Latest run of arm patches -- most of these are Philippe's SD card

cleanups. I have more in my queue to review, but 32 is enough

patches to warrant sending out.

The following changes since commit ff8689611a1d954897d857b28f7ef404e11cfa2c:

Merge remote-tracking branch 'remotes/mcayland/tags/qemu-openbios-signed' into staging (2018-02-22 11:37:05 +0000)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180222

for you to fetch changes up to 4e5cc6756586e967993187657dfcdde4e00288d9:

sdcard: simplify SD_SEND_OP_COND (ACMD41) (2018-02-22 15:12:54 +0000)

* New "raspi3" machine emulating RaspberryPi 3

* Fix bad register definitions for VMIDR and VMPIDR (which caused

assertions for 64-bit guest CPUs with EL2 on big-endian hosts)

* hw/char/stm32f2xx_usart: fix TXE/TC bit handling

* Fix ast2500 protection register emulation

* Lots of SD card emulation cleanups and bugfixes

Hugo Landau (1):

Fix ast2500 protection register emulation

Pekka Enberg (1):

raspi: Add "raspi3" machine type

Peter Maydell (1):

target/arm: Fix register definitions for VMIDR and VMPIDR

Philippe Mathieu-Daudé (28):

hw/sd/milkymist-memcard: use qemu_log_mask()

hw/sd/milkymist-memcard: split realize() out of SysBusDevice init()

hw/sd/milkymist-memcard: expose a SDBus and connect the SDCard to it

hw/sd/ssi-sd: use the SDBus API, connect the SDCard to the bus

sdcard: reorder SDState struct members

sdcard: replace DPRINTF() by trace events

sdcard: add a trace event for command responses

sdcard: replace fprintf() by qemu_hexdump()

sdcard: add more trace events

sdcard: define SDMMC_CMD_MAX instead of using the magic '64'

sdcard: use G_BYTE from cutils

sdcard: use the registerfields API to access the OCR register

sdcard: Don't always set the high capacity bit

sdcard: update the CSD CRC register regardless the CSD structure version

sdcard: fix the 'maximum data transfer rate' to 25MHz

sdcard: clean the SCR register and add few comments

sdcard: remove commands from unsupported old MMC specification

sdcard: simplify using the ldst API

sdcard: use the correct masked OCR in the R3 reply

sdcard: use the registerfields API for the CARD_STATUS register masks

sdcard: handle CMD54 (SDIO)

sdcard: handle the Security Specification commands

sdcard: use a more descriptive label 'unimplemented_spi_cmd'

sdcard: handles more commands in SPI mode

sdcard: check the card is in correct state for APP CMD (CMD55)

sdcard: warn if host uses an incorrect address for APP CMD (CMD55)

sdcard: simplify SEND_IF_COND (CMD8)

sdcard: simplify SD_SEND_OP_COND (ACMD41)

Richard Braun (1):

hw/char/stm32f2xx_usart: fix TXE/TC bit handling

hw/sd/sdmmc-internal.h | 15 ++

include/hw/char/stm32f2xx_usart.h | 7 +-

include/hw/sd/sd.h | 1 -

hw/arm/raspi.c | 23 ++

hw/char/stm32f2xx_usart.c | 12 +-

hw/misc/aspeed_scu.c | 6 +-

hw/misc/aspeed_sdmc.c | 8 +-

hw/sd/milkymist-memcard.c | 87 +++----

hw/sd/sd.c | 467 +++++++++++++++++++++++---------------

hw/sd/ssi-sd.c | 32 +--

target/arm/helper.c | 8 +-

hw/sd/trace-events | 20 ++

12 files changed, 446 insertions(+), 240 deletions(-)

create mode 100644 hw/sd/sdmmc-internal.h

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>

Acked-by: Michael Walle <michael@walle.cc>

Message-id: 20180216022933.10945-2-f4bug@amsat.org

hw/sd/milkymist-memcard.c | 17 ++++++++++-------

1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c

--- a/hw/sd/milkymist-memcard.c

+++ b/hw/sd/milkymist-memcard.c

@@ -XXX,XX +XXX,XX @@

*/

#include "qemu/osdep.h"

+#include "qemu/log.h"

#include "hw/hw.h"

#include "hw/sysbus.h"

#include "sysemu/sysemu.h"

#include "trace.h"

-#include "qemu/error-report.h"

+#include "include/qapi/error.h"

#include "sysemu/block-backend.h"

#include "sysemu/blockdev.h"

#include "hw/sd/sd.h"

@@ -XXX,XX +XXX,XX @@ static uint64_t memcard_read(void *opaque, hwaddr addr,

} else {

r = s->response[s->response_read_ptr++];

if (s->response_read_ptr > s->response_len) {

- error_report("milkymist_memcard: "

