sdcard: update the CSD CRC register regardless the CSD structure version
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215221325.7611-3-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 3 +--
+file changed, 1 insertion(+), 2 deletions(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static void sd_set_csd(SDState *sd, uint64_t size)
+         sd->csd[13] = 0x20 |    /* Max. write data block length */
+             ((HWBLOCK_SHIFT << 6) & 0xc0);
+         sd->csd[14] = 0x00;    /* File format group */
+-        sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
+     } else {            /* SDHC */
+         size /= 512 * 1024;
+         size -= 1;
+@@ -XXX,XX +XXX,XX @@ static void sd_set_csd(SDState *sd, uint64_t size)
+         sd->csd[12] = 0x0a;
+         sd->csd[13] = 0x40;
+         sd->csd[14] = 0x00;
+-        sd->csd[15] = 0x00;
+     }
++    sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
+ }
+ static void sd_set_rca(SDState *sd)
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 19/32] sdcard: fix the 'maximum data transfer rate' to 25MHz
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+To comply with Spec v1.10 (and 2.00, 3.01):
+. TRAN_SPEED
+for current SD Memory Cards that field must be always 0_0110_010b (032h) which is
+equal to 25MHz - the mandatory maximum operating frequency of SD Memory Card.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215221325.7611-4-f4bug@amsat.org
+[PMM: fixed comment indent]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static void sd_set_csd(SDState *sd, uint64_t size)
+         sd->csd[0] = 0x00;    /* CSD structure */
+         sd->csd[1] = 0x26;    /* Data read access-time-1 */
+         sd->csd[2] = 0x00;    /* Data read access-time-2 */
+-        sd->csd[3] = 0x5a;    /* Max. data transfer rate */
++        sd->csd[3] = 0x32;      /* Max. data transfer rate: 25 MHz */
+         sd->csd[4] = 0x5f;    /* Card Command Classes */
+         sd->csd[5] = 0x50 |    /* Max. read data block length */
+             HWBLOCK_SHIFT;
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 20/32] sdcard: clean the SCR register and add few comments
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215221325.7611-5-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 9 ++++++---
+file changed, 6 insertions(+), 3 deletions(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
+ static void sd_set_scr(SDState *sd)
+ {
+-    sd->scr[0] = 0x00;        /* SCR Structure */
+-    sd->scr[1] = 0x2f;        /* SD Security Support */
+-    sd->scr[2] = 0x00;
++    sd->scr[0] = (0 << 4)       /* SCR version 1.0 */
++                 | 0;           /* Spec Versions 1.0 and 1.01 */
++    sd->scr[1] = (2 << 4)       /* SDSC Card (Security Version 1.01) */
++                 | 0b0101;      /* 1-bit or 4-bit width bus modes */
++    sd->scr[2] = 0x00;          /* Extended Security is not supported. */
+     sd->scr[3] = 0x00;
++    /* reserved for manufacturer usage */
+     sd->scr[4] = 0x00;
+     sd->scr[5] = 0x00;
+     sd->scr[6] = 0x00;
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 21/32] sdcard: remove commands from unsupported old MMC specification
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+This device does not model MMCA Specification previous to v4.2
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215221325.7611-6-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 33 ---------------------------------
+file changed, 33 deletions(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+         }
+         break;
+-    case 11:    /* CMD11:  READ_DAT_UNTIL_STOP */
+-        if (sd->spi)
+-            goto bad_cmd;
+-        switch (sd->state) {
+-        case sd_transfer_state:
+-            sd->state = sd_sendingdata_state;
+-            sd->data_start = req.arg;
+-            sd->data_offset = 0;
+-
+-            if (sd->data_start + sd->blk_len > sd->size)
+-                sd->card_status |= ADDRESS_ERROR;
+-            return sd_r0;
+-
+-        default:
+-            break;
+-        }
+-        break;
+-
+     case 12:    /* CMD12:  STOP_TRANSMISSION */
+         switch (sd->state) {
+         case sd_sendingdata_state:
+@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
+             sd->state = sd_transfer_state;
+         break;
+-    case 11:    /* CMD11:  READ_DAT_UNTIL_STOP */
+-        if (sd->data_offset == 0)
+-            BLK_READ_BLOCK(sd->data_start, io_len);
+-        ret = sd->data[sd->data_offset ++];
+-
+-        if (sd->data_offset >= io_len) {
+-            sd->data_start += io_len;
+-            sd->data_offset = 0;
+-            if (sd->data_start + io_len > sd->size) {
+-                sd->card_status |= ADDRESS_ERROR;
+-                break;
+-            }
+-        }
+-        break;
+-
+     case 13:    /* ACMD13: SD_STATUS */
+         ret = sd->sd_status[sd->data_offset ++];
+--
+.16.1

-[Qemu-devel] [PULL 9/9] accel/tcg/translate-all: expand cpu_restore_state addr check
+[Qemu-devel] [PULL 22/32] sdcard: simplify using the ldst API
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-We are still seeing signals during translation time when we walk over
+the code is easier to review/refactor.
 a page protection boundary. This expands the check to ensure the host
 PC is inside the code generation buffer. The original suggestion was
 to check versus tcg_ctx.code_gen_ptr but as we now segment the
 translation buffer we have to settle for just a general check for
 being inside.
-I've also fixed up the declaration to make it clear it can deal with
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-invalid addresses. A later patch will fix up the call sites.
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215221325.7611-7-f4bug@amsat.org
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reported-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Laurent Vivier <laurent@vivier.eu>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20171108153245.20740-2-alex.bennee@linaro.org
 Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
 Cc: Richard Henderson <rth@twiddle.net>
 Tested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/exec/exec-all.h   | 11 ++++++++++
+ hw/sd/sd.c | 38 +++++++++-----------------------------
- accel/tcg/translate-all.c | 52 ++++++++++++++++++++++++++---------------------
+file changed, 9 insertions(+), 29 deletions(-)
 files changed, 40 insertions(+), 23 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/hw/sd/sd.c
-+++ b/include/exec/exec-all.h
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
+@@ -XXX,XX +XXX,XX @@ static int sd_req_crc_validate(SDRequest *req)
-                           target_ulong *data);
+ {
+     uint8_t buffer[5];
- void cpu_gen_init(void);
+     buffer[0] = 0x40 | req->cmd;
 -    buffer[1] = (req->arg >> 24) & 0xff;
 -    buffer[2] = (req->arg >> 16) & 0xff;
 -    buffer[3] = (req->arg >> 8) & 0xff;
 -    buffer[4] = (req->arg >> 0) & 0xff;
 +    stl_be_p(&buffer[1], req->arg);
      return 0;
      return sd_crc7(buffer, 5) != req->crc;    /* TODO */
  }
  static void sd_response_r1_make(SDState *sd, uint8_t *response)
  {
 -    uint32_t status = sd->card_status;
 +    stl_be_p(response, sd->card_status);
 +
-+/**
+     /* Clear the "clear on read" status bits */
-+ * cpu_restore_state:
+     sd->card_status &= ~CARD_STATUS_C;
-+ * @cpu: the vCPU state is to be restore to
+-
-+ * @searched_pc: the host PC the fault occurred at
+-    response[0] = (status >> 24) & 0xff;
-+ * @return: true if state was restored, false otherwise
+-    response[1] = (status >> 16) & 0xff;
-+ *
+-    response[2] = (status >> 8) & 0xff;
-+ * Attempt to restore the state for a fault occurring in translated
+-    response[3] = (status >> 0) & 0xff;
 + * code. If the searched_pc is not in translated code no state is
 + * restored and the function returns false.
 + */
  bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc);
  void QEMU_NORETURN cpu_loop_exit_noexc(CPUState *cpu);
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
      return 0;
  }
--bool cpu_restore_state(CPUState *cpu, uintptr_t retaddr)
+ static void sd_response_r3_make(SDState *sd, uint8_t *response)
 +bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
  {
-     TranslationBlock *tb;
+-    response[0] = (sd->ocr >> 24) & 0xff;
-     bool r = false;
+-    response[1] = (sd->ocr >> 16) & 0xff;
-+    uintptr_t check_offset;
+-    response[2] = (sd->ocr >> 8) & 0xff;
+-    response[3] = (sd->ocr >> 0) & 0xff;
--    /* A retaddr of zero is invalid so we really shouldn't have ended
++    stl_be_p(response, sd->ocr);
--     * up here. The target code has likely forgotten to check retaddr
+ }
--     * != 0 before attempting to restore state. We return early to
--     * avoid blowing up on a recursive tb_lock(). The target must have
+ static void sd_response_r6_make(SDState *sd, uint8_t *response)
--     * previously survived a failed cpu_restore_state because
+ {
--     * tb_find_pc(0) would have failed anyway. It still should be
+-    uint16_t arg;
--     * fixed though.
+     uint16_t status;
-+    /* The host_pc has to be in the region of current code buffer. If
-+     * it is not we will not be able to resolve it here. The two cases
+-    arg = sd->rca;
-+     * where host_pc will not be correct are:
+     status = ((sd->card_status >> 8) & 0xc000) |
-+     *
+              ((sd->card_status >> 6) & 0x2000) |
-+     *  - fault during translation (instruction fetch)
+               (sd->card_status & 0x1fff);
-+     *  - fault from helper (not using GETPC() macro)
+     sd->card_status &= ~(CARD_STATUS_C & 0xc81fff);
 +     *
 +     * Either way we need return early to avoid blowing up on a
 +     * recursive tb_lock() as we can't resolve it here.
 +     *
 +     * We are using unsigned arithmetic so if host_pc <
 +     * tcg_init_ctx.code_gen_buffer check_offset will wrap to way
 +     * above the code_gen_buffer_size
       */
 -
--    if (!retaddr) {
+-    response[0] = (arg >> 8) & 0xff;
--        return r;
+-    response[1] = arg & 0xff;
--    }
+-    response[2] = (status >> 8) & 0xff;
--
+-    response[3] = status & 0xff;
--    tb_lock();
++    stw_be_p(response + 0, sd->rca);
--    tb = tb_find_pc(retaddr);
++    stw_be_p(response + 2, status);
--    if (tb) {
+ }
--        cpu_restore_state_from_tb(cpu, tb, retaddr);
--        if (tb->cflags & CF_NOCACHE) {
+ static void sd_response_r7_make(SDState *sd, uint8_t *response)
--            /* one-shot translation, invalidate it immediately */
+ {
--            tb_phys_invalidate(tb, -1);
+-    response[0] = (sd->vhs >> 24) & 0xff;
--            tb_remove(tb);
+-    response[1] = (sd->vhs >> 16) & 0xff;
-+    check_offset = host_pc - (uintptr_t) tcg_init_ctx.code_gen_buffer;
+-    response[2] = (sd->vhs >>  8) & 0xff;
-+
+-    response[3] = (sd->vhs >>  0) & 0xff;
-+    if (check_offset < tcg_init_ctx.code_gen_buffer_size) {
++    stl_be_p(response, sd->vhs);
-+        tb_lock();
+ }
-+        tb = tb_find_pc(host_pc);
-+        if (tb) {
+ static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
-+            cpu_restore_state_from_tb(cpu, tb, host_pc);
+@@ -XXX,XX +XXX,XX @@ static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
-+            if (tb->cflags & CF_NOCACHE) {
-+                /* one-shot translation, invalidate it immediately */
+ static void sd_function_switch(SDState *sd, uint32_t arg)
-+                tb_phys_invalidate(tb, -1);
+ {
-+                tb_remove(tb);
+-    int i, mode, new_func, crc;
-+            }
++    int i, mode, new_func;
-+            r = true;
+     mode = !!(arg & 0x80000000);
-         }
--        r = true;
+     sd->data[0] = 0x00;        /* Maximum current consumption */
-+        tb_unlock();
+@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
          sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
      }
--    tb_unlock();
+     memset(&sd->data[17], 0, 47);
+-    crc = sd_crc16(sd->data, 64);
-     return r;
+-    sd->data[65] = crc >> 8;
 -    sd->data[66] = crc & 0xff;
 +    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
  }
+ static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
 --
-.7.4
+.16.1

-[Qemu-devel] [PULL 7/9] xlnx-zcu102: Specify the max number of CPUs for the EP108
+[Qemu-devel] [PULL 23/32] sdcard: use the correct masked OCR in the R3 reply
-From: "Emilio G. Cota" <cota@braap.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Just like the zcu102, the ep108 can instantiate several CPUs.
+use the registerfields API to access the OCR register
-Signed-off-by: Emilio G. Cota <cota@braap.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1510343626-25861-5-git-send-email-cota@braap.org
+Message-id: 20180215221325.7611-8-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-zcu102.c | 1 +
+ hw/sd/sd.c | 21 ++++++++++++++++-----
-file changed, 1 insertion(+)
+file changed, 16 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/hw/sd/sd.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@
-     mc->block_default_type = IF_IDE;
-     mc->units_per_default_bus = 1;
+ //#define DEBUG_SD 1
-     mc->ignore_memory_transaction_failures = true;
-+    mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
+-#define ACMD41_ENQUIRY_MASK     0x00ffffff
 -
  typedef enum {
      sd_r0 = 0,    /* no response */
      sd_r1,        /* normal response command */
@@ -XXX,XX +XXX,XX @@ static uint16_t sd_crc16(void *message, size_t width)
  #define OCR_POWER_DELAY_NS      500000 /* 0.5ms */
 +FIELD(OCR, VDD_VOLTAGE_WINDOW,          0, 24)
 +FIELD(OCR, VDD_VOLTAGE_WIN_LO,          0,  8)
 +FIELD(OCR, DUAL_VOLTAGE_CARD,           7,  1)
 +FIELD(OCR, VDD_VOLTAGE_WIN_HI,          8, 16)
 +FIELD(OCR, ACCEPT_SWITCH_1V8,          24,  1) /* Only UHS-I */
 +FIELD(OCR, UHS_II_CARD,                29,  1) /* Only UHS-II */
  FIELD(OCR, CARD_CAPACITY,              30,  1) /* 0:SDSC, 1:SDHC/SDXC */
  FIELD(OCR, CARD_POWER_UP,              31,  1)
 +#define ACMD41_ENQUIRY_MASK     0x00ffffff
 +#define ACMD41_R3_MASK          (R_OCR_VDD_VOLTAGE_WIN_HI_MASK \
 +                               | R_OCR_ACCEPT_SWITCH_1V8_MASK \
 +                               | R_OCR_UHS_II_CARD_MASK \
 +                               | R_OCR_CARD_CAPACITY_MASK \
 +                               | R_OCR_CARD_POWER_UP_MASK)
 +
  static void sd_set_ocr(SDState *sd)
  {
 -    /* All voltages OK, Standard Capacity SD Memory Card, not yet powered up */
 -    sd->ocr = 0x00ffff00;
 +    /* All voltages OK */
 +    sd->ocr = R_OCR_VDD_VOLTAGE_WIN_HI_MASK;
  }
- static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
+ static void sd_ocr_powerup(void *opaque)
@@ -XXX,XX +XXX,XX @@ static void sd_response_r1_make(SDState *sd, uint8_t *response)
  static void sd_response_r3_make(SDState *sd, uint8_t *response)
  {
 -    stl_be_p(response, sd->ocr);
 +    stl_be_p(response, sd->ocr & ACMD41_R3_MASK);
  }
  static void sd_response_r6_make(SDState *sd, uint8_t *response)
 --
-.7.4
+.16.1

