From: Guenter Roeck <linux@roeck-us.net>

USB1 and USB2 interrupt numbers were swapped. USB_PHY2 interrupt number

is 45. That didn't really matter up to now since the interrupts were not

used, but it needs to be fixed to be able to wire up the USB controllers.

Fixes: 31cbf933f0e ("i.MX6UL: Add i.MX6UL SOC")

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Message-id: 20200313014551.12554-3-linux@roeck-us.net

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/fsl-imx6ul.h | 6 +++---

1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/fsl-imx6ul.h

+++ b/include/hw/arm/fsl-imx6ul.h

@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULIRQs {

FSL_IMX6UL_UART7_IRQ = 39,

FSL_IMX6UL_UART8_IRQ = 40,

- FSL_IMX6UL_USB1_IRQ = 42,

- FSL_IMX6UL_USB2_IRQ = 43,

+ FSL_IMX6UL_USB1_IRQ = 43,

+ FSL_IMX6UL_USB2_IRQ = 42,

FSL_IMX6UL_USB_PHY1_IRQ = 44,

- FSL_IMX6UL_USB_PHY2_IRQ = 44,

+ FSL_IMX6UL_USB_PHY2_IRQ = 45,

FSL_IMX6UL_CAAM_JQ2_IRQ = 46,

FSL_IMX6UL_CAAM_ERR_IRQ = 47,

--

2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Recent Linux kernels (post v4.20) crash due to accesses to flexcan

and pwm controllers. Instantiate as unimplemented devices to work

around the problem.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Message-id: 20200313014551.12554-4-linux@roeck-us.net

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/fsl-imx6ul.c | 14 ++++++++++++++

1 file changed, 14 insertions(+)

diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/fsl-imx6ul.c

+++ b/hw/arm/fsl-imx6ul.c

@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)

*/

create_unimplemented_device("sdma", FSL_IMX6UL_SDMA_ADDR, 0x4000);

+ /*

+ * PWM

+ */

+ create_unimplemented_device("pwm1", FSL_IMX6UL_PWM1_ADDR, 0x4000);

+ create_unimplemented_device("pwm2", FSL_IMX6UL_PWM2_ADDR, 0x4000);

+ create_unimplemented_device("pwm3", FSL_IMX6UL_PWM3_ADDR, 0x4000);

+ create_unimplemented_device("pwm4", FSL_IMX6UL_PWM4_ADDR, 0x4000);

+

+ /*

+ * CAN

+ */

+ create_unimplemented_device("can1", FSL_IMX6UL_CAN1_ADDR, 0x4000);

+ create_unimplemented_device("can2", FSL_IMX6UL_CAN2_ADDR, 0x4000);

+

/*

* APHB_DMA

*/

--

2.20.1

From: Guenter Roeck <linux@roeck-us.net>

With this patch, the USB controllers on 'sabrelite' are detected

and can be used to boot the system.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Message-id: 20200313014551.12554-6-linux@roeck-us.net

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/fsl-imx6.h | 6 ++++++

hw/arm/fsl-imx6.c | 36 ++++++++++++++++++++++++++++++++++++

2 files changed, 42 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/fsl-imx6.h

+++ b/include/hw/arm/fsl-imx6.h

@@ -XXX,XX +XXX,XX @@

#include "hw/sd/sdhci.h"

#include "hw/ssi/imx_spi.h"

#include "hw/net/imx_fec.h"

+#include "hw/usb/chipidea.h"

+#include "hw/usb/imx-usb-phy.h"

#include "exec/memory.h"

#include "cpu.h"

@@ -XXX,XX +XXX,XX @@

#define FSL_IMX6_NUM_ESDHCS 4

#define FSL_IMX6_NUM_ECSPIS 5

#define FSL_IMX6_NUM_WDTS 2

+#define FSL_IMX6_NUM_USB_PHYS 2

+#define FSL_IMX6_NUM_USBS 4

typedef struct FslIMX6State {

/*< private >*/

@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {

SDHCIState esdhc[FSL_IMX6_NUM_ESDHCS];

IMXSPIState spi[FSL_IMX6_NUM_ECSPIS];

