Igor Mammedov (1):

hw/arm/cubieboard: make sure SOC object isn't leaked

Niek Linnenbank (13):

hw/arm: add Allwinner H3 System-on-Chip

hw/arm: add Xunlong Orange Pi PC machine

hw/arm/allwinner-h3: add Clock Control Unit

hw/arm/allwinner-h3: add USB host controller

hw/arm/allwinner-h3: add System Control module

hw/arm/allwinner: add CPU Configuration module

hw/arm/allwinner: add Security Identifier device

hw/arm/allwinner: add SD/MMC host controller

hw/arm/allwinner-h3: add EMAC ethernet device

hw/arm/allwinner-h3: add Boot ROM support

hw/arm/allwinner-h3: add SDRAM controller device

hw/arm/allwinner: add RTC device support

docs: add Orange Pi PC document

Peter Maydell (4):

hw/intc/armv7m_nvic: Rebuild hflags on reset

target/arm: Update hflags in trans_CPS_v7m()

target/arm: Recalculate hflags correctly after writes to CONTROL

target/arm: Fix some comment typos

Philippe Mathieu-Daudé (5):

tests/boot_linux_console: Add a quick test for the OrangePi PC board

tests/boot_linux_console: Add initrd test for the Orange Pi PC board

tests/boot_linux_console: Add a SD card test for the OrangePi PC board

tests/boot_linux_console: Add a SLOW test booting Ubuntu on OrangePi PC

tests/boot_linux_console: Test booting NetBSD via U-Boot on OrangePi PC

Richard Henderson (2):

target/arm: Check addresses for disabled regimes

target/arm: Disable clean_data_tbi for system mode

Makefile.objs | 1 +

hw/arm/Makefile.objs | 1 +

hw/misc/Makefile.objs | 5 +

hw/net/Makefile.objs | 1 +

hw/rtc/Makefile.objs | 1 +

hw/sd/Makefile.objs | 1 +

hw/usb/hcd-ehci.h | 1 +

include/hw/arm/allwinner-a10.h | 4 +

include/hw/arm/allwinner-h3.h | 161 ++++++

include/hw/arm/fsl-imx25.h | 18 +

include/hw/arm/virt.h | 12 +-

include/hw/misc/allwinner-cpucfg.h | 52 ++

include/hw/misc/allwinner-h3-ccu.h | 66 +++

include/hw/misc/allwinner-h3-dramc.h | 106 ++++

include/hw/misc/allwinner-h3-sysctrl.h | 67 +++

include/hw/misc/allwinner-sid.h | 60 +++

include/hw/net/allwinner-sun8i-emac.h | 99 ++++

include/hw/rtc/allwinner-rtc.h | 134 +++++

include/hw/sd/allwinner-sdhost.h | 135 +++++

target/arm/helper.h | 1 +

target/arm/kvm_arm.h | 3 +

hw/arm/allwinner-a10.c | 19 +

hw/arm/allwinner-h3.c | 465 ++++++++++++++++++

hw/arm/cubieboard.c | 18 +

hw/arm/fsl-imx25.c | 56 +++

hw/arm/imx25_pdk.c | 16 +

hw/arm/orangepi.c | 130 +++++

hw/arm/virt.c | 145 ++++--

hw/intc/armv7m_nvic.c | 6 +

hw/misc/allwinner-cpucfg.c | 282 +++++++++++

hw/misc/allwinner-h3-ccu.c | 242 +++++++++

hw/misc/allwinner-h3-dramc.c | 358 ++++++++++++++

hw/misc/allwinner-h3-sysctrl.c | 140 ++++++

hw/misc/allwinner-sid.c | 168 +++++++

hw/net/allwinner-sun8i-emac.c | 871 +++++++++++++++++++++++++++++++++

hw/rtc/allwinner-rtc.c | 411 ++++++++++++++++

hw/sd/allwinner-sdhost.c | 854 ++++++++++++++++++++++++++++++++

hw/ssi/aspeed_smc.c | 56 ++-

hw/usb/hcd-ehci-sysbus.c | 17 +

target/arm/helper.c | 49 +-

target/arm/kvm.c | 14 +-

target/arm/kvm32.c | 15 +-

target/arm/kvm64.c | 15 +-

target/arm/translate-a64.c | 11 +

target/arm/translate.c | 14 +-

MAINTAINERS | 9 +

default-configs/arm-softmmu.mak | 1 +

docs/system/arm/orangepi.rst | 253 ++++++++++

docs/system/target-arm.rst | 2 +

hw/arm/Kconfig | 12 +

hw/misc/trace-events | 19 +

hw/net/Kconfig | 3 +

hw/net/trace-events | 10 +

hw/rtc/trace-events | 4 +

hw/sd/trace-events | 7 +

hw/ssi/trace-events | 10 +

tests/acceptance/boot_linux_console.py | 230 +++++++++

57 files changed, 5787 insertions(+), 74 deletions(-)