-[Qemu-devel] [PULL 2/9] highbank: validate register offset before access
+[Qemu-devel] [PULL 24/32] sdcard: use the registerfields API for the CARD_STATUS register masks
-From: Prasad J Pandit <pjp@fedoraproject.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-An 'offset' parameter sent to highbank register r/w functions
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-could be greater than number(NUM_REGS=0x200) of hb registers,
+Acked-by: Alistair Francis <alistair.francis@xilinx.com>
-leading to an OOB access issue. Add check to avoid it.
+Message-id: 20180215221325.7611-9-f4bug@amsat.org
 Reported-by: Moguofang (Dennis mo) <moguofang@huawei.com>
 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
 Message-id: 20171113062658.9697-1-ppandit@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/highbank.c | 17 +++++++++++++++--
+ hw/sd/sd.c | 48 +++++++++++++++++++++++++++++++++++++++++++++---
-file changed, 15 insertions(+), 2 deletions(-)
+file changed, 45 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/highbank.c
+--- a/hw/sd/sd.c
-+++ b/hw/arm/highbank.c
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void sd_set_rca(SDState *sd)
- #include "hw/ide/ahci.h"
+     sd->rca += 0x4567;
  #include "hw/cpu/a9mpcore.h"
  #include "hw/cpu/a15mpcore.h"
 +#include "qemu/log.h"
  #define SMP_BOOT_ADDR           0x100
  #define SMP_BOOT_REG            0x40
@@ -XXX,XX +XXX,XX @@ static void hb_regs_write(void *opaque, hwaddr offset,
          }
      }
 -    regs[offset/4] = value;
 +    if (offset / 4 >= NUM_REGS) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                  "highbank: bad write offset 0x%" HWADDR_PRIx "\n", offset);
 +        return;
 +    }
 +    regs[offset / 4] = value;
  }
- static uint64_t hb_regs_read(void *opaque, hwaddr offset,
++FIELD(CSR, AKE_SEQ_ERROR,               3,  1)
-                              unsigned size)
++FIELD(CSR, APP_CMD,                     5,  1)
 +FIELD(CSR, FX_EVENT,                    6,  1)
 +FIELD(CSR, READY_FOR_DATA,              8,  1)
 +FIELD(CSR, CURRENT_STATE,               9,  4)
 +FIELD(CSR, ERASE_RESET,                13,  1)
 +FIELD(CSR, CARD_ECC_DISABLED,          14,  1)
 +FIELD(CSR, WP_ERASE_SKIP,              15,  1)
 +FIELD(CSR, CSD_OVERWRITE,              16,  1)
 +FIELD(CSR, DEFERRED_RESPONSE,          17,  1)
 +FIELD(CSR, ERROR,                      19,  1)
 +FIELD(CSR, CC_ERROR,                   20,  1)
 +FIELD(CSR, CARD_ECC_FAILED,            21,  1)
 +FIELD(CSR, ILLEGAL_COMMAND,            22,  1)
 +FIELD(CSR, COM_CRC_ERROR,              23,  1)
 +FIELD(CSR, LOCK_UNLOCK_FAILED,         24,  1)
 +FIELD(CSR, CARD_IS_LOCKED,             25,  1)
 +FIELD(CSR, WP_VIOLATION,               26,  1)
 +FIELD(CSR, ERASE_PARAM,                27,  1)
 +FIELD(CSR, ERASE_SEQ_ERROR,            28,  1)
 +FIELD(CSR, BLOCK_LEN_ERROR,            29,  1)
 +FIELD(CSR, ADDRESS_ERROR,              30,  1)
 +FIELD(CSR, OUT_OF_RANGE,               31,  1)
 +
  /* Card status bits, split by clear condition:
   * A : According to the card current state
   * B : Always related to the previous command
   * C : Cleared by read
   */
 -#define CARD_STATUS_A    0x02004100
 -#define CARD_STATUS_B    0x00c01e00
 -#define CARD_STATUS_C    0xfd39a028
 +#define CARD_STATUS_A           (R_CSR_READY_FOR_DATA_MASK \
 +                               | R_CSR_CARD_ECC_DISABLED_MASK \
 +                               | R_CSR_CARD_IS_LOCKED_MASK)
 +#define CARD_STATUS_B           (R_CSR_CURRENT_STATE_MASK \
 +                               | R_CSR_ILLEGAL_COMMAND_MASK \
 +                               | R_CSR_COM_CRC_ERROR_MASK)
 +#define CARD_STATUS_C           (R_CSR_AKE_SEQ_ERROR_MASK \
 +                               | R_CSR_APP_CMD_MASK \
 +                               | R_CSR_ERASE_RESET_MASK \
 +                               | R_CSR_WP_ERASE_SKIP_MASK \
 +                               | R_CSR_CSD_OVERWRITE_MASK \
 +                               | R_CSR_ERROR_MASK \
 +                               | R_CSR_CC_ERROR_MASK \
 +                               | R_CSR_CARD_ECC_FAILED_MASK \
 +                               | R_CSR_LOCK_UNLOCK_FAILED_MASK \
 +                               | R_CSR_WP_VIOLATION_MASK \
 +                               | R_CSR_ERASE_PARAM_MASK \
 +                               | R_CSR_ERASE_SEQ_ERROR_MASK \
 +                               | R_CSR_BLOCK_LEN_ERROR_MASK \
 +                               | R_CSR_ADDRESS_ERROR_MASK \
 +                               | R_CSR_OUT_OF_RANGE_MASK)
  static void sd_set_cardstatus(SDState *sd)
  {
-+    uint32_t value;
-     uint32_t *regs = opaque;
--    uint32_t value = regs[offset/4];
-+
-+    if (offset / 4 >= NUM_REGS) {
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                  "highbank: bad read offset 0x%" HWADDR_PRIx "\n", offset);
-+        return 0;
-+    }
-+    value = regs[offset / 4];
-     if ((offset == 0x100) || (offset == 0x108) || (offset == 0x10C)) {
-         value |= 0x30000000;
 --
-.7.4
+.16.1

-New patch
+[Qemu-devel] [PULL 25/32] sdcard: handle CMD54 (SDIO)
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Linux uses it to poll the bus before polling for a card.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215221325.7611-10-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 5 ++---
+file changed, 2 insertions(+), 3 deletions(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+         }
+         break;
+-    case 52:
+-    case 53:
+-        /* CMD52, CMD53: reserved for SDIO cards
++    case 52 ... 54:
++        /* CMD52, CMD53, CMD54: reserved for SDIO cards
+          * (see the SDIO Simplified Specification V2.0)
+          * Handle as illegal command but do not complain
+          * on stderr, as some OSes may use these in their
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 26/32] sdcard: handle the Security Specification commands
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+returning sd_illegal, since they are not implemented.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215221325.7611-11-f4bug@amsat.org
+[PMM: tweak multiline comment format]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 12 ++++++++++++
+file changed, 12 insertions(+)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
+         }
+         break;
++    case 18:    /* Reserved for SD security applications */
++    case 25:
++    case 26:
++    case 38:
++    case 43 ... 49:
++        /* Refer to the "SD Specifications Part3 Security Specification" for
++         * information about the SD Security Features.
++         */
++        qemu_log_mask(LOG_UNIMP, "SD: CMD%i Security not implemented\n",
++                      req.cmd);
++        return sd_illegal;
++
+     default:
+         /* Fall back to standard commands.  */
+         return sd_normal_command(sd, req);
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 27/32] sdcard: use a more descriptive label 'unimplemented_spi_cmd'
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Suggested-by: Alistair Francis <alistair.francis@xilinx.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215221325.7611-12-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 22 +++++++++++++---------
+file changed, 13 insertions(+), 9 deletions(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+     /* Block write commands (Class 4) */
+     case 24:    /* CMD24:  WRITE_SINGLE_BLOCK */
+-        if (sd->spi)
+-            goto unimplemented_cmd;
++        if (sd->spi) {
++            goto unimplemented_spi_cmd;
++        }
+         switch (sd->state) {
+         case sd_transfer_state:
+             /* Writing in SPI mode not implemented.  */
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+         break;
+     case 25:    /* CMD25:  WRITE_MULTIPLE_BLOCK */
+-        if (sd->spi)
+-            goto unimplemented_cmd;
++        if (sd->spi) {
++            goto unimplemented_spi_cmd;
++        }
+         switch (sd->state) {
+         case sd_transfer_state:
+             /* Writing in SPI mode not implemented.  */
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+         break;
+     case 27:    /* CMD27:  PROGRAM_CSD */
+-        if (sd->spi)
+-            goto unimplemented_cmd;
++        if (sd->spi) {
++            goto unimplemented_spi_cmd;
++        }
+         switch (sd->state) {
+         case sd_transfer_state:
+             sd->state = sd_receivingdata_state;
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+     /* Lock card commands (Class 7) */
+     case 42:    /* CMD42:  LOCK_UNLOCK */
+-        if (sd->spi)
+-            goto unimplemented_cmd;
++        if (sd->spi) {
++            goto unimplemented_spi_cmd;
++        }
+         switch (sd->state) {
+         case sd_transfer_state:
+             sd->state = sd_receivingdata_state;
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+         qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
+         return sd_illegal;
+-    unimplemented_cmd:
++    unimplemented_spi_cmd:
+         /* Commands that are recognised but not yet implemented in SPI mode.  */
+         qemu_log_mask(LOG_UNIMP, "SD: CMD%i not implemented in SPI mode\n",
+                       req.cmd);
+--
+.16.1

-[Qemu-devel] [PULL 4/9] qom: move CPUClass.tcg_initialize to a global
+[Qemu-devel] [PULL 28/32] sdcard: handles more commands in SPI mode
-From: "Emilio G. Cota" <cota@braap.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-c3cee ("qom: Introduce CPUClass.tcg_initialize", 2017-10-24)
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 introduces a per-CPUClass bool that we check so that the target CPU
 is initialized for TCG only once. This works well except when
 we end up creating more than one CPUClass, in which case we end
 up incorrectly initializing TCG more than once, i.e. once for
 each CPUClass.
 This can be replicated with:
   $ aarch64-softmmu/qemu-system-aarch64 -machine xlnx-zcu102 -smp 6 \
       -global driver=xlnx,,zynqmp,property=has_rpu,value=on
 In this case the class name of the "RPUs" is prefixed by "cortex-r5-",
 whereas the "regular" CPUs are prefixed by "cortex-a53-". This
 results in two CPUClass instances being created.
 Fix it by introducing a static variable, so that only the first
 target CPU being initialized will initialize the target-dependent
 part of TCG, regardless of CPUClass instances.
 Fixes: 55c3ceef61fcf06fc98ddc752b7cce788ce7680b
 Signed-off-by: Emilio G. Cota <cota@braap.org>
 Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180215221325.7611-13-f4bug@amsat.org
 Tested-by: Alistair Francis <alistair.francis@xilinx.com>
 Message-id: 1510343626-25861-2-git-send-email-cota@braap.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/qom/cpu.h | 1 -
+ hw/sd/sd.c | 29 ++++++++++++++++++++++++++---
- exec.c            | 5 +++--
+file changed, 26 insertions(+), 3 deletions(-)
 files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/include/qom/cpu.h b/include/qom/cpu.h
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qom/cpu.h
+--- a/hw/sd/sd.c
-+++ b/include/qom/cpu.h
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUClass {
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
-     /* Keep non-pointer data at the end to minimize holes.  */
-     int gdb_num_core_regs;
+     /* Application specific commands (Class 8) */
-     bool gdb_stop_before_watchpoint;
+     case 55:    /* CMD55:  APP_CMD */
--    bool tcg_initialized;
+-        if (sd->rca != rca)
- } CPUClass;
+-            return sd_r0;
+-
- #ifdef HOST_WORDS_BIGENDIAN
++        if (!sd->spi) {
-diff --git a/exec.c b/exec.c
++            if (sd->rca != rca) {
-index XXXXXXX..XXXXXXX 100644
++                return sd_r0;
---- a/exec.c
++            }
-+++ b/exec.c
++        }
-@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
+         sd->expecting_acmd = true;
- void cpu_exec_realizefn(CPUState *cpu, Error **errp)
+         sd->card_status |= APP_CMD;
- {
+         return sd_r1;
-     CPUClass *cc = CPU_GET_CLASS(cpu);
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
-+    static bool tcg_target_initialized;
+         }
+         break;
-     cpu_list_add(cpu);
++    case 58:    /* CMD58:   READ_OCR (SPI) */
--    if (tcg_enabled() && !cc->tcg_initialized) {
++        if (!sd->spi) {
--        cc->tcg_initialized = true;
++            goto bad_cmd;
-+    if (tcg_enabled() && !tcg_target_initialized) {
++        }
-+        tcg_target_initialized = true;
++        return sd_r3;
-         cc->tcg_initialize();
++
 +    case 59:    /* CMD59:   CRC_ON_OFF (SPI) */
 +        if (!sd->spi) {
 +            goto bad_cmd;
 +        }
 +        goto unimplemented_spi_cmd;
 +
      default:
      bad_cmd:
          qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
      sd->card_status |= APP_CMD;
      switch (req.cmd) {
      case 6:    /* ACMD6:  SET_BUS_WIDTH */
 +        if (sd->spi) {
 +            goto unimplemented_spi_cmd;
 +        }
          switch (sd->state) {
          case sd_transfer_state:
              sd->sd_status[0] &= 0x3f;
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
      default:
          /* Fall back to standard commands.  */
          return sd_normal_command(sd, req);
 +
 +    unimplemented_spi_cmd:
 +        /* Commands that are recognised but not yet implemented in SPI mode.  */
 +        qemu_log_mask(LOG_UNIMP, "SD: CMD%i not implemented in SPI mode\n",
 +                      req.cmd);
 +        return sd_illegal;
      }
+     qemu_log_mask(LOG_GUEST_ERROR, "SD: ACMD%i in a wrong state\n", req.cmd);
 --
-.7.4
+.16.1

-New patch
+[Qemu-devel] [PULL 29/32] sdcard: check the card is in correct state for APP CMD (CMD55)
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215221325.7611-14-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 8 ++++++++
+file changed, 8 insertions(+)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+     /* Application specific commands (Class 8) */
+     case 55:    /* CMD55:  APP_CMD */
++        switch (sd->state) {
++        case sd_ready_state:
++        case sd_identification_state:
++        case sd_inactive_state:
++            return sd_illegal;
++        default:
++            break;
++        }
+         if (!sd->spi) {
+             if (sd->rca != rca) {
+                 return sd_r0;
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 30/32] sdcard: warn if host uses an incorrect address for APP CMD (CMD55)
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215221325.7611-15-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 5 +++++
+file changed, 5 insertions(+)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+         case sd_identification_state:
+         case sd_inactive_state:
+             return sd_illegal;
++        case sd_idle_state:
++            if (rca) {
++                qemu_log_mask(LOG_GUEST_ERROR,
++                              "SD: illegal RCA 0x%04x for APP_CMD\n", req.cmd);
++            }
+         default:
+             break;
+         }
+--
+.16.1

-New patch
+[Qemu-devel] [PULL 31/32] sdcard: simplify SEND_IF_COND (CMD8)
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+replace switch(single case) -> if()
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180215221325.7611-16-f4bug@amsat.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 26 +++++++++++---------------
+file changed, 11 insertions(+), 15 deletions(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
+     case 8:    /* CMD8:   SEND_IF_COND */
+         /* Physical Layer Specification Version 2.00 command */
+-        switch (sd->state) {
+-        case sd_idle_state:
+-            sd->vhs = 0;
+-
+-            /* No response if not exactly one VHS bit is set.  */
+-            if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
+-                return sd->spi ? sd_r7 : sd_r0;
+-            }
+-
+-            /* Accept.  */
+-            sd->vhs = req.arg;
+-            return sd_r7;
+-
+-        default:
++        if (sd->state != sd_idle_state) {
+             break;
+         }
+-        break;
++        sd->vhs = 0;
++
++        /* No response if not exactly one VHS bit is set.  */
++        if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
++            return sd->spi ? sd_r7 : sd_r0;
++        }
++
++        /* Accept.  */
++        sd->vhs = req.arg;
++        return sd_r7;
+     case 9:    /* CMD9:   SEND_CSD */
+         switch (sd->state) {
+--
+.16.1