- "read more cmd bytes than available. Clipping.");

+ qemu_log_mask(LOG_GUEST_ERROR, "milkymist_memcard: "

+ "read more cmd bytes than available. Clipping.");

s->response_read_ptr = 0;

}

@@ -XXX,XX +XXX,XX @@ static void memcard_write(void *opaque, hwaddr addr, uint64_t value,

break;

default:

- error_report("milkymist_memcard: write access to unknown register 0x"

- TARGET_FMT_plx, addr << 2);

+ qemu_log_mask(LOG_UNIMP, "milkymist_memcard: "

+ "write access to unknown register 0x%" HWADDR_PRIx " "

+ "(value 0x%" PRIx64 ")\n", addr << 2, value);

break;

}

}

2.16.1

From: Hugo Landau <hlandau@devever.net>

Some register blocks of the ast2500 are protected by protection key

registers which require the right magic value to be written to those

registers to allow those registers to be mutated.

Register manuals indicate that writing the correct magic value to these

registers should cause subsequent reads from those values to return 1,

and writing any other value should cause subsequent reads to return 0.

Previously, qemu implemented these registers incorrectly: the registers

were handled as simple memory, meaning that writing some value x to a

protection key register would result in subsequent reads from that

register returning the same value x. The protection was implemented by

ensuring that the current value of that register equaled the magic

value.

This modifies qemu to have the correct behaviour: attempts to write to a

ast2500 protection register results in a transition to 1 or 0 depending

on whether the written value is the correct magic. The protection logic

is updated to ensure that the value of the register is nonzero.

This bug caused deadlocks with u-boot HEAD: when u-boot is done with a

protectable register block, it attempts to lock it by writing the

bitwise inverse of the correct magic value, and then spinning forever

until the register reads as zero. Since qemu implemented writes to these

registers as ordinary memory writes, writing the inverse of the magic

value resulted in subsequent reads returning that value, leading to

u-boot spinning forever.

Signed-off-by: Hugo Landau <hlandau@devever.net>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Acked-by: Andrew Jeffery <andrew@aj.id.au>

Message-id: 20180220132627.4163-1-hlandau@devever.net

[PMM: fixed incorrect code indentation]

hw/misc/aspeed_scu.c | 6 +++++-

hw/misc/aspeed_sdmc.c | 8 +++++++-

2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c

--- a/hw/misc/aspeed_scu.c

+++ b/hw/misc/aspeed_scu.c

@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,

}

if (reg > PROT_KEY && reg < CPU2_BASE_SEG1 &&

- s->regs[PROT_KEY] != ASPEED_SCU_PROT_KEY) {

+ !s->regs[PROT_KEY]) {

qemu_log_mask(LOG_GUEST_ERROR, "%s: SCU is locked!\n", __func__);

return;

}

@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,

trace_aspeed_scu_write(offset, size, data);

switch (reg) {

+ case PROT_KEY:

+ s->regs[reg] = (data == ASPEED_SCU_PROT_KEY) ? 1 : 0;

+ return;

+

case FREQ_CNTR_EVAL:

case VGA_SCRATCH1 ... VGA_SCRATCH8:

case RNG_DATA:

diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/misc/aspeed_sdmc.c

+++ b/hw/misc/aspeed_sdmc.c

@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,

return;

}

- if (addr != R_PROT && s->regs[R_PROT] != PROT_KEY_UNLOCK) {

+ if (addr == R_PROT) {

+ s->regs[addr] = (data == PROT_KEY_UNLOCK) ? 1 : 0;

+ return;

+ if (!s->regs[R_PROT]) {

qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);

return;

@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,

data &= ~ASPEED_SDMC_READONLY_MASK;

break;

case AST2500_A0_SILICON_REV:

+ case AST2500_A1_SILICON_REV:

data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;

break;

default:

2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Acked-by: Alistair Francis <alistair.francis@xilinx.com>

Message-id: 20180215220540.6556-6-f4bug@amsat.org

hw/sd/sd.c | 32 ++++++++++++++++++++++++++------

hw/sd/trace-events | 13 +++++++++++++

2 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c

--- a/hw/sd/sd.c

+++ b/hw/sd/sd.c

@@ -XXX,XX +XXX,XX @@ static bool sd_get_cmd_line(SDState *sd)

static void sd_set_voltage(SDState *sd, uint16_t millivolts)

{

+ trace_sdcard_set_voltage(millivolts);

+

switch (millivolts) {

case 3001 ... 3600: /* SD_VOLTAGE_3_3V */

case 2001 ... 3000: /* SD_VOLTAGE_3_0V */

@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)

{

SDState *sd = opaque;

+ trace_sdcard_powerup();

/* Set powered up bit in OCR */

assert(!(sd->ocr & OCR_POWER_UP));

sd->ocr |= OCR_POWER_UP;