create mode 100644 include/hw/arm/allwinner-h3.h

create mode 100644 include/hw/misc/allwinner-cpucfg.h

create mode 100644 include/hw/misc/allwinner-h3-ccu.h

create mode 100644 include/hw/misc/allwinner-h3-dramc.h

create mode 100644 include/hw/misc/allwinner-h3-sysctrl.h

create mode 100644 include/hw/misc/allwinner-sid.h

create mode 100644 include/hw/net/allwinner-sun8i-emac.h

create mode 100644 include/hw/rtc/allwinner-rtc.h

create mode 100644 include/hw/sd/allwinner-sdhost.h

create mode 100644 hw/arm/allwinner-h3.c

create mode 100644 hw/arm/orangepi.c

create mode 100644 hw/misc/allwinner-cpucfg.c

create mode 100644 hw/misc/allwinner-h3-ccu.c

create mode 100644 hw/misc/allwinner-h3-dramc.c

create mode 100644 hw/misc/allwinner-h3-sysctrl.c

create mode 100644 hw/misc/allwinner-sid.c

create mode 100644 hw/net/allwinner-sun8i-emac.c

create mode 100644 hw/rtc/allwinner-rtc.c

create mode 100644 hw/sd/allwinner-sdhost.c

create mode 100644 docs/system/arm/orangepi.rst

create mode 100644 hw/ssi/trace-events

Some of an M-profile CPU's cached hflags state depends on state that's

in our NVIC object. We already do an hflags rebuild when the NVIC

registers are written, but we also need to do this on NVIC reset,

because there's no guarantee that this will happen before the

CPU reset.

This fixes an assertion due to mismatched hflags which happens if

the CPU is reset from inside a HardFault handler.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200303174950.3298-2-peter.maydell@linaro.org

---

hw/intc/armv7m_nvic.c | 6 ++++++

1 file changed, 6 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/armv7m_nvic.c

+++ b/hw/intc/armv7m_nvic.c

@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)

s->itns[i] = true;

}

}

+

+ /*

+ * We updated state that affects the CPU's MMUidx and thus its hflags;

+ * and we can't guarantee that we run before the CPU reset function.

+ */

+ arm_rebuild_hflags(&s->cpu->env);

}

static void nvic_systick_trigger(void *opaque, int n, int level)

--

2.20.1

For M-profile CPUs, the FAULTMASK value affects the CPU's MMU index

(it changes the NegPri bit). We update the hflags after calls

to the v7m_msr helper in trans_MSR_v7m() but forgot to do so

in trans_CPS_v7m().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200303174950.3298-3-peter.maydell@linaro.org

---

target/arm/translate.c | 5 ++++-

1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static bool trans_CPS(DisasContext *s, arg_CPS *a)

static bool trans_CPS_v7m(DisasContext *s, arg_CPS_v7m *a)

{

- TCGv_i32 tmp, addr;

+ TCGv_i32 tmp, addr, el;

if (!arm_dc_feature(s, ARM_FEATURE_M)) {

return false;

@@ -XXX,XX +XXX,XX @@ static bool trans_CPS_v7m(DisasContext *s, arg_CPS_v7m *a)

gen_helper_v7m_msr(cpu_env, addr, tmp);

tcg_temp_free_i32(addr);

}

+ el = tcg_const_i32(s->current_el);

+ gen_helper_rebuild_hflags_m32(cpu_env, el);

+ tcg_temp_free_i32(el);

tcg_temp_free_i32(tmp);

gen_lookup_tb(s);

return true;

--

2.20.1

A write to the CONTROL register can change our current EL (by

writing to the nPRIV bit). That means that we can't assume

that s->current_el is still valid in trans_MSR_v7m() when

we try to rebuild the hflags.

Add a new helper rebuild_hflags_m32_newel() which, like the

existing rebuild_hflags_a32_newel(), recalculates the current

EL from scratch, and use it in trans_MSR_v7m().