-[Qemu-devel] [PULL 3/9] MAINTAINERS: Add entries for Smartfusion2
+[Qemu-devel] [PULL 32/32] sdcard: simplify SD_SEND_OP_COND (ACMD41)
-From: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Voluntarily add myself as maintainer for Smartfusion2
+replace switch(single case) -> if()
-Signed-off-by: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20180215221325.7611-17-f4bug@amsat.org
 Message-id: 1510552520-3566-1-git-send-email-sundeep.lkml@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS | 17 +++++++++++++++++
+ hw/sd/sd.c | 56 ++++++++++++++++++++++++++------------------------------
-file changed, 17 insertions(+)
+file changed, 26 insertions(+), 30 deletions(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/sd/sd.c
-+++ b/MAINTAINERS
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ M: Alistair Francis <alistair@alistair23.me>
+@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
- S: Maintained
+             sd->state = sd_transfer_state;
- F: hw/arm/netduino2.c
+             return sd_r1;
+         }
-+SmartFusion2
+-        switch (sd->state) {
-+M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+-        case sd_idle_state:
-+S: Maintained
+-            /* If it's the first ACMD41 since reset, we need to decide
-+F: hw/arm/msf2-soc.c
+-             * whether to power up. If this is not an enquiry ACMD41,
-+F: hw/misc/msf2-sysreg.c
+-             * we immediately report power on and proceed below to the
-+F: hw/timer/mss-timer.c
+-             * ready state, but if it is, we set a timer to model a
-+F: hw/ssi/mss-spi.c
+-             * delay for power up. This works around a bug in EDK2
-+F: include/hw/arm/msf2-soc.h
+-             * UEFI, which sends an initial enquiry ACMD41, but
-+F: include/hw/misc/msf2-sysreg.h
+-             * assumes that the card is in ready state as soon as it
-+F: include/hw/timer/mss-timer.h
+-             * sees the power up bit set. */
-+F: include/hw/ssi/mss-spi.h
+-            if (!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP)) {
 -                if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
 -                    timer_del(sd->ocr_power_timer);
 -                    sd_ocr_powerup(sd);
 -                } else {
 -                    trace_sdcard_inquiry_cmd41();
 -                    if (!timer_pending(sd->ocr_power_timer)) {
 -                        timer_mod_ns(sd->ocr_power_timer,
 -                                     (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
 -                                      + OCR_POWER_DELAY_NS));
 -                    }
 +        if (sd->state != sd_idle_state) {
 +            break;
 +        }
 +        /* If it's the first ACMD41 since reset, we need to decide
 +         * whether to power up. If this is not an enquiry ACMD41,
 +         * we immediately report power on and proceed below to the
 +         * ready state, but if it is, we set a timer to model a
 +         * delay for power up. This works around a bug in EDK2
 +         * UEFI, which sends an initial enquiry ACMD41, but
 +         * assumes that the card is in ready state as soon as it
 +         * sees the power up bit set. */
 +        if (!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP)) {
 +            if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
 +                timer_del(sd->ocr_power_timer);
 +                sd_ocr_powerup(sd);
 +            } else {
 +                trace_sdcard_inquiry_cmd41();
 +                if (!timer_pending(sd->ocr_power_timer)) {
 +                    timer_mod_ns(sd->ocr_power_timer,
 +                                 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
 +                                  + OCR_POWER_DELAY_NS));
                  }
              }
 +        }
 +        if (FIELD_EX32(sd->ocr & req.arg, OCR, VDD_VOLTAGE_WINDOW)) {
              /* We accept any voltage.  10000 V is nothing.
               *
               * Once we're powered up, we advance straight to ready state
               * unless it's an enquiry ACMD41 (bits 23:0 == 0).
               */
 -            if (req.arg & ACMD41_ENQUIRY_MASK) {
 -                sd->state = sd_ready_state;
 -            }
 -
 -            return sd_r3;
 -
 -        default:
 -            break;
 +            sd->state = sd_ready_state;
          }
 -        break;
 +
-+Emcraft M2S-FG484
++        return sd_r3;
-+M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
-+S: Maintained
+     case 42:    /* ACMD42: SET_CLR_CARD_DETECT */
-+F: hw/arm/msf2-som.c
+         switch (sd->state) {
 +
  CRIS Machines
  -------------
  Axis Dev88
 --
-.7.4
+.16.1

ARM bugfixes for rc1...

The following changes since commit f291910db61b5812e68f1e76afb3ade41d567bea:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-11-09' into staging (2017-11-13 13:13:12 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171113

for you to fetch changes up to d25f2a72272b9ffe0d06710d6217d1169bc2cc7d:

accel/tcg/translate-all: expand cpu_restore_state addr check (2017-11-13 13:55:27 +0000)

----------------------------------------------------------------
target-arm queue:
 * translate-a64.c: silence gcc5 warning
 * highbank: validate register offset before access
 * MAINTAINERS: Add entries for Smartfusion2
 * accel/tcg/translate-all: expand cpu_restore_state addr check
   (so usermode insn aborts don't crash with an assertion failure)
 * fix TCG initialization of some Arm boards by allowing them
   to specify min/default number of CPUs to create

----------------------------------------------------------------
Alex Bennée (1):
      accel/tcg/translate-all: expand cpu_restore_state addr check

Alistair Francis (2):
      xlnx-zynqmp: Properly support the smp command line option
      xlnx-zcu102: Add an info message deprecating the EP108

Emilio G. Cota (4):
      arm/translate-a64: mark path as unreachable to eliminate warning
      qom: move CPUClass.tcg_initialize to a global
      xlnx-zcu102: Specify the max number of CPUs for the EP108
      hw: add .min_cpus and .default_cpus fields to machine_class

Prasad J Pandit (1):
      highbank: validate register offset before access

Subbaraya Sundeep (1):
      MAINTAINERS: Add entries for Smartfusion2

From: "Emilio G. Cota" <cota@braap.org>

Fixes the following warning when compiling with gcc 5.4.0 with -O1
optimizations and --enable-debug:

target/arm/translate-a64.c: In function ‘aarch64_tr_translate_insn’:
target/arm/translate-a64.c:2361:8: error: ‘post_index’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
     if (!post_index) {
        ^
target/arm/translate-a64.c:2307:10: note: ‘post_index’ was declared here
     bool post_index;
          ^
target/arm/translate-a64.c:2386:8: error: ‘writeback’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
     if (writeback) {
        ^
target/arm/translate-a64.c:2308:10: note: ‘writeback’ was declared here
     bool writeback;
          ^

Note that idx comes from selecting 2 bits, and therefore its value
can be at most 3.

Signed-off-by: Emilio G. Cota <cota@braap.org>
Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1510087611-1851-1-git-send-email-cota@braap.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
         post_index = false;
         writeback = true;
         break;
+    default:
+        g_assert_not_reached();
     }
 
     if (rn == 31) {
-- 
2.7.4

From: Prasad J Pandit <pjp@fedoraproject.org>

An 'offset' parameter sent to highbank register r/w functions
could be greater than number(NUM_REGS=0x200) of hb registers,
leading to an OOB access issue. Add check to avoid it.

Reported-by: Moguofang (Dennis mo) <moguofang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20171113062658.9697-1-ppandit@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/highbank.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/ide/ahci.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/cpu/a15mpcore.h"
+#include "qemu/log.h"
 
 #define SMP_BOOT_ADDR           0x100
 #define SMP_BOOT_REG            0x40
@@ -XXX,XX +XXX,XX @@ static void hb_regs_write(void *opaque, hwaddr offset,
         }
     }
 
-    regs[offset/4] = value;
+    if (offset / 4 >= NUM_REGS) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                  "highbank: bad write offset 0x%" HWADDR_PRIx "\n", offset);
+        return;
+    }
+    regs[offset / 4] = value;
 }
 
 static uint64_t hb_regs_read(void *opaque, hwaddr offset,
                              unsigned size)
 {
+    uint32_t value;
     uint32_t *regs = opaque;
-    uint32_t value = regs[offset/4];
+
+    if (offset / 4 >= NUM_REGS) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                  "highbank: bad read offset 0x%" HWADDR_PRIx "\n", offset);
+        return 0;
+    }
+    value = regs[offset / 4];
 
     if ((offset == 0x100) || (offset == 0x108) || (offset == 0x10C)) {
         value |= 0x30000000;
-- 
2.7.4

From: Subbaraya Sundeep <sundeep.lkml@gmail.com>

Voluntarily add myself as maintainer for Smartfusion2

Signed-off-by: Subbaraya Sundeep <sundeep.lkml@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1510552520-3566-1-git-send-email-sundeep.lkml@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Alistair Francis <alistair@alistair23.me>
 S: Maintained
 F: hw/arm/netduino2.c
 
+SmartFusion2
+M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+S: Maintained
+F: hw/arm/msf2-soc.c
+F: hw/misc/msf2-sysreg.c
+F: hw/timer/mss-timer.c
+F: hw/ssi/mss-spi.c
+F: include/hw/arm/msf2-soc.h
+F: include/hw/misc/msf2-sysreg.h
+F: include/hw/timer/mss-timer.h
+F: include/hw/ssi/mss-spi.h
+
+Emcraft M2S-FG484
+M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+S: Maintained
+F: hw/arm/msf2-som.c
+
 CRIS Machines
 -------------
 Axis Dev88
-- 
2.7.4

From: "Emilio G. Cota" <cota@braap.org>

55c3cee ("qom: Introduce CPUClass.tcg_initialize", 2017-10-24)
introduces a per-CPUClass bool that we check so that the target CPU
is initialized for TCG only once. This works well except when
we end up creating more than one CPUClass, in which case we end
up incorrectly initializing TCG more than once, i.e. once for
each CPUClass.

This can be replicated with:
  $ aarch64-softmmu/qemu-system-aarch64 -machine xlnx-zcu102 -smp 6 \
      -global driver=xlnx,,zynqmp,property=has_rpu,value=on
In this case the class name of the "RPUs" is prefixed by "cortex-r5-",
whereas the "regular" CPUs are prefixed by "cortex-a53-". This
results in two CPUClass instances being created.

Fix it by introducing a static variable, so that only the first
target CPU being initialized will initialize the target-dependent
part of TCG, regardless of CPUClass instances.

Fixes: 55c3ceef61fcf06fc98ddc752b7cce788ce7680b
Signed-off-by: Emilio G. Cota <cota@braap.org>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1510343626-25861-2-git-send-email-cota@braap.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qom/cpu.h | 1 -
 exec.c            | 5 +++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUClass {
     /* Keep non-pointer data at the end to minimize holes.  */
     int gdb_num_core_regs;
     bool gdb_stop_before_watchpoint;
-    bool tcg_initialized;
 } CPUClass;
 
 #ifdef HOST_WORDS_BIGENDIAN
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
 void cpu_exec_realizefn(CPUState *cpu, Error **errp)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
+    static bool tcg_target_initialized;
 
     cpu_list_add(cpu);
 
-    if (tcg_enabled() && !cc->tcg_initialized) {
-        cc->tcg_initialized = true;
+    if (tcg_enabled() && !tcg_target_initialized) {
+        tcg_target_initialized = true;
         cc->tcg_initialize();
     }
 
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

Allow the -smp command line option to control the number of CPUs we
create.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Emilio G. Cota <cota@braap.org>
Tested-by: Emilio G. Cota <cota@braap.org>
Message-id: 1510343626-25861-3-git-send-email-cota@braap.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c |  3 ++-
 hw/arm/xlnx-zynqmp.c | 26 ++++++++++++++++----------
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
-    mc->desc = "Xilinx ZynqMP ZCU102 board";
+    mc->desc = "Xilinx ZynqMP ZCU102 board with 4xA53s and 2xR5s based on " \
+               "the value of smp";
     mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(XlnxZynqMPState *s, const char *boot_cpu,
 {
     Error *err = NULL;
     int i;
+    int num_rpus = MIN(smp_cpus - XLNX_ZYNQMP_NUM_APU_CPUS, XLNX_ZYNQMP_NUM_RPU_CPUS);
 
-    for (i = 0; i < XLNX_ZYNQMP_NUM_RPU_CPUS; i++) {
+    for (i = 0; i < num_rpus; i++) {
         char *name;
 
         object_initialize(&s->rpu_cpu[i], sizeof(s->rpu_cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(Object *obj)
 {
     XlnxZynqMPState *s = XLNX_ZYNQMP(obj);
     int i;
+    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
 
-    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
+    for (i = 0; i < num_apus; i++) {
         object_initialize(&s->apu_cpu[i], sizeof(s->apu_cpu[i]),
                           "cortex-a53-" TYPE_ARM_CPU);
         object_property_add_child(obj, "apu-cpu[*]", OBJECT(&s->apu_cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     MemoryRegion *system_memory = get_system_memory();
     uint8_t i;
     uint64_t ram_size;
+    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
     const char *boot_cpu = s->boot_cpu ? s->boot_cpu : "apu-cpu[0]";
     ram_addr_t ddr_low_size, ddr_high_size;
     qemu_irq gic_spi[GIC_NUM_SPI_INTR];
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 
     qdev_prop_set_uint32(DEVICE(&s->gic), "num-irq", GIC_NUM_SPI_INTR + 32);
     qdev_prop_set_uint32(DEVICE(&s->gic), "revision", 2);
-    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", XLNX_ZYNQMP_NUM_APU_CPUS);
+    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", num_apus);
 
     /* Realize APUs before realizing the GIC. KVM requires this.  */
-    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
+    for (i = 0; i < num_apus; i++) {
         char *name;
 
         object_property_set_int(OBJECT(&s->apu_cpu[i]), QEMU_PSCI_CONDUIT_SMC,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         }
     }
 
-    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
+    for (i = 0; i < num_apus; i++) {
         qemu_irq irq;
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     }
 
     if (s->has_rpu) {
-        xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
-        if (err) {
-            error_propagate(errp, err);
-            return;
-        }
+        info_report("The 'has_rpu' property is no longer required, to use the "
+                    "RPUs just use -smp 6.");
+    }
+
+    xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
     }
 
     if (!s->boot_cpu_ptr) {
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

The EP108 was an early access development board that is no longer used.
Add an info message to convert any users to the ZCU102 instead. On QEMU
they are both identical.

This patch also updated the qemu-doc.texi file to indicate that the
EP108 has been deprecated.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Emilio G. Cota <cota@braap.org>
Message-id: 1510343626-25861-4-git-send-email-cota@braap.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c | 3 +++
 qemu-doc.texi        | 7 +++++++
 2 files changed, 10 insertions(+)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
 {
     XlnxZCU102 *s = EP108_MACHINE(machine);
 
+    info_report("The Xilinx EP108 machine is deprecated, please use the "
+                "ZCU102 machine instead. It has the same features supported.");
+
     xlnx_zynqmp_init(s, machine);
 }
 
diff --git a/qemu-doc.texi b/qemu-doc.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@ or ``ivshmem-doorbell`` device types.
 The ``spapr-pci-vfio-host-bridge'' device type is replaced by
 the ``spapr-pci-host-bridge'' device type.
 