IMX2WdtState wdt[FSL_IMX6_NUM_WDTS];

+ IMXUSBPHYState usbphy[FSL_IMX6_NUM_USB_PHYS];

+ ChipideaState usb[FSL_IMX6_NUM_USBS];

IMXFECState eth;

MemoryRegion rom;

MemoryRegion caam;

diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/fsl-imx6.c

+++ b/hw/arm/fsl-imx6.c

@@ -XXX,XX +XXX,XX @@

#include "qemu/osdep.h"

#include "qapi/error.h"

#include "hw/arm/fsl-imx6.h"

+#include "hw/usb/imx-usb-phy.h"

#include "hw/boards.h"

#include "hw/qdev-properties.h"

#include "sysemu/sysemu.h"

@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)

TYPE_IMX_USDHC);

}

+ for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {

+ snprintf(name, NAME_SIZE, "usbphy%d", i);

+ sysbus_init_child_obj(obj, name, &s->usbphy[i], sizeof(s->usbphy[i]),

+ TYPE_IMX_USBPHY);

+ }

+ for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {

+ snprintf(name, NAME_SIZE, "usb%d", i);

+ sysbus_init_child_obj(obj, name, &s->usb[i], sizeof(s->usb[i]),

+ TYPE_CHIPIDEA);

+ }

+

for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {

snprintf(name, NAME_SIZE, "spi%d", i + 1);

sysbus_init_child_obj(obj, name, &s->spi[i], sizeof(s->spi[i]),

@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)

esdhc_table[i].irq));

}

+ /* USB */

+ for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {

+ object_property_set_bool(OBJECT(&s->usbphy[i]), true, "realized",

+ &error_abort);

+ sysbus_mmio_map(SYS_BUS_DEVICE(&s->usbphy[i]), 0,

+ FSL_IMX6_USBPHY1_ADDR + i * 0x1000);

+ }

+ for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {

+ static const int FSL_IMX6_USBn_IRQ[] = {

+ FSL_IMX6_USB_OTG_IRQ,

+ FSL_IMX6_USB_HOST1_IRQ,

+ FSL_IMX6_USB_HOST2_IRQ,

+ FSL_IMX6_USB_HOST3_IRQ,

+ };

+

+ object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",

+ &error_abort);

+ sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,

+ FSL_IMX6_USBOH3_USB_ADDR + i * 0x200);

+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,

+ qdev_get_gpio_in(DEVICE(&s->a9mpcore),

+ FSL_IMX6_USBn_IRQ[i]));

+ }

+

/* Initialize all ECSPI */

for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {

static const struct {

--

2.20.1

From: Chen Qun <kuhn.chenqun@huawei.com>

The current code causes clang static code analyzer generate warning:

hw/net/imx_fec.c:858:9: warning: Value stored to 'value' is never read

value = value & 0x0000000f;

^ ~~~~~~~~~~~~~~~~~~

hw/net/imx_fec.c:864:9: warning: Value stored to 'value' is never read

value = value & 0x000000fd;

^ ~~~~~~~~~~~~~~~~~~

According to the definition of the function, the two “value” assignments

should be written to registers.

Reported-by: Euler Robot <euler.robot@huawei.com>

Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>

Message-id: 20200313123242.13236-1-kuhn.chenqun@huawei.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/net/imx_fec.c | 6 ++++--

1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/imx_fec.c

+++ b/hw/net/imx_fec.c

@@ -XXX,XX +XXX,XX @@ static void imx_enet_write(IMXFECState *s, uint32_t index, uint32_t value)

break;

case ENET_TGSR:

/* implement clear timer flag */

- value = value & 0x0000000f;

+ s->regs[index] &= ~(value & 0x0000000f); /* all bits W1C */

break;

case ENET_TCSR0:

case ENET_TCSR1:

case ENET_TCSR2:

case ENET_TCSR3:

- value = value & 0x000000fd;

+ s->regs[index] &= ~(value & 0x00000080); /* W1C bits */

+ s->regs[index] &= ~0x0000007d; /* writable fields */

+ s->regs[index] |= (value & 0x0000007d);

break;

case ENET_TCCR0:

case ENET_TCCR1:

--

2.20.1

From: Guenter Roeck <linux@roeck-us.net>

While at it, add some trace messages to help debug problems

seen when running the latest Linux kernel.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/block/m25p80.c | 48 ++++++++++++++++++++-----------------------

hw/block/trace-events | 16 +++++++++++++++

2 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/block/m25p80.c

+++ b/hw/block/m25p80.c

@@ -XXX,XX +XXX,XX @@

#include "qemu/module.h"

#include "qemu/error-report.h"

#include "qapi/error.h"

-

-#ifndef M25P80_ERR_DEBUG

-#define M25P80_ERR_DEBUG 0

-#endif

-

-#define DB_PRINT_L(level, ...) do { \

- if (M25P80_ERR_DEBUG > (level)) { \

- fprintf(stderr, ": %s: ", __func__); \

- fprintf(stderr, ## __VA_ARGS__); \

- } \

-} while (0)

+#include "trace.h"

/* Fields for FlashPartInfo->flags */

@@ -XXX,XX +XXX,XX @@ static void flash_erase(Flash *s, int offset, FlashCMD cmd)

abort();

}

- DB_PRINT_L(0, "offset = %#x, len = %d\n", offset, len);

+ trace_m25p80_flash_erase(s, offset, len);

+

if ((s->pi->flags & capa_to_assert) != capa_to_assert) {

qemu_log_mask(LOG_GUEST_ERROR, "M25P80: %d erase size not supported by"

" device\n", len);

@@ -XXX,XX +XXX,XX @@ void flash_write8(Flash *s, uint32_t addr, uint8_t data)

}

if ((prev ^ data) & data) {

- DB_PRINT_L(1, "programming zero to one! addr=%" PRIx32 " %" PRIx8

- " -> %" PRIx8 "\n", addr, prev, data);

+ trace_m25p80_programming_zero_to_one(s, addr, prev, data);

}

if (s->pi->flags & EEPROM) {

@@ -XXX,XX +XXX,XX @@ static void complete_collecting_data(Flash *s)

s->state = STATE_IDLE;

+ trace_m25p80_complete_collecting(s, s->cmd_in_progress, n, s->ear,

+ s->cur_addr);

+

switch (s->cmd_in_progress) {

case DPP:

case QPP:

@@ -XXX,XX +XXX,XX @@ static void reset_memory(Flash *s)

break;

}

- DB_PRINT_L(0, "Reset done.\n");

+ trace_m25p80_reset_done(s);

}

static void decode_fast_read_cmd(Flash *s)

@@ -XXX,XX +XXX,XX @@ static void decode_qio_read_cmd(Flash *s)

static void decode_new_cmd(Flash *s, uint32_t value)

{

- s->cmd_in_progress = value;

int i;

- DB_PRINT_L(0, "decoded new command:%x\n", value);

+

+ s->cmd_in_progress = value;

+ trace_m25p80_command_decoded(s, value);

if (value != RESET_MEMORY) {

s->reset_enable = false;

@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)

break;

case JEDEC_READ:

- DB_PRINT_L(0, "populated jedec code\n");

+ trace_m25p80_populated_jedec(s);

for (i = 0; i < s->pi->id_len; i++) {

s->data[i] = s->pi->id[i];

}

@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)

case BULK_ERASE_60:

case BULK_ERASE:

if (s->write_enable) {

- DB_PRINT_L(0, "chip erase\n");

+ trace_m25p80_chip_erase(s);

flash_erase(s, 0, BULK_ERASE);

} else {

qemu_log_mask(LOG_GUEST_ERROR, "M25P80: chip erase with write "

@@ -XXX,XX +XXX,XX @@ static int m25p80_cs(SSISlave *ss, bool select)

s->data_read_loop = false;

}

- DB_PRINT_L(0, "%sselect\n", select ? "de" : "");

+ trace_m25p80_select(s, select ? "de" : "");

return 0;

}

@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)

Flash *s = M25P80(ss);

uint32_t r = 0;

+ trace_m25p80_transfer(s, s->state, s->len, s->needed_bytes, s->pos,

+ s->cur_addr, (uint8_t)tx);