This fixes an assertion about an hflags mismatch when the

guest changes privilege by writing to CONTROL.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200303174950.3298-4-peter.maydell@linaro.org

---

target/arm/helper.h | 1 +

target/arm/helper.c | 12 ++++++++++++

target/arm/translate.c | 7 +++----

3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.h

+++ b/target/arm/helper.h

@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(msr_banked, void, env, i32, i32, i32)

DEF_HELPER_2(get_user_reg, i32, env, i32)

DEF_HELPER_3(set_user_reg, void, env, i32, i32)

+DEF_HELPER_FLAGS_1(rebuild_hflags_m32_newel, TCG_CALL_NO_RWG, void, env)

DEF_HELPER_FLAGS_2(rebuild_hflags_m32, TCG_CALL_NO_RWG, void, env, int)

DEF_HELPER_FLAGS_1(rebuild_hflags_a32_newel, TCG_CALL_NO_RWG, void, env)

DEF_HELPER_FLAGS_2(rebuild_hflags_a32, TCG_CALL_NO_RWG, void, env, int)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void arm_rebuild_hflags(CPUARMState *env)

env->hflags = rebuild_hflags_internal(env);

}

+/*

+ * If we have triggered a EL state change we can't rely on the

+ * translator having passed it to us, we need to recompute.

+ */

+void HELPER(rebuild_hflags_m32_newel)(CPUARMState *env)

+{

+ int el = arm_current_el(env);

+ int fp_el = fp_exception_el(env, el);

+ ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);

+ env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);

+}

+

void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)

{

int fp_el = fp_exception_el(env, el);

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static bool trans_MRS_v7m(DisasContext *s, arg_MRS_v7m *a)

static bool trans_MSR_v7m(DisasContext *s, arg_MSR_v7m *a)

{

- TCGv_i32 addr, reg, el;

+ TCGv_i32 addr, reg;

if (!arm_dc_feature(s, ARM_FEATURE_M)) {

return false;

@@ -XXX,XX +XXX,XX @@ static bool trans_MSR_v7m(DisasContext *s, arg_MSR_v7m *a)

gen_helper_v7m_msr(cpu_env, addr, reg);

tcg_temp_free_i32(addr);

tcg_temp_free_i32(reg);

- el = tcg_const_i32(s->current_el);

- gen_helper_rebuild_hflags_m32(cpu_env, el);

- tcg_temp_free_i32(el);

+ /* If we wrote to CONTROL, the EL might have changed */

+ gen_helper_rebuild_hflags_m32_newel(cpu_env);

gen_lookup_tb(s);

return true;

}

--

2.20.1

Fix a couple of comment typos.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200303174950.3298-5-peter.maydell@linaro.org

---

target/arm/helper.c | 2 +-

target/arm/translate.c | 2 +-

2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)

/*

* If we have triggered a EL state change we can't rely on the

- * translator having passed it too us, we need to recompute.

+ * translator having passed it to us, we need to recompute.

*/

void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env)

{

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)

if (!isread && !(ri->type & ARM_CP_SUPPRESS_TB_END)) {

/*

- * A write to any coprocessor regiser that ends a TB

+ * A write to any coprocessor register that ends a TB

* must rebuild the hflags for the next TB.

*/

TCGv_i32 tcg_el = tcg_const_i32(s->current_el);

--

2.20.1

From: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Cédric Le Goater <clg@kaod.org>

Reviewed-by: Andrew Jeffery <andrew@aj.id.au>

Reviewed-by: Joel Stanley <joel@jms.id.au>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Message-id: 20200206112645.21275-2-clg@kaod.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

Makefile.objs | 1 +

hw/ssi/aspeed_smc.c | 17 +++++++++++++++++

hw/ssi/trace-events | 9 +++++++++

3 files changed, 27 insertions(+)

create mode 100644 hw/ssi/trace-events

diff --git a/Makefile.objs b/Makefile.objs

index XXXXXXX..XXXXXXX 100644

--- a/Makefile.objs

+++ b/Makefile.objs

@@ -XXX,XX +XXX,XX @@ trace-events-subdirs += hw/scsi

trace-events-subdirs += hw/sd

trace-events-subdirs += hw/sparc

trace-events-subdirs += hw/sparc64

+trace-events-subdirs += hw/ssi

trace-events-subdirs += hw/timer

trace-events-subdirs += hw/tpm

trace-events-subdirs += hw/usb

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/aspeed_smc.c

+++ b/hw/ssi/aspeed_smc.c

@@ -XXX,XX +XXX,XX @@

#include "qapi/error.h"