+@section System emulator machines
+
+@subsection Xilinx EP108 (since 2.11.0)
+
+The ``xlnx-ep108'' machine has been replaced by the ``xlnx-zcu102'' machine.
+The ``xlnx-zcu102'' machine has the same features and capabilites in QEMU.
+
 @node License
 @appendix License
 
-- 
2.7.4

From: "Emilio G. Cota" <cota@braap.org>

max_cpus needs to be an upper bound on the number of vCPUs
initialized; otherwise TCG region initialization breaks.

Some boards initialize a hard-coded number of vCPUs, which is not
captured by the global max_cpus and therefore breaks TCG initialization.
Fix it by adding the .min_cpus field to machine_class.

This commit also changes some user-facing behaviour: we now die if
-smp is below this hard-coded vCPU minimum instead of silently
ignoring the passed -smp value (sometimes announcing this by printing
a warning). However, the introduction of .default_cpus lessens the
likelihood that users will notice this: if -smp isn't set, we now
assign the value in .default_cpus to both smp_cpus and max_cpus. IOW,
if a user does not set -smp, they always get a correct number of vCPUs.

This change fixes 3468b59 ("tcg: enable multiple TCG contexts in
softmmu", 2017-10-24), which broke TCG initialization for some
ARM boards.

Fixes: 3468b59e18b179bc63c7ce934de912dfa9596122
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Emilio G. Cota <cota@braap.org>
Message-id: 1510343626-25861-6-git-send-email-cota@braap.org
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Emilio G. Cota <cota@braap.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/boards.h     |  5 +++++
 hw/arm/exynos4_boards.c | 12 ++++--------
 hw/arm/raspi.c          |  2 ++
 hw/arm/xlnx-zcu102.c    |  2 ++
 vl.c                    | 21 ++++++++++++++++++---
 5 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 /**
  * MachineClass:
+ * @max_cpus: maximum number of CPUs supported. Default: 1
+ * @min_cpus: minimum number of CPUs supported. Default: 1
+ * @default_cpus: number of CPUs instantiated if none are specified. Default: 1
  * @get_hotplug_handler: this function is called during bus-less
  *    device hotplug. If defined it returns pointer to an instance
  *    of HotplugHandler object, which handles hotplug operation
@@ -XXX,XX +XXX,XX @@ struct MachineClass {
     BlockInterfaceType block_default_type;
     int units_per_default_bus;
     int max_cpus;
+    int min_cpus;
+    int default_cpus;
     unsigned int no_serial:1,
         no_parallel:1,
         use_virtcon:1,
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/qtest.h"
 #include "hw/sysbus.h"
 #include "net/net.h"
 #include "hw/arm/arm.h"
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
                            Exynos4BoardType board_type)
 {
     Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
-    MachineClass *mc = MACHINE_GET_CLASS(machine);
-
-    if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
-        error_report("%s board supports only %d CPU cores, ignoring smp_cpus"
-                     " value",
-                     mc->name, EXYNOS4210_NCPUS);
-    }
 
     exynos4_board_binfo.ram_size = exynos4_board_ram_size[board_type];
     exynos4_board_binfo.board_id = exynos4_board_id[board_type];
@@ -XXX,XX +XXX,XX @@ static void nuri_class_init(ObjectClass *oc, void *data)
     mc->desc = "Samsung NURI board (Exynos4210)";
     mc->init = nuri_init;
     mc->max_cpus = EXYNOS4210_NCPUS;
+    mc->min_cpus = EXYNOS4210_NCPUS;
+    mc->default_cpus = EXYNOS4210_NCPUS;
     mc->ignore_memory_transaction_failures = true;
 }
 
@@ -XXX,XX +XXX,XX @@ static void smdkc210_class_init(ObjectClass *oc, void *data)
     mc->desc = "Samsung SMDKC210 board (Exynos4210)";
     mc->init = smdkc210_init;
     mc->max_cpus = EXYNOS4210_NCPUS;
+    mc->min_cpus = EXYNOS4210_NCPUS;
+    mc->default_cpus = EXYNOS4210_NCPUS;
     mc->ignore_memory_transaction_failures = true;
 }
 
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->max_cpus = BCM2836_NCPUS;
+    mc->min_cpus = BCM2836_NCPUS;
+    mc->default_cpus = BCM2836_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
     mc->ignore_memory_transaction_failures = true;
 };
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
     mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
+    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
 }
 
 static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
     mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
+    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
 }
 
 static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
diff --git a/vl.c b/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/vl.c
+++ b/vl.c
@@ -XXX,XX +XXX,XX @@ Chardev *virtcon_hds[MAX_VIRTIO_CONSOLES];
 Chardev *sclp_hds[MAX_SCLP_CONSOLES];
 int win2k_install_hack = 0;
 int singlestep = 0;
-int smp_cpus = 1;
-unsigned int max_cpus = 1;
+int smp_cpus;
+unsigned int max_cpus;
 int smp_cores = 1;
 int smp_threads = 1;
 int acpi_enabled = 1;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
         exit(0);
     }
 
+    /* machine_class: default to UP */
+    machine_class->max_cpus = machine_class->max_cpus ?: 1;
+    machine_class->min_cpus = machine_class->min_cpus ?: 1;
+    machine_class->default_cpus = machine_class->default_cpus ?: 1;
+
+    /* default to machine_class->default_cpus */
+    smp_cpus = machine_class->default_cpus;
+    max_cpus = machine_class->default_cpus;
+
     smp_parse(qemu_opts_find(qemu_find_opts("smp-opts"), NULL));
 
-    machine_class->max_cpus = machine_class->max_cpus ?: 1; /* Default to UP */
+    /* sanity-check smp_cpus and max_cpus against machine_class */
+    if (smp_cpus < machine_class->min_cpus) {
+        error_report("Invalid SMP CPUs %d. The min CPUs "
+                     "supported by machine '%s' is %d", smp_cpus,
+                     machine_class->name, machine_class->min_cpus);
+        exit(1);
+    }
     if (max_cpus > machine_class->max_cpus) {
         error_report("Invalid SMP CPUs %d. The max CPUs "
                      "supported by machine '%s' is %d", max_cpus,
-- 
2.7.4

From: Alex Bennée <alex.bennee@linaro.org>

We are still seeing signals during translation time when we walk over
a page protection boundary. This expands the check to ensure the host
PC is inside the code generation buffer. The original suggestion was
to check versus tcg_ctx.code_gen_ptr but as we now segment the
translation buffer we have to settle for just a general check for
being inside.

I've also fixed up the declaration to make it clear it can deal with
invalid addresses. A later patch will fix up the call sites.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20171108153245.20740-2-alex.bennee@linaro.org
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/exec/exec-all.h   | 11 ++++++++++
 accel/tcg/translate-all.c | 52 ++++++++++++++++++++++++++---------------------
 2 files changed, 40 insertions(+), 23 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
                           target_ulong *data);
 
 void cpu_gen_init(void);
+
+/**
+ * cpu_restore_state:
+ * @cpu: the vCPU state is to be restore to
+ * @searched_pc: the host PC the fault occurred at
+ * @return: true if state was restored, false otherwise
+ *
+ * Attempt to restore the state for a fault occurring in translated
+ * code. If the searched_pc is not in translated code no state is
+ * restored and the function returns false.
+ */
 bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc);
 
 void QEMU_NORETURN cpu_loop_exit_noexc(CPUState *cpu);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
     return 0;
 }
 
-bool cpu_restore_state(CPUState *cpu, uintptr_t retaddr)
+bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
 {
     TranslationBlock *tb;
     bool r = false;
+    uintptr_t check_offset;
 
-    /* A retaddr of zero is invalid so we really shouldn't have ended
-     * up here. The target code has likely forgotten to check retaddr
-     * != 0 before attempting to restore state. We return early to
-     * avoid blowing up on a recursive tb_lock(). The target must have
-     * previously survived a failed cpu_restore_state because
-     * tb_find_pc(0) would have failed anyway. It still should be
-     * fixed though.
+    /* The host_pc has to be in the region of current code buffer. If
+     * it is not we will not be able to resolve it here. The two cases
+     * where host_pc will not be correct are:
+     *
+     *  - fault during translation (instruction fetch)
+     *  - fault from helper (not using GETPC() macro)
+     *
+     * Either way we need return early to avoid blowing up on a
+     * recursive tb_lock() as we can't resolve it here.
+     *
+     * We are using unsigned arithmetic so if host_pc <
+     * tcg_init_ctx.code_gen_buffer check_offset will wrap to way
+     * above the code_gen_buffer_size
      */
-
-    if (!retaddr) {
-        return r;
-    }
-
-    tb_lock();
-    tb = tb_find_pc(retaddr);
-    if (tb) {
-        cpu_restore_state_from_tb(cpu, tb, retaddr);
-        if (tb->cflags & CF_NOCACHE) {
-            /* one-shot translation, invalidate it immediately */
-            tb_phys_invalidate(tb, -1);
-            tb_remove(tb);
+    check_offset = host_pc - (uintptr_t) tcg_init_ctx.code_gen_buffer;
+
+    if (check_offset < tcg_init_ctx.code_gen_buffer_size) {
+        tb_lock();
+        tb = tb_find_pc(host_pc);
+        if (tb) {
+            cpu_restore_state_from_tb(cpu, tb, host_pc);
+            if (tb->cflags & CF_NOCACHE) {
+                /* one-shot translation, invalidate it immediately */
+                tb_phys_invalidate(tb, -1);
+                tb_remove(tb);
+            }
+            r = true;
         }
-        r = true;
+        tb_unlock();
     }
-    tb_unlock();
 
     return r;
 }
-- 
2.7.4

Latest run of arm patches -- most of these are Philippe's SD card
cleanups. I have more in my queue to review, but 32 is enough
patches to warrant sending out.

thanks
-- PMM

The following changes since commit ff8689611a1d954897d857b28f7ef404e11cfa2c:

Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging (2018-02-22 11:37:05 +0000)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180222

for you to fetch changes up to 4e5cc6756586e967993187657dfcdde4e00288d9:

sdcard: simplify SD_SEND_OP_COND (ACMD41) (2018-02-22 15:12:54 +0000)

----------------------------------------------------------------
 * New "raspi3" machine emulating RaspberryPi 3
 * Fix bad register definitions for VMIDR and VMPIDR (which caused
   assertions for 64-bit guest CPUs with EL2 on big-endian hosts)
 * hw/char/stm32f2xx_usart: fix TXE/TC bit handling
 * Fix ast2500 protection register emulation
 * Lots of SD card emulation cleanups and bugfixes

----------------------------------------------------------------
Hugo Landau (1):
      Fix ast2500 protection register emulation

Pekka Enberg (1):
      raspi: Add "raspi3" machine type

Peter Maydell (1):
      target/arm: Fix register definitions for VMIDR and VMPIDR

Philippe Mathieu-Daudé (28):
      hw/sd/milkymist-memcard: use qemu_log_mask()
      hw/sd/milkymist-memcard: split realize() out of SysBusDevice init()
      hw/sd/milkymist-memcard: expose a SDBus and connect the SDCard to it
      hw/sd/ssi-sd: use the SDBus API, connect the SDCard to the bus
      sdcard: reorder SDState struct members
      sdcard: replace DPRINTF() by trace events
      sdcard: add a trace event for command responses
      sdcard: replace fprintf() by qemu_hexdump()
      sdcard: add more trace events
      sdcard: define SDMMC_CMD_MAX instead of using the magic '64'
      sdcard: use G_BYTE from cutils
      sdcard: use the registerfields API to access the OCR register
      sdcard: Don't always set the high capacity bit
      sdcard: update the CSD CRC register regardless the CSD structure version
      sdcard: fix the 'maximum data transfer rate' to 25MHz
      sdcard: clean the SCR register and add few comments
      sdcard: remove commands from unsupported old MMC specification
      sdcard: simplify using the ldst API
      sdcard: use the correct masked OCR in the R3 reply
      sdcard: use the registerfields API for the CARD_STATUS register masks
      sdcard: handle CMD54 (SDIO)
      sdcard: handle the Security Specification commands
      sdcard: use a more descriptive label 'unimplemented_spi_cmd'
      sdcard: handles more commands in SPI mode
      sdcard: check the card is in correct state for APP CMD (CMD55)
      sdcard: warn if host uses an incorrect address for APP CMD (CMD55)
      sdcard: simplify SEND_IF_COND (CMD8)
      sdcard: simplify SD_SEND_OP_COND (ACMD41)

Richard Braun (1):
      hw/char/stm32f2xx_usart: fix TXE/TC bit handling

The register definitions for VMIDR and VMPIDR have separate
reginfo structs for the AArch32 and AArch64 registers. However
the 32-bit versions are wrong:
 * they use offsetof instead of offsetoflow32 to mark where
   the 32-bit value lives in the uint64_t CPU state field
 * they don't mark themselves as ARM_CP_ALIAS

In particular this means that if you try to use an Arm guest CPU
which enables EL2 on a big-endian host it will assert at reset:
 target/arm/cpu.c:114: cp_reg_check_reset: Assertion `oldvalue == newvalue' failed.

because the reset of the 32-bit register writes to the top
half of the uint64_t.

Correct the errors in the structures.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
This is necessary for 'make check' to pass on big endian
systems with the 'raspi3' board enabled, which is the
first board which has an EL2-enabled-by-default CPU.
---
 target/arm/helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
               .access = PL2_RW, .accessfn = access_el3_aa32ns,
-              .resetvalue = cpu->midr,
-              .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
+              .resetvalue = cpu->midr, .type = ARM_CP_ALIAS,
+              .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) },
             { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
               .access = PL2_RW, .resetvalue = cpu->midr,
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "VMPIDR", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
               .access = PL2_RW, .accessfn = access_el3_aa32ns,
-              .resetvalue = vmpidr_def,
-              .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
+              .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS,
+              .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) },
             { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
               .access = PL2_RW,
-- 
2.16.1

From: Pekka Enberg <penberg@iki.fi>

This patch adds a "raspi3" machine type, which can now be selected as
the machine to run on by users via the "-M" command line option to QEMU.

The machine type does *not* ignore memory transaction failures so we
likely need to add some dummy devices later when people run something
more complicated than what I'm using for testing.

Signed-off-by: Pekka Enberg <penberg@iki.fi>
[PMM: added #ifdef TARGET_AARCH64 so we don't provide the 64-bit
 board in the 32-bit only arm-softmmu build.]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->ignore_memory_transaction_failures = true;
 };
 DEFINE_MACHINE("raspi2", raspi2_machine_init)
+
+#ifdef TARGET_AARCH64
+static void raspi3_init(MachineState *machine)
+{
+    raspi_init(machine, 3);
+}
+
+static void raspi3_machine_init(MachineClass *mc)
+{
+    mc->desc = "Raspberry Pi 3";
+    mc->init = raspi3_init;
+    mc->block_default_type = IF_SD;
+    mc->no_parallel = 1;
+    mc->no_floppy = 1;
+    mc->no_cdrom = 1;
+    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
+    mc->max_cpus = BCM2836_NCPUS;
+    mc->min_cpus = BCM2836_NCPUS;
+    mc->default_cpus = BCM2836_NCPUS;
+    mc->default_ram_size = 1024 * 1024 * 1024;
+}
+DEFINE_MACHINE("raspi3", raspi3_machine_init)
+#endif
-- 
2.16.1

From: Richard Braun <rbraun@sceen.net>

I/O currently being synchronous, there is no reason to ever clear the
SR_TXE bit. However the SR_TC bit may be cleared by software writing
to the SR register, so set it on each write.

In addition, fix the reset value of the USART status register.