+

switch (s->state) {

case STATE_PAGE_PROGRAM:

- DB_PRINT_L(1, "page program cur_addr=%#" PRIx32 " data=%" PRIx8 "\n",

- s->cur_addr, (uint8_t)tx);

+ trace_m25p80_page_program(s, s->cur_addr, (uint8_t)tx);

flash_write8(s, s->cur_addr, (uint8_t)tx);

s->cur_addr = (s->cur_addr + 1) & (s->size - 1);

break;

case STATE_READ:

r = s->storage[s->cur_addr];

- DB_PRINT_L(1, "READ 0x%" PRIx32 "=%" PRIx8 "\n", s->cur_addr,

- (uint8_t)r);

+ trace_m25p80_read_byte(s, s->cur_addr, (uint8_t)r);

s->cur_addr = (s->cur_addr + 1) & (s->size - 1);

break;

@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)

}

r = s->data[s->pos];

+ trace_m25p80_read_data(s, s->pos, (uint8_t)r);

s->pos++;

if (s->pos == s->len) {

s->pos = 0;

@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)

return;

}

- DB_PRINT_L(0, "Binding to IF_MTD drive\n");

+ trace_m25p80_binding(s);

s->storage = blk_blockalign(s->blk, s->size);

if (blk_pread(s->blk, 0, s->storage, s->size) != s->size) {

@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)

return;

}

} else {

- DB_PRINT_L(0, "No BDRV - binding to RAM\n");

+ trace_m25p80_binding_no_bdrv(s);

s->storage = blk_blockalign(NULL, s->size);

memset(s->storage, 0xFF, s->size);

}

diff --git a/hw/block/trace-events b/hw/block/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/block/trace-events

+++ b/hw/block/trace-events

@@ -XXX,XX +XXX,XX @@ xen_block_blockdev_add(char *str) "%s"

xen_block_blockdev_del(const char *node_name) "%s"

xen_block_device_create(unsigned int number) "%u"

xen_block_device_destroy(unsigned int number) "%u"

+

+# m25p80.c

+m25p80_flash_erase(void *s, int offset, uint32_t len) "[%p] offset = 0x%"PRIx32", len = %u"

+m25p80_programming_zero_to_one(void *s, uint32_t addr, uint8_t prev, uint8_t data) "[%p] programming zero to one! addr=0x%"PRIx32" 0x%"PRIx8" -> 0x%"PRIx8

+m25p80_reset_done(void *s) "[%p] Reset done."

+m25p80_command_decoded(void *s, uint32_t cmd) "[%p] new command:0x%"PRIx32

+m25p80_complete_collecting(void *s, uint32_t cmd, int n, uint8_t ear, uint32_t cur_addr) "[%p] decode cmd: 0x%"PRIx32" len %d ear 0x%"PRIx8" addr 0x%"PRIx32

+m25p80_populated_jedec(void *s) "[%p] populated jedec code"

+m25p80_chip_erase(void *s) "[%p] chip erase"

+m25p80_select(void *s, const char *what) "[%p] %sselect"

+m25p80_page_program(void *s, uint32_t addr, uint8_t tx) "[%p] page program cur_addr=0x%"PRIx32" data=0x%"PRIx8

+m25p80_transfer(void *s, uint8_t state, uint32_t len, uint8_t needed, uint32_t pos, uint32_t cur_addr, uint8_t t) "[%p] Transfer state 0x%"PRIx8" len 0x%"PRIx32" needed 0x%"PRIx8" pos 0x%"PRIx32" addr 0x%"PRIx32" tx 0x%"PRIx8

+m25p80_read_byte(void *s, uint32_t addr, uint8_t v) "[%p] Read byte 0x%"PRIx32"=0x%"PRIx8

+m25p80_read_data(void *s, uint32_t pos, uint8_t v) "[%p] Read data 0x%"PRIx32"=0x%"PRIx8

+m25p80_binding(void *s) "[%p] Binding to IF_MTD drive"

+m25p80_binding_no_bdrv(void *s) "[%p] No BDRV - binding to RAM"

--