#include "exec/address-spaces.h"

#include "qemu/units.h"

+#include "trace.h"

#include "hw/irq.h"

#include "hw/qdev-properties.h"

@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,

s->ctrl->reg_to_segment(s, new, &seg);

+ trace_aspeed_smc_flash_set_segment(cs, new, seg.addr, seg.addr + seg.size);

+

/* The start address of CS0 is read-only */

if (cs == 0 && seg.addr != s->ctrl->flash_window_base) {

qemu_log_mask(LOG_GUEST_ERROR,

@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)

__func__, aspeed_smc_flash_mode(fl));

}

+ trace_aspeed_smc_flash_read(fl->id, addr, size, ret,

+ aspeed_smc_flash_mode(fl));

return ret;

}

@@ -XXX,XX +XXX,XX @@ static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl, uint64_t data,

AspeedSMCState *s = fl->controller;

uint8_t addr_width = aspeed_smc_flash_is_4byte(fl) ? 4 : 3;

+ trace_aspeed_smc_do_snoop(fl->id, s->snoop_index, s->snoop_dummies,

+ (uint8_t) data & 0xff);

+

if (s->snoop_index == SNOOP_OFF) {

return false; /* Do nothing */

@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,

AspeedSMCState *s = fl->controller;

int i;

+ trace_aspeed_smc_flash_write(fl->id, addr, size, data,

+ aspeed_smc_flash_mode(fl));

+

if (!aspeed_smc_is_writable(fl)) {

qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%"

HWADDR_PRIx "\n", __func__, addr);

@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)

(s->ctrl->has_dma && addr == R_DMA_CHECKSUM) ||

(addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) ||

(addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->ctrl->max_slaves)) {

+

+ trace_aspeed_smc_read(addr, size, s->regs[addr]);

+

return s->regs[addr];

} else {

qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",

@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_checksum(AspeedSMCState *s)

__func__, s->regs[R_DMA_FLASH_ADDR]);

return;

}

+ trace_aspeed_smc_dma_checksum(s->regs[R_DMA_FLASH_ADDR], data);

/*

* When the DMA is on-going, the DMA registers are updated

@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,

addr >>= 2;

+ trace_aspeed_smc_write(addr, size, data);

+

if (addr == s->r_conf ||

(addr >= s->r_timings &&

addr < s->r_timings + s->ctrl->nregs_timings) ||

diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/hw/ssi/trace-events

@@ -XXX,XX +XXX,XX @@

+# aspeed_smc.c

+

+aspeed_smc_flash_set_segment(int cs, uint64_t reg, uint64_t start, uint64_t end) "CS%d segreg=0x%"PRIx64" [ 0x%"PRIx64" - 0x%"PRIx64" ]"

+aspeed_smc_flash_read(int cs, uint64_t addr, uint32_t size, uint64_t data, int mode) "CS%d @0x%" PRIx64 " size %u: 0x%" PRIx64" mode:%d"

+aspeed_smc_do_snoop(int cs, int index, int dummies, int data) "CS%d index:0x%x dummies:%d data:0x%x"

+aspeed_smc_flash_write(int cs, uint64_t addr, uint32_t size, uint64_t data, int mode) "CS%d @0x%" PRIx64 " size %u: 0x%" PRIx64" mode:%d"

+aspeed_smc_read(uint64_t addr, uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64

+aspeed_smc_dma_checksum(uint32_t addr, uint32_t data) "0x%08x: 0x%08x"

+aspeed_smc_write(uint64_t addr, uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64

--

2.20.1

From: Cédric Le Goater <clg@kaod.org>

The Aspeed SMC Controller can operate in different modes : Read, Fast

Read, Write and User modes. When the User mode is configured, it

selects automatically the SPI slave device until the CE_STOP_ACTIVE

bit is set to 1. When any other modes are configured the device is

unselected. The HW logic handles the chip select automatically when

the flash is accessed through its AHB window.

When configuring the CEx Control Register, the User mode logic to

select and unselect the slave is incorrect and data corruption can be

seen on machines using two chips, witherspoon and romulus.

Rework the handler setting the CEx Control Register to fix this issue.