Signed-off-by: Richard Braun <rbraun@sceen.net>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
[PMM: removed XXX tag from comment, since it isn't something
 we need to come back and fix in QEMU]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/stm32f2xx_usart.h |  7 ++++++-
 hw/char/stm32f2xx_usart.c         | 12 ++++++++----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/include/hw/char/stm32f2xx_usart.h b/include/hw/char/stm32f2xx_usart.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/stm32f2xx_usart.h
+++ b/include/hw/char/stm32f2xx_usart.h
@@ -XXX,XX +XXX,XX @@
 #define USART_CR3  0x14
 #define USART_GTPR 0x18
 
-#define USART_SR_RESET 0x00C00000
+/*
+ * NB: The reset value mentioned in "24.6.1 Status register" seems bogus.
+ * Looking at "Table 98 USART register map and reset values", it seems it
+ * should be 0xc0, and that's how real hardware behaves.
+ */
+#define USART_SR_RESET (USART_SR_TXE | USART_SR_TC)
 
 #define USART_SR_TXE  (1 << 7)
 #define USART_SR_TC   (1 << 6)
diff --git a/hw/char/stm32f2xx_usart.c b/hw/char/stm32f2xx_usart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/stm32f2xx_usart.c
+++ b/hw/char/stm32f2xx_usart.c
@@ -XXX,XX +XXX,XX @@ static uint64_t stm32f2xx_usart_read(void *opaque, hwaddr addr,
     switch (addr) {
     case USART_SR:
         retvalue = s->usart_sr;
-        s->usart_sr &= ~USART_SR_TC;
         qemu_chr_fe_accept_input(&s->chr);
         return retvalue;
     case USART_DR:
         DB_PRINT("Value: 0x%" PRIx32 ", %c\n", s->usart_dr, (char) s->usart_dr);
-        s->usart_sr |= USART_SR_TXE;
         s->usart_sr &= ~USART_SR_RXNE;
         qemu_chr_fe_accept_input(&s->chr);
         qemu_set_irq(s->irq, 0);
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_usart_write(void *opaque, hwaddr addr,
     switch (addr) {
     case USART_SR:
         if (value <= 0x3FF) {
-            s->usart_sr = value;
+            /* I/O being synchronous, TXE is always set. In addition, it may
+               only be set by hardware, so keep it set here. */
+            s->usart_sr = value | USART_SR_TXE;
         } else {
             s->usart_sr &= value;
         }
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_usart_write(void *opaque, hwaddr addr,
             /* XXX this blocks entire thread. Rewrite to use
              * qemu_chr_fe_write and background I/O callbacks */
             qemu_chr_fe_write_all(&s->chr, &ch, 1);
+            /* XXX I/O are currently synchronous, making it impossible for
+               software to observe transient states where TXE or TC aren't
+               set. Unlike TXE however, which is read-only, software may
+               clear TC by writing 0 to the SR register, so set it again
+               on each write. */
             s->usart_sr |= USART_SR_TC;
-            s->usart_sr &= ~USART_SR_TXE;
         }
         return;
     case USART_BRR:
-- 
2.16.1

From: Hugo Landau <hlandau@devever.net>

Some register blocks of the ast2500 are protected by protection key
registers which require the right magic value to be written to those
registers to allow those registers to be mutated.

Register manuals indicate that writing the correct magic value to these
registers should cause subsequent reads from those values to return 1,
and writing any other value should cause subsequent reads to return 0.

Previously, qemu implemented these registers incorrectly: the registers
were handled as simple memory, meaning that writing some value x to a
protection key register would result in subsequent reads from that
register returning the same value x. The protection was implemented by
ensuring that the current value of that register equaled the magic
value.

This modifies qemu to have the correct behaviour: attempts to write to a
ast2500 protection register results in a transition to 1 or 0 depending
on whether the written value is the correct magic. The protection logic
is updated to ensure that the value of the register is nonzero.

This bug caused deadlocks with u-boot HEAD: when u-boot is done with a
protectable register block, it attempts to lock it by writing the
bitwise inverse of the correct magic value, and then spinning forever
until the register reads as zero. Since qemu implemented writes to these
registers as ordinary memory writes, writing the inverse of the magic
value resulted in subsequent reads returning that value, leading to
u-boot spinning forever.

Signed-off-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 20180220132627.4163-1-hlandau@devever.net
[PMM: fixed incorrect code indentation]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/aspeed_scu.c  | 6 +++++-
 hw/misc/aspeed_sdmc.c | 8 +++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
     }
 
     if (reg > PROT_KEY && reg < CPU2_BASE_SEG1 &&
-            s->regs[PROT_KEY] != ASPEED_SCU_PROT_KEY) {
+            !s->regs[PROT_KEY]) {
         qemu_log_mask(LOG_GUEST_ERROR, "%s: SCU is locked!\n", __func__);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
     trace_aspeed_scu_write(offset, size, data);
 
     switch (reg) {
+    case PROT_KEY:
+        s->regs[reg] = (data == ASPEED_SCU_PROT_KEY) ? 1 : 0;
+        return;
+
     case FREQ_CNTR_EVAL:
     case VGA_SCRATCH1 ... VGA_SCRATCH8:
     case RNG_DATA:
diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_sdmc.c
+++ b/hw/misc/aspeed_sdmc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,
         return;
     }
 
-    if (addr != R_PROT && s->regs[R_PROT] != PROT_KEY_UNLOCK) {
+    if (addr == R_PROT) {
+        s->regs[addr] = (data == PROT_KEY_UNLOCK) ? 1 : 0;
+        return;
+    }
+
+    if (!s->regs[R_PROT]) {
         qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,
             data &= ~ASPEED_SDMC_READONLY_MASK;
             break;
         case AST2500_A0_SILICON_REV:
+        case AST2500_A1_SILICON_REV:
             data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
             break;
         default:
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Acked-by: Michael Walle <michael@walle.cc>
Message-id: 20180216022933.10945-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/milkymist-memcard.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/log.h"
 #include "hw/hw.h"
 #include "hw/sysbus.h"
 #include "sysemu/sysemu.h"
 #include "trace.h"
-#include "qemu/error-report.h"
+#include "include/qapi/error.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
 #include "hw/sd/sd.h"
@@ -XXX,XX +XXX,XX @@ static uint64_t memcard_read(void *opaque, hwaddr addr,
         } else {
             r = s->response[s->response_read_ptr++];
             if (s->response_read_ptr > s->response_len) {
-                error_report("milkymist_memcard: "
-                        "read more cmd bytes than available. Clipping.");
+                qemu_log_mask(LOG_GUEST_ERROR, "milkymist_memcard: "
+                              "read more cmd bytes than available. Clipping.");
                 s->response_read_ptr = 0;
             }
         }
@@ -XXX,XX +XXX,XX @@ static uint64_t memcard_read(void *opaque, hwaddr addr,
         break;
 
     default:
-        error_report("milkymist_memcard: read access to unknown register 0x"
-                TARGET_FMT_plx, addr << 2);
+        qemu_log_mask(LOG_UNIMP, "milkymist_memcard: "
+                      "read access to unknown register 0x%" HWADDR_PRIx "\n",
+                      addr << 2);
         break;
     }
 
@@ -XXX,XX +XXX,XX @@ static void memcard_write(void *opaque, hwaddr addr, uint64_t value,
         break;
 
     default:
-        error_report("milkymist_memcard: write access to unknown register 0x"
-                TARGET_FMT_plx, addr << 2);
+        qemu_log_mask(LOG_UNIMP, "milkymist_memcard: "
+                      "write access to unknown register 0x%" HWADDR_PRIx " "
+                      "(value 0x%" PRIx64 ")\n", addr << 2, value);
         break;
     }
 }
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Create the SDCard in the realize() function.

Suggested-by: Michael Walle <michael@walle.cc>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Acked-by: Michael Walle <michael@walle.cc>
Message-id: 20180216022933.10945-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/milkymist-memcard.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -XXX,XX +XXX,XX @@ static void milkymist_memcard_reset(DeviceState *d)
     device_reset(DEVICE(s->card));
 }
 
-static int milkymist_memcard_init(SysBusDevice *dev)
+static void milkymist_memcard_init(Object *obj)
+{
+    MilkymistMemcardState *s = MILKYMIST_MEMCARD(obj);
+    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
+
+    memory_region_init_io(&s->regs_region, OBJECT(s), &memcard_mmio_ops, s,
+            "milkymist-memcard", R_MAX * 4);
+    sysbus_init_mmio(dev, &s->regs_region);
+}
+
+static void milkymist_memcard_realize(DeviceState *dev, Error **errp)
 {
     MilkymistMemcardState *s = MILKYMIST_MEMCARD(dev);
-    DriveInfo *dinfo;
     BlockBackend *blk;
+    DriveInfo *dinfo;
 
     /* FIXME use a qdev drive property instead of drive_get_next() */
     dinfo = drive_get_next(IF_SD);
     blk = dinfo ? blk_by_legacy_dinfo(dinfo) : NULL;
     s->card = sd_init(blk, false);
     if (s->card == NULL) {
-        return -1;
+        error_setg(errp, "failed to init SD card");
+        return;
     }
-
     s->enabled = blk && blk_is_inserted(blk);
-
-    memory_region_init_io(&s->regs_region, OBJECT(s), &memcard_mmio_ops, s,
-            "milkymist-memcard", R_MAX * 4);
-    sysbus_init_mmio(dev, &s->regs_region);
-
-    return 0;
 }
 
 static const VMStateDescription vmstate_milkymist_memcard = {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_milkymist_memcard = {
 static void milkymist_memcard_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 
-    k->init = milkymist_memcard_init;
+    dc->realize = milkymist_memcard_realize;
     dc->reset = milkymist_memcard_reset;
     dc->vmsd = &vmstate_milkymist_memcard;
     /* Reason: init() method uses drive_get_next() */
@@ -XXX,XX +XXX,XX @@ static const TypeInfo milkymist_memcard_info = {
     .name          = TYPE_MILKYMIST_MEMCARD,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(MilkymistMemcardState),
+    .instance_init = milkymist_memcard_init,
     .class_init    = milkymist_memcard_class_init,
 };
 
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

using the sdbus_*() API.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Acked-by: Michael Walle <michael@walle.cc>
Message-id: 20180216022933.10945-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/milkymist-memcard.c | 38 +++++++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -XXX,XX +XXX,XX @@ struct MilkymistMemcardState {
     SysBusDevice parent_obj;
 
     MemoryRegion regs_region;
-    SDState *card;
+    SDBus sdbus;
 
     int command_write_ptr;
     int response_read_ptr;
@@ -XXX,XX +XXX,XX @@ static void memcard_sd_command(MilkymistMemcardState *s)
     req.crc = s->command[5];
 
     s->response[0] = req.cmd;
-    s->response_len = sd_do_command(s->card, &req, s->response+1);
+    s->response_len = sdbus_do_command(&s->sdbus, &req, s->response + 1);
     s->response_read_ptr = 0;
 
     if (s->response_len == 16) {
@@ -XXX,XX +XXX,XX @@ static uint64_t memcard_read(void *opaque, hwaddr addr,
             r = 0xffffffff;
         } else {
             r = 0;
-            r |= sd_read_data(s->card) << 24;
-            r |= sd_read_data(s->card) << 16;
-            r |= sd_read_data(s->card) << 8;
-            r |= sd_read_data(s->card);
+            r |= sdbus_read_data(&s->sdbus) << 24;
+            r |= sdbus_read_data(&s->sdbus) << 16;
+            r |= sdbus_read_data(&s->sdbus) << 8;
+            r |= sdbus_read_data(&s->sdbus);
         }
         break;
     case R_CLK2XDIV:
@@ -XXX,XX +XXX,XX @@ static void memcard_write(void *opaque, hwaddr addr, uint64_t value,
         if (!s->enabled) {
             break;
         }
-        sd_write_data(s->card, (value >> 24) & 0xff);
-        sd_write_data(s->card, (value >> 16) & 0xff);
-        sd_write_data(s->card, (value >> 8) & 0xff);
-        sd_write_data(s->card, value & 0xff);
+        sdbus_write_data(&s->sdbus, (value >> 24) & 0xff);
+        sdbus_write_data(&s->sdbus, (value >> 16) & 0xff);
+        sdbus_write_data(&s->sdbus, (value >> 8) & 0xff);
+        sdbus_write_data(&s->sdbus, value & 0xff);
         break;
     case R_ENABLE:
         s->regs[addr] = value;
@@ -XXX,XX +XXX,XX @@ static void milkymist_memcard_reset(DeviceState *d)
     for (i = 0; i < R_MAX; i++) {
         s->regs[i] = 0;
     }
-    /* Since we're still using the legacy SD API the card is not plugged
-     * into any bus, and we must reset it manually.
-     */
-    device_reset(DEVICE(s->card));
 }
 
 static void milkymist_memcard_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void milkymist_memcard_init(Object *obj)
 static void milkymist_memcard_realize(DeviceState *dev, Error **errp)
 {
     MilkymistMemcardState *s = MILKYMIST_MEMCARD(dev);
+    DeviceState *carddev;
     BlockBackend *blk;
     DriveInfo *dinfo;
+    Error *err = NULL;
 
+    qbus_create_inplace(&s->sdbus, sizeof(s->sdbus), TYPE_SD_BUS,
+                        dev, "sd-bus");
+
+    /* Create and plug in the sd card */
     /* FIXME use a qdev drive property instead of drive_get_next() */
     dinfo = drive_get_next(IF_SD);
     blk = dinfo ? blk_by_legacy_dinfo(dinfo) : NULL;
-    s->card = sd_init(blk, false);
-    if (s->card == NULL) {
-        error_setg(errp, "failed to init SD card");
+    carddev = qdev_create(&s->sdbus.qbus, TYPE_SD_CARD);
+    qdev_prop_set_drive(carddev, "drive", blk, &err);
+    object_property_set_bool(OBJECT(carddev), true, "realized", &err);
+    if (err) {
+        error_setg(errp, "failed to init SD card: %s", error_get_pretty(err));
         return;
     }
     s->enabled = blk && blk_is_inserted(blk);
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

On reset the bus will reset the card,
we can now drop the device_reset() call.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180216022933.10945-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/ssi-sd.c | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -XXX,XX +XXX,XX @@ typedef struct {
     int32_t arglen;
     int32_t response_pos;
     int32_t stopping;
-    SDState *sd;
+    SDBus sdbus;
 } ssi_sd_state;
 
 #define TYPE_SSI_SD "ssi-sd"
@@ -XXX,XX +XXX,XX @@ static uint32_t ssi_sd_transfer(SSISlave *dev, uint32_t val)
             request.arg = (s->cmdarg[0] << 24) | (s->cmdarg[1] << 16)
                            | (s->cmdarg[2] << 8) | s->cmdarg[3];
             DPRINTF("CMD%d arg 0x%08x\n", s->cmd, request.arg);
-            s->arglen = sd_do_command(s->sd, &request, longresp);
+            s->arglen = sdbus_do_command(&s->sdbus, &request, longresp);
             if (s->arglen <= 0) {
                 s->arglen = 1;
                 s->response[0] = 4;
@@ -XXX,XX +XXX,XX @@ static uint32_t ssi_sd_transfer(SSISlave *dev, uint32_t val)
             DPRINTF("Response 0x%02x\n", s->response[s->response_pos]);
             return s->response[s->response_pos++];
         }
-        if (sd_data_ready(s->sd)) {
+        if (sdbus_data_ready(&s->sdbus)) {
             DPRINTF("Data read\n");
             s->mode = SSI_SD_DATA_START;
         } else {
@@ -XXX,XX +XXX,XX @@ static uint32_t ssi_sd_transfer(SSISlave *dev, uint32_t val)
         s->mode = SSI_SD_DATA_READ;
         return 0xfe;
     case SSI_SD_DATA_READ:
-        val = sd_read_data(s->sd);
-        if (!sd_data_ready(s->sd)) {
+        val = sdbus_read_data(&s->sdbus);
+        if (!sdbus_data_ready(&s->sdbus)) {
             DPRINTF("Data read end\n");
             s->mode = SSI_SD_CMD;
         }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_ssi_sd = {
 static void ssi_sd_realize(SSISlave *d, Error **errp)
 {
     ssi_sd_state *s = FROM_SSI_SLAVE(ssi_sd_state, d);
+    DeviceState *carddev;
     DriveInfo *dinfo;
+    Error *err = NULL;
 