@@ -XXX,XX +XXX,XX @@ static void sd_reset(DeviceState *dev)

uint64_t size;

uint64_t sect;

+ trace_sdcard_reset();

if (sd->blk) {

blk_get_geometry(sd->blk, &sect);

} else {

@@ -XXX,XX +XXX,XX @@ static void sd_cardchange(void *opaque, bool load, Error **errp)

bool readonly = sd_get_readonly(sd);

if (inserted) {

+ trace_sdcard_inserted(readonly);

sd_reset(dev);

+ } else {

+ trace_sdcard_ejected();

/* The IRQ notification is for legacy non-QOM SD controller devices;

@@ -XXX,XX +XXX,XX @@ static void sd_erase(SDState *sd)

uint64_t erase_start = sd->erase_start;

uint64_t erase_end = sd->erase_end;

+ trace_sdcard_erase();

if (!sd->erase_start || !sd->erase_end) {

sd->card_status |= ERASE_SEQ_ERROR;

return;

@@ -XXX,XX +XXX,XX @@ static void sd_lock_command(SDState *sd)

else

pwd_len = 0;

+ if (lock) {

+ trace_sdcard_lock();

+ } else {

+ trace_sdcard_unlock();

+ }

if (erase) {

if (!(sd->card_status & CARD_IS_LOCKED) || sd->blk_len > 1 ||

set_pwd || clr_pwd || lock || sd->wp_switch ||

@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd,

case 16:    /* CMD16: SET_BLOCKLEN */

switch (sd->state) {

case sd_transfer_state:

- if (req.arg > (1 << HWBLOCK_SHIFT))

+ if (req.arg > (1 << HWBLOCK_SHIFT)) {

sd->card_status |= BLOCK_LEN_ERROR;

- else

+ } else {

+ trace_sdcard_set_blocklen(req.arg);

sd->blk_len = req.arg;

+ }

return sd_r1;

@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_app_command(SDState *sd,

if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) {

timer_del(sd->ocr_power_timer);

sd_ocr_powerup(sd);

- } else if (!timer_pending(sd->ocr_power_timer)) {

- timer_mod_ns(sd->ocr_power_timer,

- (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)

- + OCR_POWER_DELAY_NS));

+ } else {

+ trace_sdcard_inquiry_cmd41();

+ if (!timer_pending(sd->ocr_power_timer)) {

+ timer_mod_ns(sd->ocr_power_timer,

+ (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)

+ + OCR_POWER_DELAY_NS));

+ }

}

}

@@ -XXX,XX +XXX,XX @@ void sd_write_data(SDState *sd, uint8_t value)

if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))

return;

+ trace_sdcard_write_data(sd->current_cmd, value);

switch (sd->current_cmd) {

case 24:    /* CMD24: WRITE_SINGLE_BLOCK */

sd->data[sd->data_offset ++] = value;

@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)

io_len = (sd->ocr & (1 << 30)) ? 512 : sd->blk_len;

+ trace_sdcard_read_data(sd->current_cmd, io_len);

switch (sd->current_cmd) {

case 6:    /* CMD6: SWITCH_FUNCTION */

ret = sd->data[sd->data_offset ++];

diff --git a/hw/sd/trace-events b/hw/sd/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/sd/trace-events

+++ b/hw/sd/trace-events

@@ -XXX,XX +XXX,XX @@ sdhci_capareg(const char *desc, uint16_t val) "%s: %u"

sdcard_normal_command(uint8_t cmd, uint32_t arg, const char *state) "CMD%d arg 0x%08x (state %s)"

sdcard_app_command(uint8_t acmd, uint32_t arg) "ACMD%d arg 0x%08x"

sdcard_response(const char *rspdesc, int rsplen) "%s (sz:%d)"

+sdcard_powerup(void) ""

+sdcard_inquiry_cmd41(void) ""

+sdcard_set_enable(bool current_state, bool new_state) "%u -> %u"

+sdcard_reset(void) ""

+sdcard_set_blocklen(uint16_t length) "0x%04x"

+sdcard_inserted(bool readonly) "read_only: %u"

+sdcard_ejected(void) ""

+sdcard_erase(void) ""

+sdcard_lock(void) ""

+sdcard_unlock(void) ""

sdcard_read_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"

sdcard_write_block(uint64_t addr, uint32_t len) "addr 0x%" PRIx64 " size 0x%x"

+sdcard_write_data(uint8_t cmd, uint8_t value) "CMD%02d value 0x%02x"

+sdcard_read_data(uint8_t cmd, int length) "CMD%02d len %d"

+sdcard_set_voltage(uint16_t millivolts) "%u mV"

# hw/sd/milkymist-memcard.c

milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"

2.16.1