Fixes: 7c1c69bca43c ("ast2400: add SMC controllers (FMC and SPI)")

Signed-off-by: Cédric Le Goater <clg@kaod.org>

Reviewed-by: Andrew Jeffery <andrew@aj.id.au>

Message-id: 20200206112645.21275-3-clg@kaod.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/ssi/aspeed_smc.c | 39 +++++++++++++++++++++++----------------

hw/ssi/trace-events | 1 +

2 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/aspeed_smc.c

+++ b/hw/ssi/aspeed_smc.c

@@ -XXX,XX +XXX,XX @@ static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl)

}

}

-static inline bool aspeed_smc_is_ce_stop_active(const AspeedSMCFlash *fl)

+static void aspeed_smc_flash_do_select(AspeedSMCFlash *fl, bool unselect)

{

- const AspeedSMCState *s = fl->controller;

+ AspeedSMCState *s = fl->controller;

- return s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE;

+ trace_aspeed_smc_flash_select(fl->id, unselect ? "un" : "");

+

+ qemu_set_irq(s->cs_lines[fl->id], unselect);

}

static void aspeed_smc_flash_select(AspeedSMCFlash *fl)

{

- AspeedSMCState *s = fl->controller;

-

- s->regs[s->r_ctrl0 + fl->id] &= ~CTRL_CE_STOP_ACTIVE;

- qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));

+ aspeed_smc_flash_do_select(fl, false);

}

static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)

{

- AspeedSMCState *s = fl->controller;

-

- s->regs[s->r_ctrl0 + fl->id] |= CTRL_CE_STOP_ACTIVE;

- qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));

+ aspeed_smc_flash_do_select(fl, true);

}

static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_smc_flash_ops = {

},

};

-static void aspeed_smc_flash_update_cs(AspeedSMCFlash *fl)

+static void aspeed_smc_flash_update_ctrl(AspeedSMCFlash *fl, uint32_t value)

{

AspeedSMCState *s = fl->controller;

+ bool unselect;

- s->snoop_index = aspeed_smc_is_ce_stop_active(fl) ? SNOOP_OFF : SNOOP_START;

+ /* User mode selects the CS, other modes unselect */

+ unselect = (value & CTRL_CMD_MODE_MASK) != CTRL_USERMODE;

- qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));

+ /* A change of CTRL_CE_STOP_ACTIVE from 0 to 1, unselects the CS */

+ if (!(s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE) &&

+ value & CTRL_CE_STOP_ACTIVE) {

+ unselect = true;

+ }

+

+ s->regs[s->r_ctrl0 + fl->id] = value;

+

+ s->snoop_index = unselect ? SNOOP_OFF : SNOOP_START;

+

+ aspeed_smc_flash_do_select(fl, unselect);

}

static void aspeed_smc_reset(DeviceState *d)

@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,

s->regs[addr] = value;

} else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) {

int cs = addr - s->r_ctrl0;

- s->regs[addr] = value;

- aspeed_smc_flash_update_cs(&s->flashes[cs]);

+ aspeed_smc_flash_update_ctrl(&s->flashes[cs], value);

} else if (addr >= R_SEG_ADDR0 &&

addr < R_SEG_ADDR0 + s->ctrl->max_slaves) {

int cs = addr - R_SEG_ADDR0;

diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/ssi/trace-events

+++ b/hw/ssi/trace-events

@@ -XXX,XX +XXX,XX @@ aspeed_smc_flash_write(int cs, uint64_t addr, uint32_t size, uint64_t data, int

aspeed_smc_read(uint64_t addr, uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64

aspeed_smc_dma_checksum(uint32_t addr, uint32_t data) "0x%08x: 0x%08x"

aspeed_smc_write(uint64_t addr, uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64

+aspeed_smc_flash_select(int cs, const char *prefix) "CS%d %sselect"

--

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

We fail to validate the upper bits of a virtual address on a

translation disabled regime, as per AArch64.TranslateAddressS1Off.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200308012946.16303-2-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/helper.c | 35 ++++++++++++++++++++++++++++++++++-

1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,

/* Definitely a real MMU, not an MPU */

if (regime_translation_disabled(env, mmu_idx)) {

- /* MMU disabled. */

+ /*

+ * MMU disabled. S1 addresses within aa64 translation regimes are

+ * still checked for bounds -- see AArch64.TranslateAddressS1Off.