+    qbus_create_inplace(&s->sdbus, sizeof(s->sdbus), TYPE_SD_BUS,
+                        DEVICE(d), "sd-bus");
+
+    /* Create and plug in the sd card */
     /* FIXME use a qdev drive property instead of drive_get_next() */
     dinfo = drive_get_next(IF_SD);
-    s->sd = sd_init(dinfo ? blk_by_legacy_dinfo(dinfo) : NULL, true);
-    if (s->sd == NULL) {
-        error_setg(errp, "Device initialization failed.");
+    carddev = qdev_create(&s->sdbus.qbus, TYPE_SD_CARD);
+    if (dinfo) {
+        qdev_prop_set_drive(carddev, "drive", blk_by_legacy_dinfo(dinfo), &err);
+    }
+    object_property_set_bool(OBJECT(carddev), true, "spi", &err);
+    object_property_set_bool(OBJECT(carddev), true, "realized", &err);
+    if (err) {
+        error_setg(errp, "failed to init SD card: %s", error_get_pretty(err));
         return;
     }
 }
@@ -XXX,XX +XXX,XX @@ static void ssi_sd_reset(DeviceState *dev)
     s->arglen = 0;
     s->response_pos = 0;
     s->stopping = 0;
-
-    /* Since we're still using the legacy SD API the card is not plugged
-     * into any bus, and we must reset it manually.
-     */
-    device_reset(DEVICE(s->sd));
 }
 
 static void ssi_sd_class_init(ObjectClass *klass, void *data)
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

place card registers first, this will ease further code movements.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215220540.6556-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ enum SDCardStates {
 struct SDState {
     DeviceState parent_obj;
 
-    uint32_t mode;    /* current card mode, one of SDCardModes */
-    int32_t state;    /* current card state, one of SDCardStates */
+    /* SD Memory Card Registers */
     uint32_t ocr;
-    QEMUTimer *ocr_power_timer;
     uint8_t scr[8];
     uint8_t cid[16];
     uint8_t csd[16];
     uint16_t rca;
     uint32_t card_status;
     uint8_t sd_status[64];
+
+    /* Configurable properties */
+    BlockBackend *blk;
+    bool spi;
+
+    uint32_t mode;    /* current card mode, one of SDCardModes */
+    int32_t state;    /* current card state, one of SDCardStates */
     uint32_t vhs;
     bool wp_switch;
     unsigned long *wp_groups;
@@ -XXX,XX +XXX,XX @@ struct SDState {
     uint8_t pwd[16];
     uint32_t pwd_len;
     uint8_t function_group[6];
-
-    bool spi;
     uint8_t current_cmd;
     /* True if we will handle the next command as an ACMD. Note that this does
      * *not* track the APP_CMD status bit!
@@ -XXX,XX +XXX,XX @@ struct SDState {
     uint8_t data[512];
     qemu_irq readonly_cb;
     qemu_irq inserted_cb;
-    BlockBackend *blk;
-
+    QEMUTimer *ocr_power_timer;
     bool enable;
     uint8_t dat_lines;
     bool cmd_line;
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215220540.6556-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c         | 32 ++++++++++++++++++++++++++------
 hw/sd/trace-events |  6 ++++++
 2 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "qemu/timer.h"
 #include "qemu/log.h"
+#include "trace.h"
 
 //#define DEBUG_SD 1
 
@@ -XXX,XX +XXX,XX @@ struct SDState {
     bool cmd_line;
 };
 
+static const char *sd_state_name(enum SDCardStates state)
+{
+    static const char *state_name[] = {
+        [sd_idle_state]             = "idle",
+        [sd_ready_state]            = "ready",
+        [sd_identification_state]   = "identification",
+        [sd_standby_state]          = "standby",
+        [sd_transfer_state]         = "transfer",
+        [sd_sendingdata_state]      = "sendingdata",
+        [sd_receivingdata_state]    = "receivingdata",
+        [sd_programming_state]      = "programming",
+        [sd_disconnect_state]       = "disconnect",
+    };
+    if (state == sd_inactive_state) {
+        return "inactive";
+    }
+    assert(state <= ARRAY_SIZE(state_name));
+    return state_name[state];
+}
+
 static uint8_t sd_get_dat_lines(SDState *sd)
 {
     return sd->enable ? sd->dat_lines : 0;
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
     uint32_t rca = 0x0000;
     uint64_t addr = (sd->ocr & (1 << 30)) ? (uint64_t) req.arg << 9 : req.arg;
 
+    trace_sdcard_normal_command(req.cmd, req.arg, sd_state_name(sd->state));
+
     /* Not interpreting this as an app command */
     sd->card_status &= ~APP_CMD;
 
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         sd->multi_blk_cnt = 0;
     }
 
-    DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state);
     switch (req.cmd) {
     /* Basic commands (Class 0 and Class 1) */
     case 0:	/* CMD0:   GO_IDLE_STATE */
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         return sd_r1;
 
     case 56:	/* CMD56:  GEN_CMD */
-        fprintf(stderr, "SD: GEN_CMD 0x%08x\n", req.arg);
-
         switch (sd->state) {
         case sd_transfer_state:
             sd->data_offset = 0;
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
 static sd_rsp_type_t sd_app_command(SDState *sd,
                                     SDRequest req)
 {
-    DPRINTF("ACMD%d 0x%08x\n", req.cmd, req.arg);
+    trace_sdcard_app_command(req.cmd, req.arg);
     sd->card_status |= APP_CMD;
     switch (req.cmd) {
     case 6:	/* ACMD6:  SET_BUS_WIDTH */
@@ -XXX,XX +XXX,XX @@ send_response:
 
 static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
 {
-    DPRINTF("sd_blk_read: addr = 0x%08llx, len = %d\n",
-            (unsigned long long) addr, len);
+    trace_sdcard_read_block(addr, len);
     if (!sd->blk || blk_pread(sd->blk, addr, sd->data, len) < 0) {
         fprintf(stderr, "sd_blk_read: read error on host side\n");
     }
@@ -XXX,XX +XXX,XX @@ static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
 
 static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
 {
+    trace_sdcard_write_block(addr, len);
     if (!sd->blk || blk_pwrite(sd->blk, addr, sd->data, len, 0) < 0) {
         fprintf(stderr, "sd_blk_write: write error on host side\n");
     }
diff --git a/hw/sd/trace-events b/hw/sd/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/trace-events
+++ b/hw/sd/trace-events
@@ -XXX,XX +XXX,XX @@ sdhci_read_dataport(uint16_t data_count) "all %u bytes of data have been read fr
 sdhci_write_dataport(uint16_t data_count) "write buffer filled with %u bytes of data"
 sdhci_capareg(const char *desc, uint16_t val) "%s: %u"
 
+# hw/sd/sd.c
+sdcard_normal_command(uint8_t cmd, uint32_t arg, const char *state) "CMD%d arg 0x%08x (state %s)"
+sdcard_app_command(uint8_t acmd, uint32_t arg) "ACMD%d arg 0x%08x"
+sdcard_read_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
+sdcard_write_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
+
 # hw/sd/milkymist-memcard.c
 milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 milkymist_memcard_memory_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180215220540.6556-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c         | 27 ++++++++++++++++++++++++---
 hw/sd/trace-events |  1 +
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static const char *sd_state_name(enum SDCardStates state)
     return state_name[state];
 }
 
+static const char *sd_response_name(sd_rsp_type_t rsp)
+{
+    static const char *response_name[] = {
+        [sd_r0]     = "RESP#0 (no response)",
+        [sd_r1]     = "RESP#1 (normal cmd)",
+        [sd_r2_i]   = "RESP#2 (CID reg)",
+        [sd_r2_s]   = "RESP#2 (CSD reg)",
+        [sd_r3]     = "RESP#3 (OCR reg)",
+        [sd_r6]     = "RESP#6 (RCA)",
+        [sd_r7]     = "RESP#7 (operating voltage)",
+    };
+    if (rsp == sd_illegal) {
+        return "ILLEGAL RESP";
+    }
+    if (rsp == sd_r1b) {
+        rsp = sd_r1;
+    }
+    assert(rsp <= ARRAY_SIZE(response_name));
+    return response_name[rsp];
+}
+
 static uint8_t sd_get_dat_lines(SDState *sd)
 {
     return sd->enable ? sd->dat_lines : 0;
@@ -XXX,XX +XXX,XX @@ send_response:
 
     case sd_r0:
     case sd_illegal:
-    default:
         rsplen = 0;
         break;
+    default:
+        g_assert_not_reached();
     }
+    trace_sdcard_response(sd_response_name(rtype), rsplen);
 
     if (rtype != sd_illegal) {
         /* Clear the "clear on valid command" status bits now we've
@@ -XXX,XX +XXX,XX @@ send_response:
             DPRINTF(" %02x", response[i]);
         }
         DPRINTF(" state %d\n", sd->state);
-    } else {
-        DPRINTF("No response %d\n", sd->state);
     }
 #endif
 
diff --git a/hw/sd/trace-events b/hw/sd/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/trace-events
+++ b/hw/sd/trace-events
@@ -XXX,XX +XXX,XX @@ sdhci_capareg(const char *desc, uint16_t val) "%s: %u"
 # hw/sd/sd.c
 sdcard_normal_command(uint8_t cmd, uint32_t arg, const char *state) "CMD%d arg 0x%08x (state %s)"
 sdcard_app_command(uint8_t acmd, uint32_t arg) "ACMD%d arg 0x%08x"
+sdcard_response(const char *rspdesc, int rsplen) "%s (sz:%d)"
 sdcard_read_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
 sdcard_write_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
 
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215220540.6556-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 16 +---------------
 1 file changed, 1 insertion(+), 15 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@
 
 //#define DEBUG_SD 1
 
-#ifdef DEBUG_SD
-#define DPRINTF(fmt, ...) \
-do { fprintf(stderr, "SD: " fmt , ## __VA_ARGS__); } while (0)
-#else
-#define DPRINTF(fmt, ...) do {} while(0)
-#endif
-
 #define ACMD41_ENQUIRY_MASK     0x00ffffff
 #define OCR_POWER_UP            0x80000000
 #define OCR_POWER_DELAY_NS      500000 /* 0.5ms */
@@ -XXX,XX +XXX,XX @@ send_response:
     }
 
 #ifdef DEBUG_SD
-    if (rsplen) {
-        int i;
-        DPRINTF("Response:");
-        for (i = 0; i < rsplen; i++) {
-            DPRINTF(" %02x", response[i]);
-        }
-        DPRINTF(" state %d\n", sd->state);
-    }
+    qemu_hexdump((const char *)response, stderr, "Response", rsplen);
 #endif
 
     return rsplen;
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215220540.6556-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c         | 32 ++++++++++++++++++++++++++------
 hw/sd/trace-events | 13 +++++++++++++
 2 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static bool sd_get_cmd_line(SDState *sd)
 
 static void sd_set_voltage(SDState *sd, uint16_t millivolts)
 {
+    trace_sdcard_set_voltage(millivolts);
+
     switch (millivolts) {
     case 3001 ... 3600: /* SD_VOLTAGE_3_3V */
     case 2001 ... 3000: /* SD_VOLTAGE_3_0V */
@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
 {
     SDState *sd = opaque;
 
+    trace_sdcard_powerup();
     /* Set powered up bit in OCR */
     assert(!(sd->ocr & OCR_POWER_UP));
     sd->ocr |= OCR_POWER_UP;
@@ -XXX,XX +XXX,XX @@ static void sd_reset(DeviceState *dev)
     uint64_t size;
     uint64_t sect;
 
+    trace_sdcard_reset();
     if (sd->blk) {
         blk_get_geometry(sd->blk, &sect);
     } else {
@@ -XXX,XX +XXX,XX @@ static void sd_cardchange(void *opaque, bool load, Error **errp)
     bool readonly = sd_get_readonly(sd);
 
     if (inserted) {
+        trace_sdcard_inserted(readonly);
         sd_reset(dev);
+    } else {
+        trace_sdcard_ejected();
     }
 
     /* The IRQ notification is for legacy non-QOM SD controller devices;
@@ -XXX,XX +XXX,XX @@ static void sd_erase(SDState *sd)
     uint64_t erase_start = sd->erase_start;
     uint64_t erase_end = sd->erase_end;
 
+    trace_sdcard_erase();
     if (!sd->erase_start || !sd->erase_end) {
         sd->card_status |= ERASE_SEQ_ERROR;
         return;
@@ -XXX,XX +XXX,XX @@ static void sd_lock_command(SDState *sd)
     else
         pwd_len = 0;
 
+    if (lock) {
+        trace_sdcard_lock();
+    } else {
+        trace_sdcard_unlock();
+    }
     if (erase) {
         if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||
                         set_pwd || clr_pwd || lock || sd->wp_switch ||
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
     case 16:	/* CMD16:  SET_BLOCKLEN */
         switch (sd->state) {
         case sd_transfer_state:
-            if (req.arg > (1 << HWBLOCK_SHIFT))
+            if (req.arg > (1 << HWBLOCK_SHIFT)) {
                 sd->card_status |= BLOCK_LEN_ERROR;
-            else
+            } else {
+                trace_sdcard_set_blocklen(req.arg);
                 sd->blk_len = req.arg;
+            }
 
             return sd_r1;
 
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
                 if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
                     timer_del(sd->ocr_power_timer);
                     sd_ocr_powerup(sd);
-                } else if (!timer_pending(sd->ocr_power_timer)) {
-                    timer_mod_ns(sd->ocr_power_timer,
-                                 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
-                                  + OCR_POWER_DELAY_NS));
+                } else {
+                    trace_sdcard_inquiry_cmd41();
+                    if (!timer_pending(sd->ocr_power_timer)) {
+                        timer_mod_ns(sd->ocr_power_timer,
+                                     (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
+                                      + OCR_POWER_DELAY_NS));
+                    }
                 }
             }
 
@@ -XXX,XX +XXX,XX @@ void sd_write_data(SDState *sd, uint8_t value)
     if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
         return;
 
+    trace_sdcard_write_data(sd->current_cmd, value);
     switch (sd->current_cmd) {
     case 24:	/* CMD24:  WRITE_SINGLE_BLOCK */
         sd->data[sd->data_offset ++] = value;
@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
 
     io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len;
 
+    trace_sdcard_read_data(sd->current_cmd, io_len);
     switch (sd->current_cmd) {
     case 6:	/* CMD6:   SWITCH_FUNCTION */
         ret = sd->data[sd->data_offset ++];
diff --git a/hw/sd/trace-events b/hw/sd/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/trace-events
+++ b/hw/sd/trace-events
@@ -XXX,XX +XXX,XX @@ sdhci_capareg(const char *desc, uint16_t val) "%s: %u"
 sdcard_normal_command(uint8_t cmd, uint32_t arg, const char *state) "CMD%d arg 0x%08x (state %s)"
 sdcard_app_command(uint8_t acmd, uint32_t arg) "ACMD%d arg 0x%08x"
 sdcard_response(const char *rspdesc, int rsplen) "%s (sz:%d)"
+sdcard_powerup(void) ""
+sdcard_inquiry_cmd41(void) ""
+sdcard_set_enable(bool current_state, bool new_state) "%u -> %u"
+sdcard_reset(void) ""
+sdcard_set_blocklen(uint16_t length) "0x%04x"
+sdcard_inserted(bool readonly) "read_only: %u"
+sdcard_ejected(void) ""
+sdcard_erase(void) ""
+sdcard_lock(void) ""
+sdcard_unlock(void) ""
 sdcard_read_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
 sdcard_write_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"
+sdcard_write_data(uint8_t cmd, uint8_t value) "CMD%02d value 0x%02x"
+sdcard_read_data(uint8_t cmd, int length) "CMD%02d len %d"
+sdcard_set_voltage(uint16_t millivolts) "%u mV"
 
 # hw/sd/milkymist-memcard.c
 milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215220540.6556-8-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdmmc-internal.h | 15 +++++++++++++++
 hw/sd/sd.c             | 22 ++++++++++++++++------
 2 files changed, 31 insertions(+), 6 deletions(-)
 create mode 100644 hw/sd/sdmmc-internal.h

diff --git a/hw/sd/sdmmc-internal.h b/hw/sd/sdmmc-internal.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/sd/sdmmc-internal.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * SD/MMC cards common
+ *
+ * Copyright (c) 2018  Philippe Mathieu-Daudé <f4bug@amsat.org>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#ifndef SD_INTERNAL_H
+#define SD_INTERNAL_H
+
+#define SDMMC_CMD_MAX 64
+
+#endif
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "qemu/timer.h"
 #include "qemu/log.h"
+#include "sdmmc-internal.h"
 #include "trace.h"
 
 //#define DEBUG_SD 1
@@ -XXX,XX +XXX,XX @@ static void sd_set_mode(SDState *sd)
     }
 }
 
-static const sd_cmd_type_t sd_cmd_type[64] = {
+static const sd_cmd_type_t sd_cmd_type[SDMMC_CMD_MAX] = {
     sd_bc,   sd_none, sd_bcr,  sd_bcr,  sd_none, sd_none, sd_none, sd_ac,
     sd_bcr,  sd_ac,   sd_ac,   sd_adtc, sd_ac,   sd_ac,   sd_none, sd_ac,
+    /* 16 */
     sd_ac,   sd_adtc, sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none,
     sd_adtc, sd_adtc, sd_adtc, sd_adtc, sd_ac,   sd_ac,   sd_adtc, sd_none,
+    /* 32 */
     sd_ac,   sd_ac,   sd_none, sd_none, sd_none, sd_none, sd_ac,   sd_none,
     sd_none, sd_none, sd_bc,   sd_none, sd_none, sd_none, sd_none, sd_none,
+    /* 48 */
     sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_ac,
     sd_adtc, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none, sd_none,
 };
 
-static const int sd_cmd_class[64] = {
+static const int sd_cmd_class[SDMMC_CMD_MAX] = {
     0,  0,  0,  0,  0,  9, 10,  0,  0,  0,  0,  1,  0,  0,  0,  0,
     2,  2,  2,  2,  3,  3,  3,  3,  4,  4,  4,  4,  6,  6,  6,  6,
     5,  5, 10, 10, 10, 10,  5,  9,  9,  9,  7,  7,  7,  7,  7,  7,
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
     /* Not interpreting this as an app command */
     sd->card_status &= ~APP_CMD;
 
-    if (sd_cmd_type[req.cmd & 0x3F] == sd_ac
-        || sd_cmd_type[req.cmd & 0x3F] == sd_adtc) {
+    if (sd_cmd_type[req.cmd] == sd_ac
+        || sd_cmd_type[req.cmd] == sd_adtc) {
         rca = req.arg >> 16;
     }
 
@@ -XXX,XX +XXX,XX @@ static int cmd_valid_while_locked(SDState *sd, SDRequest *req)
     if (req->cmd == 16 || req->cmd == 55) {
         return 1;
     }
-    return sd_cmd_class[req->cmd & 0x3F] == 0
-            || sd_cmd_class[req->cmd & 0x3F] == 7;
+    return sd_cmd_class[req->cmd] == 0
+            || sd_cmd_class[req->cmd] == 7;
 }
 
 int sd_do_command(SDState *sd, SDRequest *req,
@@ -XXX,XX +XXX,XX @@ int sd_do_command(SDState *sd, SDRequest *req,
         goto send_response;
     }
 
+    if (req->cmd >= SDMMC_CMD_MAX) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SD: incorrect command 0x%02x\n",
+                      req->cmd);
+        req->cmd &= 0x3f;
+    }
+
     if (sd->card_status & CARD_IS_LOCKED) {
         if (!cmd_valid_while_locked(sd, req)) {
             sd->card_status |= ILLEGAL_COMMAND;
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

code is now easier to read.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215220540.6556-11-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sd/sd.h"
 #include "qapi/error.h"
 #include "qemu/bitmap.h"
+#include "qemu/cutils.h"
 #include "hw/qdev-properties.h"
 #include "qemu/error-report.h"
 #include "qemu/timer.h"
@@ -XXX,XX +XXX,XX @@ static void sd_set_csd(SDState *sd, uint64_t size)
     uint32_t sectsize = (1 << (SECTOR_SHIFT + 1)) - 1;
     uint32_t wpsize = (1 << (WPGROUP_SHIFT + 1)) - 1;
 
-    if (size <= 0x40000000) {	/* Standard Capacity SD */
+    if (size <= 1 * G_BYTE) { /* Standard Capacity SD */
         sd->csd[0] = 0x00;	/* CSD structure */
         sd->csd[1] = 0x26;	/* Data read access-time-1 */
         sd->csd[2] = 0x00;	/* Data read access-time-2 */
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215220540.6556-12-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sd.h |  1 -
 hw/sd/sd.c         | 21 +++++++++++++--------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sd.h
+++ b/include/hw/sd/sd.h
@@ -XXX,XX +XXX,XX @@
 #define READY_FOR_DATA		(1 << 8)
 #define APP_CMD			(1 << 5)
 #define AKE_SEQ_ERROR		(1 << 3)
-#define OCR_CCS_BITN        30
 
 typedef enum {
     SD_VOLTAGE_0_4V     = 400,  /* currently not supported */
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/qdev.h"
 #include "hw/hw.h"
+#include "hw/registerfields.h"
 #include "sysemu/block-backend.h"
 #include "hw/sd/sd.h"
 #include "qapi/error.h"
@@ -XXX,XX +XXX,XX @@
 //#define DEBUG_SD 1
 
 #define ACMD41_ENQUIRY_MASK     0x00ffffff
-#define OCR_POWER_UP            0x80000000
-#define OCR_POWER_DELAY_NS      500000 /* 0.5ms */
 
 typedef enum {
     sd_r0 = 0,    /* no response */
@@ -XXX,XX +XXX,XX @@ static uint16_t sd_crc16(void *message, size_t width)
     return shift_reg;
 }
 
+#define OCR_POWER_DELAY_NS      500000 /* 0.5ms */
+
+FIELD(OCR, CARD_CAPACITY,              30,  1) /* 0:SDSC, 1:SDHC/SDXC */
+FIELD(OCR, CARD_POWER_UP,              31,  1)
+
 static void sd_set_ocr(SDState *sd)
 {
     /* All voltages OK, Standard Capacity SD Memory Card, not yet powered up */
@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
     SDState *sd = opaque;
 
     trace_sdcard_powerup();
-    /* Set powered up bit in OCR */
-    assert(!(sd->ocr & OCR_POWER_UP));
-    sd->ocr |= OCR_POWER_UP;
+    assert(!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP));
+
+    /* card power-up OK */
+    sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_POWER_UP, 1);
 }
 
 static void sd_set_scr(SDState *sd)
@@ -XXX,XX +XXX,XX @@ static bool sd_ocr_vmstate_needed(void *opaque)
     SDState *sd = opaque;
 
     /* Include the OCR state (and timer) if it is not yet powered up */
-    return !(sd->ocr & OCR_POWER_UP);
+    return !FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP);
 }
 
 static const VMStateDescription sd_ocr_vmstate = {
@@ -XXX,XX +XXX,XX @@ static void sd_erase(SDState *sd)
         return;
     }
 
-    if (extract32(sd->ocr, OCR_CCS_BITN, 1)) {
+    if (FIELD_EX32(sd->ocr, OCR, CARD_CAPACITY)) {
         /* High capacity memory card: erase units are 512 byte blocks */
         erase_start *= 512;
         erase_end *= 512;
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
              * UEFI, which sends an initial enquiry ACMD41, but
              * assumes that the card is in ready state as soon as it
              * sees the power up bit set. */
-            if (!(sd->ocr & OCR_POWER_UP)) {
+            if (!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP)) {
                 if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
                     timer_del(sd->ocr_power_timer);
                     sd_ocr_powerup(sd);
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Don't set the high capacity bit by default as it will be set if required
in the sd_set_csd() function.

[based on a patch from Alistair Francis <alistair.francis@xilinx.com>
 and Peter Ogden <ogden@xilinx.com> from qemu/xilinx tag xilinx-v2015.4]
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
 
     /* card power-up OK */
     sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_POWER_UP, 1);
+
+    if (sd->size > 1 * G_BYTE) {
+        sd->ocr = FIELD_DP32(sd->ocr, OCR, CARD_CAPACITY, 1);
+    }
 }
 
 static void sd_set_scr(SDState *sd)
@@ -XXX,XX +XXX,XX @@ static void sd_set_csd(SDState *sd, uint64_t size)
         sd->csd[13] = 0x40;
         sd->csd[14] = 0x00;
         sd->csd[15] = 0x00;
-        sd->ocr |= 1 << 30;     /* High Capacity SD Memory Card */
     }
 }
 
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_set_csd(SDState *sd, uint64_t size)
         sd->csd[13] = 0x20 |	/* Max. write data block length */
             ((HWBLOCK_SHIFT << 6) & 0xc0);
         sd->csd[14] = 0x00;	/* File format group */
-        sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
     } else {			/* SDHC */
         size /= 512 * 1024;
         size -= 1;
@@ -XXX,XX +XXX,XX @@ static void sd_set_csd(SDState *sd, uint64_t size)
         sd->csd[12] = 0x0a;
         sd->csd[13] = 0x40;
         sd->csd[14] = 0x00;
-        sd->csd[15] = 0x00;
     }
+    sd->csd[15] = (sd_crc7(sd->csd, 15) << 1) | 1;
 }
 
 static void sd_set_rca(SDState *sd)
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

To comply with Spec v1.10 (and 2.00, 3.01):

. TRAN_SPEED

for current SD Memory Cards that field must be always 0_0110_010b (032h) which is
equal to 25MHz - the mandatory maximum operating frequency of SD Memory Card.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-4-f4bug@amsat.org
[PMM: fixed comment indent]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_set_csd(SDState *sd, uint64_t size)
         sd->csd[0] = 0x00;	/* CSD structure */
         sd->csd[1] = 0x26;	/* Data read access-time-1 */
         sd->csd[2] = 0x00;	/* Data read access-time-2 */
-        sd->csd[3] = 0x5a;	/* Max. data transfer rate */
+        sd->csd[3] = 0x32;      /* Max. data transfer rate: 25 MHz */
         sd->csd[4] = 0x5f;	/* Card Command Classes */
         sd->csd[5] = 0x50 |	/* Max. read data block length */
             HWBLOCK_SHIFT;
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
 
 static void sd_set_scr(SDState *sd)
 {
-    sd->scr[0] = 0x00;		/* SCR Structure */
-    sd->scr[1] = 0x2f;		/* SD Security Support */
-    sd->scr[2] = 0x00;
+    sd->scr[0] = (0 << 4)       /* SCR version 1.0 */
+                 | 0;           /* Spec Versions 1.0 and 1.01 */
+    sd->scr[1] = (2 << 4)       /* SDSC Card (Security Version 1.01) */
+                 | 0b0101;      /* 1-bit or 4-bit width bus modes */
+    sd->scr[2] = 0x00;          /* Extended Security is not supported. */
     sd->scr[3] = 0x00;
+    /* reserved for manufacturer usage */
     sd->scr[4] = 0x00;
     sd->scr[5] = 0x00;
     sd->scr[6] = 0x00;
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

This device does not model MMCA Specification previous to v4.2

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-6-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 33 ---------------------------------
 1 file changed, 33 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         }
         break;
 
-    case 11:	/* CMD11:  READ_DAT_UNTIL_STOP */
-        if (sd->spi)
-            goto bad_cmd;
-        switch (sd->state) {
-        case sd_transfer_state:
-            sd->state = sd_sendingdata_state;
-            sd->data_start = req.arg;
-            sd->data_offset = 0;
-
-            if (sd->data_start + sd->blk_len > sd->size)
-                sd->card_status |= ADDRESS_ERROR;
-            return sd_r0;
-
-        default:
-            break;
-        }
-        break;
-
     case 12:	/* CMD12:  STOP_TRANSMISSION */
         switch (sd->state) {
         case sd_sendingdata_state:
@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
             sd->state = sd_transfer_state;
         break;
 
-    case 11:	/* CMD11:  READ_DAT_UNTIL_STOP */
-        if (sd->data_offset == 0)
-            BLK_READ_BLOCK(sd->data_start, io_len);
-        ret = sd->data[sd->data_offset ++];
-
-        if (sd->data_offset >= io_len) {
-            sd->data_start += io_len;
-            sd->data_offset = 0;
-            if (sd->data_start + io_len > sd->size) {
-                sd->card_status |= ADDRESS_ERROR;
-                break;
-            }
-        }
-        break;
-
     case 13:	/* ACMD13: SD_STATUS */
         ret = sd->sd_status[sd->data_offset ++];
 
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

the code is easier to review/refactor.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-7-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 38 +++++++++-----------------------------
 1 file changed, 9 insertions(+), 29 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static int sd_req_crc_validate(SDRequest *req)
 {
     uint8_t buffer[5];
     buffer[0] = 0x40 | req->cmd;
-    buffer[1] = (req->arg >> 24) & 0xff;
-    buffer[2] = (req->arg >> 16) & 0xff;
-    buffer[3] = (req->arg >> 8) & 0xff;
-    buffer[4] = (req->arg >> 0) & 0xff;
+    stl_be_p(&buffer[1], req->arg);
     return 0;
     return sd_crc7(buffer, 5) != req->crc;	/* TODO */
 }
 
 static void sd_response_r1_make(SDState *sd, uint8_t *response)
 {
-    uint32_t status = sd->card_status;
+    stl_be_p(response, sd->card_status);
+
     /* Clear the "clear on read" status bits */
     sd->card_status &= ~CARD_STATUS_C;
-
-    response[0] = (status >> 24) & 0xff;
-    response[1] = (status >> 16) & 0xff;
-    response[2] = (status >> 8) & 0xff;
-    response[3] = (status >> 0) & 0xff;
 }
 
 static void sd_response_r3_make(SDState *sd, uint8_t *response)
 {
-    response[0] = (sd->ocr >> 24) & 0xff;
-    response[1] = (sd->ocr >> 16) & 0xff;
-    response[2] = (sd->ocr >> 8) & 0xff;
-    response[3] = (sd->ocr >> 0) & 0xff;
+    stl_be_p(response, sd->ocr);
 }
 
 static void sd_response_r6_make(SDState *sd, uint8_t *response)
 {
-    uint16_t arg;
     uint16_t status;
 