+ */

+ if (mmu_idx != ARMMMUIdx_Stage2) {

+ int r_el = regime_el(env, mmu_idx);

+ if (arm_el_is_aa64(env, r_el)) {

+ int pamax = arm_pamax(env_archcpu(env));

+ uint64_t tcr = env->cp15.tcr_el[r_el].raw_tcr;

+ int addrtop, tbi;

+

+ tbi = aa64_va_parameter_tbi(tcr, mmu_idx);

+ if (access_type == MMU_INST_FETCH) {

+ tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);

+ }

+ tbi = (tbi >> extract64(address, 55, 1)) & 1;

+ addrtop = (tbi ? 55 : 63);

+

+ if (extract64(address, pamax, addrtop - pamax + 1) != 0) {

+ fi->type = ARMFault_AddressSize;

+ fi->level = 0;

+ fi->stage2 = false;

+ return 1;

+ }

+

+ /*

+ * When TBI is disabled, we've just validated that all of the

+ * bits above PAMax are zero, so logically we only need to

+ * clear the top byte for TBI. But it's clearer to follow

+ * the pseudocode set of addrdesc.paddress.

+ */

+ address = extract64(address, 0, 52);

+ }

+ }

*phys_ptr = address;

*prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;

*page_size = TARGET_PAGE_SIZE;

--

2.20.1

From: Igor Mammedov <imammedo@redhat.com>

SOC object returned by object_new() is leaked in current code.

Set SOC parent explicitly to board and then unref to SOC object

to make sure that refererence returned by object_new() is taken

care of.

The SOC object will be kept alive by its parent (machine) and

will be automatically freed when MachineState is destroyed.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>

Reported-by: Andrew Jones <drjones@redhat.com>

Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>

Message-id: 20200303091254.22373-1-imammedo@redhat.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/cubieboard.c | 3 +++

1 file changed, 3 insertions(+)

diff --git a/hw/arm/cubieboard.c b/hw/arm/cubieboard.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/cubieboard.c

+++ b/hw/arm/cubieboard.c

@@ -XXX,XX +XXX,XX @@ static void cubieboard_init(MachineState *machine)

}

a10 = AW_A10(object_new(TYPE_AW_A10));

+ object_property_add_child(OBJECT(machine), "soc", OBJECT(a10),

+ &error_abort);

+ object_unref(OBJECT(a10));

object_property_set_int(OBJECT(&a10->emac), 1, "phy-addr", &err);

if (err != NULL) {

--

2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Wire up eSDHC controllers in fsl-imx25. For imx25-pdk, connect drives

provided on the command line to available eSDHC controllers.

This patch enables booting the imx25-pdk emulation from SD card.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Message-id: 20200310215146.19688-2-linux@roeck-us.net

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

[PMM: made commit subject consistent with other patch]

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/fsl-imx25.h | 9 +++++++++

hw/arm/fsl-imx25.c | 32 ++++++++++++++++++++++++++++++++

hw/arm/imx25_pdk.c | 16 ++++++++++++++++

3 files changed, 57 insertions(+)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/fsl-imx25.h

+++ b/include/hw/arm/fsl-imx25.h

@@ -XXX,XX +XXX,XX @@

#include "hw/misc/imx_rngc.h"

#include "hw/i2c/imx_i2c.h"

#include "hw/gpio/imx_gpio.h"

+#include "hw/sd/sdhci.h"

#include "exec/memory.h"

#include "target/arm/cpu.h"

@@ -XXX,XX +XXX,XX @@

#define FSL_IMX25_NUM_EPITS 2

#define FSL_IMX25_NUM_I2CS 3

#define FSL_IMX25_NUM_GPIOS 4

+#define FSL_IMX25_NUM_ESDHCS 2

typedef struct FslIMX25State {

/*< private >*/

@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {

IMXRNGCState rngc;

IMXI2CState i2c[FSL_IMX25_NUM_I2CS];

IMXGPIOState gpio[FSL_IMX25_NUM_GPIOS];

+ SDHCIState esdhc[FSL_IMX25_NUM_ESDHCS];

MemoryRegion rom[2];

MemoryRegion iram;

MemoryRegion iram_alias;

@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {

#define FSL_IMX25_GPIO3_SIZE 0x4000

#define FSL_IMX25_RNGC_ADDR 0x53FB0000

#define FSL_IMX25_RNGC_SIZE 0x4000

+#define FSL_IMX25_ESDHC1_ADDR 0x53FB4000

+#define FSL_IMX25_ESDHC1_SIZE 0x4000

+#define FSL_IMX25_ESDHC2_ADDR 0x53FB8000

+#define FSL_IMX25_ESDHC2_SIZE 0x4000

#define FSL_IMX25_GPIO1_ADDR 0x53FCC000

#define FSL_IMX25_GPIO1_SIZE 0x4000

#define FSL_IMX25_GPIO2_ADDR 0x53FD0000

@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {

#define FSL_IMX25_GPIO2_IRQ 51

#define FSL_IMX25_GPIO3_IRQ 16

#define FSL_IMX25_GPIO4_IRQ 23

+#define FSL_IMX25_ESDHC1_IRQ 9

+#define FSL_IMX25_ESDHC2_IRQ 8

#endif /* FSL_IMX25_H */

diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/fsl-imx25.c

+++ b/hw/arm/fsl-imx25.c

@@ -XXX,XX +XXX,XX @@

#include "hw/qdev-properties.h"

#include "chardev/char.h"

+#define IMX25_ESDHC_CAPABILITIES 0x07e20000

+

static void fsl_imx25_init(Object *obj)

{

FslIMX25State *s = FSL_IMX25(obj);

@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_init(Object *obj)

sysbus_init_child_obj(obj, "gpio[*]", &s->gpio[i], sizeof(s->gpio[i]),

TYPE_IMX_GPIO);

}

+

+ for (i = 0; i < FSL_IMX25_NUM_ESDHCS; i++) {

+ sysbus_init_child_obj(obj, "sdhc[*]", &s->esdhc[i], sizeof(s->esdhc[i]),

+ TYPE_IMX_USDHC);

+ }

}

static void fsl_imx25_realize(DeviceState *dev, Error **errp)

@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)

gpio_table[i].irq));

}

+ /* Initialize all SDHC */

+ for (i = 0; i < FSL_IMX25_NUM_ESDHCS; i++) {

+ static const struct {

+ hwaddr addr;

+ unsigned int irq;

+ } esdhc_table[FSL_IMX25_NUM_ESDHCS] = {

+ { FSL_IMX25_ESDHC1_ADDR, FSL_IMX25_ESDHC1_IRQ },

+ { FSL_IMX25_ESDHC2_ADDR, FSL_IMX25_ESDHC2_IRQ },

+ };

+

+ object_property_set_uint(OBJECT(&s->esdhc[i]), 2, "sd-spec-version",

+ &err);

+ object_property_set_uint(OBJECT(&s->esdhc[i]), IMX25_ESDHC_CAPABILITIES,

+ "capareg", &err);

+ object_property_set_bool(OBJECT(&s->esdhc[i]), true, "realized", &err);

+ if (err) {

+ error_propagate(errp, err);

+ return;

+ }

+ sysbus_mmio_map(SYS_BUS_DEVICE(&s->esdhc[i]), 0, esdhc_table[i].addr);

+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->esdhc[i]), 0,

+ qdev_get_gpio_in(DEVICE(&s->avic),

+ esdhc_table[i].irq));

+ }

+

/* initialize 2 x 16 KB ROM */

memory_region_init_rom(&s->rom[0], NULL,

"imx25.rom0", FSL_IMX25_ROM0_SIZE, &err);

diff --git a/hw/arm/imx25_pdk.c b/hw/arm/imx25_pdk.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/imx25_pdk.c

+++ b/hw/arm/imx25_pdk.c

@@ -XXX,XX +XXX,XX @@

#include "qemu/osdep.h"

#include "qapi/error.h"

#include "cpu.h"

+#include "hw/qdev-properties.h"

#include "hw/arm/fsl-imx25.h"

#include "hw/boards.h"

#include "qemu/error-report.h"

@@ -XXX,XX +XXX,XX @@ static void imx25_pdk_init(MachineState *machine)

imx25_pdk_binfo.board_id = 1771,

imx25_pdk_binfo.nb_cpus = 1;

+ for (i = 0; i < FSL_IMX25_NUM_ESDHCS; i++) {

+ BusState *bus;

+ DeviceState *carddev;

+ DriveInfo *di;

+ BlockBackend *blk;

+

+ di = drive_get_next(IF_SD);

+ blk = di ? blk_by_legacy_dinfo(di) : NULL;

+ bus = qdev_get_child_bus(DEVICE(&s->soc.esdhc[i]), "sd-bus");

+ carddev = qdev_create(bus, TYPE_SD_CARD);

+ qdev_prop_set_drive(carddev, "drive", blk, &error_fatal);

+ object_property_set_bool(OBJECT(carddev), true,

+ "realized", &error_fatal);

+ }

+

/*

* We test explicitly for qtest here as it is not done (yet?) in

* arm_load_kernel(). Without this the "make check" command would

--

2.20.1

From: Guenter Roeck <linux@roeck-us.net>

i.MX25 supports two USB controllers. Let's wire them up.