-    arg = sd->rca;
     status = ((sd->card_status >> 8) & 0xc000) |
              ((sd->card_status >> 6) & 0x2000) |
               (sd->card_status & 0x1fff);
     sd->card_status &= ~(CARD_STATUS_C & 0xc81fff);
-
-    response[0] = (arg >> 8) & 0xff;
-    response[1] = arg & 0xff;
-    response[2] = (status >> 8) & 0xff;
-    response[3] = status & 0xff;
+    stw_be_p(response + 0, sd->rca);
+    stw_be_p(response + 2, status);
 }
 
 static void sd_response_r7_make(SDState *sd, uint8_t *response)
 {
-    response[0] = (sd->vhs >> 24) & 0xff;
-    response[1] = (sd->vhs >> 16) & 0xff;
-    response[2] = (sd->vhs >>  8) & 0xff;
-    response[3] = (sd->vhs >>  0) & 0xff;
+    stl_be_p(response, sd->vhs);
 }
 
 static inline uint64_t sd_addr_to_wpnum(uint64_t addr)
@@ -XXX,XX +XXX,XX @@ static uint32_t sd_wpbits(SDState *sd, uint64_t addr)
 
 static void sd_function_switch(SDState *sd, uint32_t arg)
 {
-    int i, mode, new_func, crc;
+    int i, mode, new_func;
     mode = !!(arg & 0x80000000);
 
     sd->data[0] = 0x00;		/* Maximum current consumption */
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    crc = sd_crc16(sd->data, 64);
-    sd->data[65] = crc >> 8;
-    sd->data[66] = crc & 0xff;
+    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

use the registerfields API to access the OCR register

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-8-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@
 
 //#define DEBUG_SD 1
 
-#define ACMD41_ENQUIRY_MASK     0x00ffffff
-
 typedef enum {
     sd_r0 = 0,    /* no response */
     sd_r1,        /* normal response command */
@@ -XXX,XX +XXX,XX @@ static uint16_t sd_crc16(void *message, size_t width)
 
 #define OCR_POWER_DELAY_NS      500000 /* 0.5ms */
 
+FIELD(OCR, VDD_VOLTAGE_WINDOW,          0, 24)
+FIELD(OCR, VDD_VOLTAGE_WIN_LO,          0,  8)
+FIELD(OCR, DUAL_VOLTAGE_CARD,           7,  1)
+FIELD(OCR, VDD_VOLTAGE_WIN_HI,          8, 16)
+FIELD(OCR, ACCEPT_SWITCH_1V8,          24,  1) /* Only UHS-I */
+FIELD(OCR, UHS_II_CARD,                29,  1) /* Only UHS-II */
 FIELD(OCR, CARD_CAPACITY,              30,  1) /* 0:SDSC, 1:SDHC/SDXC */
 FIELD(OCR, CARD_POWER_UP,              31,  1)
 
+#define ACMD41_ENQUIRY_MASK     0x00ffffff
+#define ACMD41_R3_MASK          (R_OCR_VDD_VOLTAGE_WIN_HI_MASK \
+                               | R_OCR_ACCEPT_SWITCH_1V8_MASK \
+                               | R_OCR_UHS_II_CARD_MASK \
+                               | R_OCR_CARD_CAPACITY_MASK \
+                               | R_OCR_CARD_POWER_UP_MASK)
+
 static void sd_set_ocr(SDState *sd)
 {
-    /* All voltages OK, Standard Capacity SD Memory Card, not yet powered up */
-    sd->ocr = 0x00ffff00;
+    /* All voltages OK */
+    sd->ocr = R_OCR_VDD_VOLTAGE_WIN_HI_MASK;
 }
 
 static void sd_ocr_powerup(void *opaque)
@@ -XXX,XX +XXX,XX @@ static void sd_response_r1_make(SDState *sd, uint8_t *response)
 
 static void sd_response_r3_make(SDState *sd, uint8_t *response)
 {
-    stl_be_p(response, sd->ocr);
+    stl_be_p(response, sd->ocr & ACMD41_R3_MASK);
 }
 
 static void sd_response_r6_make(SDState *sd, uint8_t *response)
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-9-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 48 +++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 45 insertions(+), 3 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_set_rca(SDState *sd)
     sd->rca += 0x4567;
 }
 
+FIELD(CSR, AKE_SEQ_ERROR,               3,  1)
+FIELD(CSR, APP_CMD,                     5,  1)
+FIELD(CSR, FX_EVENT,                    6,  1)
+FIELD(CSR, READY_FOR_DATA,              8,  1)
+FIELD(CSR, CURRENT_STATE,               9,  4)
+FIELD(CSR, ERASE_RESET,                13,  1)
+FIELD(CSR, CARD_ECC_DISABLED,          14,  1)
+FIELD(CSR, WP_ERASE_SKIP,              15,  1)
+FIELD(CSR, CSD_OVERWRITE,              16,  1)
+FIELD(CSR, DEFERRED_RESPONSE,          17,  1)
+FIELD(CSR, ERROR,                      19,  1)
+FIELD(CSR, CC_ERROR,                   20,  1)
+FIELD(CSR, CARD_ECC_FAILED,            21,  1)
+FIELD(CSR, ILLEGAL_COMMAND,            22,  1)
+FIELD(CSR, COM_CRC_ERROR,              23,  1)
+FIELD(CSR, LOCK_UNLOCK_FAILED,         24,  1)
+FIELD(CSR, CARD_IS_LOCKED,             25,  1)
+FIELD(CSR, WP_VIOLATION,               26,  1)
+FIELD(CSR, ERASE_PARAM,                27,  1)
+FIELD(CSR, ERASE_SEQ_ERROR,            28,  1)
+FIELD(CSR, BLOCK_LEN_ERROR,            29,  1)
+FIELD(CSR, ADDRESS_ERROR,              30,  1)
+FIELD(CSR, OUT_OF_RANGE,               31,  1)
+
 /* Card status bits, split by clear condition:
  * A : According to the card current state
  * B : Always related to the previous command
  * C : Cleared by read
  */
-#define CARD_STATUS_A	0x02004100
-#define CARD_STATUS_B	0x00c01e00
-#define CARD_STATUS_C	0xfd39a028
+#define CARD_STATUS_A           (R_CSR_READY_FOR_DATA_MASK \
+                               | R_CSR_CARD_ECC_DISABLED_MASK \
+                               | R_CSR_CARD_IS_LOCKED_MASK)
+#define CARD_STATUS_B           (R_CSR_CURRENT_STATE_MASK \
+                               | R_CSR_ILLEGAL_COMMAND_MASK \
+                               | R_CSR_COM_CRC_ERROR_MASK)
+#define CARD_STATUS_C           (R_CSR_AKE_SEQ_ERROR_MASK \
+                               | R_CSR_APP_CMD_MASK \
+                               | R_CSR_ERASE_RESET_MASK \
+                               | R_CSR_WP_ERASE_SKIP_MASK \
+                               | R_CSR_CSD_OVERWRITE_MASK \
+                               | R_CSR_ERROR_MASK \
+                               | R_CSR_CC_ERROR_MASK \
+                               | R_CSR_CARD_ECC_FAILED_MASK \
+                               | R_CSR_LOCK_UNLOCK_FAILED_MASK \
+                               | R_CSR_WP_VIOLATION_MASK \
+                               | R_CSR_ERASE_PARAM_MASK \
+                               | R_CSR_ERASE_SEQ_ERROR_MASK \
+                               | R_CSR_BLOCK_LEN_ERROR_MASK \
+                               | R_CSR_ADDRESS_ERROR_MASK \
+                               | R_CSR_OUT_OF_RANGE_MASK)
 
 static void sd_set_cardstatus(SDState *sd)
 {
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

returning sd_illegal, since they are not implemented.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-11-f4bug@amsat.org
[PMM: tweak multiline comment format]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
         }
         break;
 
+    case 18:    /* Reserved for SD security applications */
+    case 25:
+    case 26:
+    case 38:
+    case 43 ... 49:
+        /* Refer to the "SD Specifications Part3 Security Specification" for
+         * information about the SD Security Features.
+         */
+        qemu_log_mask(LOG_UNIMP, "SD: CMD%i Security not implemented\n",
+                      req.cmd);
+        return sd_illegal;
+
     default:
         /* Fall back to standard commands.  */
         return sd_normal_command(sd, req);
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Suggested-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-12-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
 
     /* Block write commands (Class 4) */
     case 24:	/* CMD24:  WRITE_SINGLE_BLOCK */
-        if (sd->spi)
-            goto unimplemented_cmd;
+        if (sd->spi) {
+            goto unimplemented_spi_cmd;
+        }
         switch (sd->state) {
         case sd_transfer_state:
             /* Writing in SPI mode not implemented.  */
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         break;
 
     case 25:	/* CMD25:  WRITE_MULTIPLE_BLOCK */
-        if (sd->spi)
-            goto unimplemented_cmd;
+        if (sd->spi) {
+            goto unimplemented_spi_cmd;
+        }
         switch (sd->state) {
         case sd_transfer_state:
             /* Writing in SPI mode not implemented.  */
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         break;
 
     case 27:	/* CMD27:  PROGRAM_CSD */
-        if (sd->spi)
-            goto unimplemented_cmd;
+        if (sd->spi) {
+            goto unimplemented_spi_cmd;
+        }
         switch (sd->state) {
         case sd_transfer_state:
             sd->state = sd_receivingdata_state;
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
 
     /* Lock card commands (Class 7) */
     case 42:	/* CMD42:  LOCK_UNLOCK */
-        if (sd->spi)
-            goto unimplemented_cmd;
+        if (sd->spi) {
+            goto unimplemented_spi_cmd;
+        }
         switch (sd->state) {
         case sd_transfer_state:
             sd->state = sd_receivingdata_state;
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
         return sd_illegal;
 
-    unimplemented_cmd:
+    unimplemented_spi_cmd:
         /* Commands that are recognised but not yet implemented in SPI mode.  */
         qemu_log_mask(LOG_UNIMP, "SD: CMD%i not implemented in SPI mode\n",
                       req.cmd);
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-13-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
 
     /* Application specific commands (Class 8) */
     case 55:	/* CMD55:  APP_CMD */
-        if (sd->rca != rca)
-            return sd_r0;
-
+        if (!sd->spi) {
+            if (sd->rca != rca) {
+                return sd_r0;
+            }
+        }
         sd->expecting_acmd = true;
         sd->card_status |= APP_CMD;
         return sd_r1;
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
         }
         break;
 
+    case 58:    /* CMD58:   READ_OCR (SPI) */
+        if (!sd->spi) {
+            goto bad_cmd;
+        }
+        return sd_r3;
+
+    case 59:    /* CMD59:   CRC_ON_OFF (SPI) */
+        if (!sd->spi) {
+            goto bad_cmd;
+        }
+        goto unimplemented_spi_cmd;
+
     default:
     bad_cmd:
         qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd);
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
     sd->card_status |= APP_CMD;
     switch (req.cmd) {
     case 6:	/* ACMD6:  SET_BUS_WIDTH */
+        if (sd->spi) {
+            goto unimplemented_spi_cmd;
+        }
         switch (sd->state) {
         case sd_transfer_state:
             sd->sd_status[0] &= 0x3f;
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
     default:
         /* Fall back to standard commands.  */
         return sd_normal_command(sd, req);
+
+    unimplemented_spi_cmd:
+        /* Commands that are recognised but not yet implemented in SPI mode.  */
+        qemu_log_mask(LOG_UNIMP, "SD: CMD%i not implemented in SPI mode\n",
+                      req.cmd);
+        return sd_illegal;
     }
 
     qemu_log_mask(LOG_GUEST_ERROR, "SD: ACMD%i in a wrong state\n", req.cmd);
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

replace switch(single case) -> if()

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-16-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,
 
     case 8:	/* CMD8:   SEND_IF_COND */
         /* Physical Layer Specification Version 2.00 command */
-        switch (sd->state) {
-        case sd_idle_state:
-            sd->vhs = 0;
-
-            /* No response if not exactly one VHS bit is set.  */
-            if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
-                return sd->spi ? sd_r7 : sd_r0;
-            }
-
-            /* Accept.  */
-            sd->vhs = req.arg;
-            return sd_r7;
-
-        default:
+        if (sd->state != sd_idle_state) {
             break;
         }
-        break;
+        sd->vhs = 0;
+
+        /* No response if not exactly one VHS bit is set.  */
+        if (!(req.arg >> 8) || (req.arg >> (ctz32(req.arg & ~0xff) + 1))) {
+            return sd->spi ? sd_r7 : sd_r0;
+        }
+
+        /* Accept.  */
+        sd->vhs = req.arg;
+        return sd_r7;
 
     case 9:	/* CMD9:   SEND_CSD */
         switch (sd->state) {
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

replace switch(single case) -> if()

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180215221325.7611-17-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 56 ++++++++++++++++++++++++++------------------------------
 1 file changed, 26 insertions(+), 30 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,
             sd->state = sd_transfer_state;
             return sd_r1;
         }
-        switch (sd->state) {
-        case sd_idle_state:
-            /* If it's the first ACMD41 since reset, we need to decide
-             * whether to power up. If this is not an enquiry ACMD41,
-             * we immediately report power on and proceed below to the
-             * ready state, but if it is, we set a timer to model a
-             * delay for power up. This works around a bug in EDK2
-             * UEFI, which sends an initial enquiry ACMD41, but
-             * assumes that the card is in ready state as soon as it
-             * sees the power up bit set. */
-            if (!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP)) {
-                if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
-                    timer_del(sd->ocr_power_timer);
-                    sd_ocr_powerup(sd);
-                } else {
-                    trace_sdcard_inquiry_cmd41();
-                    if (!timer_pending(sd->ocr_power_timer)) {
-                        timer_mod_ns(sd->ocr_power_timer,
-                                     (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
-                                      + OCR_POWER_DELAY_NS));
-                    }
+        if (sd->state != sd_idle_state) {
+            break;
+        }
+        /* If it's the first ACMD41 since reset, we need to decide
+         * whether to power up. If this is not an enquiry ACMD41,
+         * we immediately report power on and proceed below to the
+         * ready state, but if it is, we set a timer to model a
+         * delay for power up. This works around a bug in EDK2
+         * UEFI, which sends an initial enquiry ACMD41, but
+         * assumes that the card is in ready state as soon as it
+         * sees the power up bit set. */
+        if (!FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP)) {
+            if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {
+                timer_del(sd->ocr_power_timer);
+                sd_ocr_powerup(sd);
+            } else {
+                trace_sdcard_inquiry_cmd41();
+                if (!timer_pending(sd->ocr_power_timer)) {
+                    timer_mod_ns(sd->ocr_power_timer,
+                                 (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)
+                                  + OCR_POWER_DELAY_NS));
                 }
             }
+        }
 
+        if (FIELD_EX32(sd->ocr & req.arg, OCR, VDD_VOLTAGE_WINDOW)) {
             /* We accept any voltage.  10000 V is nothing.
              *
              * Once we're powered up, we advance straight to ready state
              * unless it's an enquiry ACMD41 (bits 23:0 == 0).
              */
-            if (req.arg & ACMD41_ENQUIRY_MASK) {
-                sd->state = sd_ready_state;
-            }
-
-            return sd_r3;
-
-        default:
-            break;
+            sd->state = sd_ready_state;
         }
-        break;
+
+        return sd_r3;
 
     case 42:	/* ACMD42: SET_CLR_CARD_DETECT */
         switch (sd->state) {
-- 
2.16.1