With this patch, imx25-pdk can boot from both USB ports.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Message-id: 20200310215146.19688-3-linux@roeck-us.net

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/fsl-imx25.h | 9 +++++++++

hw/arm/fsl-imx25.c | 24 ++++++++++++++++++++++++

2 files changed, 33 insertions(+)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/fsl-imx25.h

+++ b/include/hw/arm/fsl-imx25.h

@@ -XXX,XX +XXX,XX @@

#include "hw/i2c/imx_i2c.h"

#include "hw/gpio/imx_gpio.h"

#include "hw/sd/sdhci.h"

+#include "hw/usb/chipidea.h"

#include "exec/memory.h"

#include "target/arm/cpu.h"

@@ -XXX,XX +XXX,XX @@

#define FSL_IMX25_NUM_I2CS 3

#define FSL_IMX25_NUM_GPIOS 4

#define FSL_IMX25_NUM_ESDHCS 2

+#define FSL_IMX25_NUM_USBS 2

typedef struct FslIMX25State {

/*< private >*/

@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {

IMXI2CState i2c[FSL_IMX25_NUM_I2CS];

IMXGPIOState gpio[FSL_IMX25_NUM_GPIOS];

SDHCIState esdhc[FSL_IMX25_NUM_ESDHCS];

+ ChipideaState usb[FSL_IMX25_NUM_USBS];

MemoryRegion rom[2];

MemoryRegion iram;

MemoryRegion iram_alias;

@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {

#define FSL_IMX25_GPIO1_SIZE 0x4000

#define FSL_IMX25_GPIO2_ADDR 0x53FD0000

#define FSL_IMX25_GPIO2_SIZE 0x4000

+#define FSL_IMX25_USB1_ADDR 0x53FF4000

+#define FSL_IMX25_USB1_SIZE 0x0200

+#define FSL_IMX25_USB2_ADDR 0x53FF4400

+#define FSL_IMX25_USB2_SIZE 0x0200

#define FSL_IMX25_AVIC_ADDR 0x68000000

#define FSL_IMX25_AVIC_SIZE 0x4000

#define FSL_IMX25_IRAM_ADDR 0x78000000

@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {

#define FSL_IMX25_GPIO4_IRQ 23

#define FSL_IMX25_ESDHC1_IRQ 9

#define FSL_IMX25_ESDHC2_IRQ 8

+#define FSL_IMX25_USB1_IRQ 37

+#define FSL_IMX25_USB2_IRQ 35

#endif /* FSL_IMX25_H */

diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/fsl-imx25.c

+++ b/hw/arm/fsl-imx25.c

@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_init(Object *obj)

sysbus_init_child_obj(obj, "sdhc[*]", &s->esdhc[i], sizeof(s->esdhc[i]),

TYPE_IMX_USDHC);

}

+

+ for (i = 0; i < FSL_IMX25_NUM_USBS; i++) {

+ sysbus_init_child_obj(obj, "usb[*]", &s->usb[i], sizeof(s->usb[i]),

+ TYPE_CHIPIDEA);

+ }

+

}

static void fsl_imx25_realize(DeviceState *dev, Error **errp)

@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)

esdhc_table[i].irq));

}

+ /* USB */

+ for (i = 0; i < FSL_IMX25_NUM_USBS; i++) {

+ static const struct {

+ hwaddr addr;

+ unsigned int irq;

+ } usb_table[FSL_IMX25_NUM_USBS] = {

+ { FSL_IMX25_USB1_ADDR, FSL_IMX25_USB1_IRQ },

+ { FSL_IMX25_USB2_ADDR, FSL_IMX25_USB2_IRQ },

+ };

+

+ object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",

+ &error_abort);

+ sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0, usb_table[i].addr);

+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,

+ qdev_get_gpio_in(DEVICE(&s->avic),

+ usb_table[i].irq));

+ }

+

/* initialize 2 x 16 KB ROM */

memory_region_init_rom(&s->rom[0], NULL,

"imx25.rom0", FSL_IMX25_ROM0_SIZE, &err);

--

2.20.1

+ *

+ * This program is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

+ * GNU General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License

+ * along with this program. If not, see <http://www.gnu.org/licenses/>.