Series comparison

-[PULL 00/11] target-arm queue
+[PULL 0/9] target-arm queue
-Last handful of arm patches before softfreeze...
+Arm queue; bugfixes only.
-The following changes since commit a98135f727595382e200d04c2996e868b7925a01:
+thanks
 -- PMM
-  Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200316-pull-request' into staging (2020-03-16 14:55:59 +0000)
+The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:
   Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200317
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117
-for you to fetch changes up to e88d3671e3bbd59d385838a4101ea19cdcf47309:
+for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:
-  hw/arm/pxa2xx: Do not wire up OHCI for PXA255 (2020-03-17 11:36:48 +0000)
+  tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)
 ----------------------------------------------------------------
-target-arm:
+target-arm queue:
- * hw/arm/pxa2xx: Do not wire up OHCI for PXA255
+ * hw/arm/virt: ARM_VIRT must select ARM_GIC
- * aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command
+ * exynos: Fix bad printf format specifiers
- * m25p80: Improve command handling for Jedec and unsupported commands
+ * hw/input/ps2.c: Remove remnants of printf debug
- * hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()
+ * target/openrisc: Remove dead code attempting to check "is timer disabled"
- * hw/arm/fsl-imx6, imx6ul: Wire up USB controllers
+ * register: Remove unnecessary NULL check
- * hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices
+ * util/cutils: Fix Coverity array overrun in freq_to_str()
  * configure: Make "does libgio work" test pull in some actual functions
  * tmp105: reset the T_low and T_High registers
  * tmp105: Correct handling of temperature limit checks
 ----------------------------------------------------------------
-Chen Qun (1):
+Alex Chen (1):
-      hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()
+      exynos: Fix bad printf format specifiers
-Guenter Roeck (10):
+Alistair Francis (1):
-      hw/usb: Add basic i.MX USB Phy support
+      register: Remove unnecessary NULL check
       hw/arm/fsl-imx6ul: Fix USB interrupt numbers
       hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices
       hw/arm/fsl-imx6ul: Wire up USB controllers
       hw/arm/fsl-imx6: Wire up USB controllers
       m25p80: Convert to support tracing
       m25p80: Improve command handling for Jedec commands
       m25p80: Improve command handling for unsupported commands
       aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command
       hw/arm/pxa2xx: Do not wire up OHCI for PXA255
- hw/usb/Makefile.objs         |   2 +
+Andrew Jones (1):
- include/hw/arm/fsl-imx6.h    |   6 ++
+      hw/arm/virt: ARM_VIRT must select ARM_GIC
  include/hw/arm/fsl-imx6ul.h  |  16 ++-
  include/hw/usb/imx-usb-phy.h |  53 ++++++++++
  hw/arm/fsl-imx6.c            |  36 +++++++
  hw/arm/fsl-imx6ul.c          |  49 ++++++++++
  hw/arm/pxa2xx.c              |   3 -
  hw/block/m25p80.c            |  58 +++++------
  hw/net/imx_fec.c             |   6 +-
  hw/ssi/aspeed_smc.c          |   2 +-
  hw/usb/imx-usb-phy.c         | 225 +++++++++++++++++++++++++++++++++++++++++++
  MAINTAINERS                  |   2 +
  hw/arm/Kconfig               |   1 +
  hw/block/trace-events        |  16 +++
  hw/usb/Kconfig               |   5 +
 files changed, 444 insertions(+), 36 deletions(-)
  create mode 100644 include/hw/usb/imx-usb-phy.h
  create mode 100644 hw/usb/imx-usb-phy.c
+Peter Maydell (5):
+      hw/input/ps2.c: Remove remnants of printf debug
+      target/openrisc: Remove dead code attempting to check "is timer disabled"
+      configure: Make "does libgio work" test pull in some actual functions
+      hw/misc/tmp105: reset the T_low and T_High registers
+      tmp105: Correct handling of temperature limit checks
+Philippe Mathieu-Daudé (1):
+      util/cutils: Fix Coverity array overrun in freq_to_str()
+ configure                    | 11 +++++--
+ hw/misc/tmp105.h             |  7 +++++
+ hw/core/register.c           |  4 ---
+ hw/input/ps2.c               |  9 ------
+ hw/misc/tmp105.c             | 73 ++++++++++++++++++++++++++++++++++++++------
+ hw/timer/exynos4210_mct.c    |  4 +--
+ hw/timer/exynos4210_pwm.c    |  8 ++---
+ target/openrisc/sys_helper.c |  3 --
+ util/cutils.c                |  3 +-
+ hw/arm/Kconfig               |  1 +
+files changed, 89 insertions(+), 34 deletions(-)

-[PULL 01/11] hw/usb: Add basic i.MX USB Phy support
+[PULL 1/9] hw/arm/virt: ARM_VIRT must select ARM_GIC
-From: Guenter Roeck <linux@roeck-us.net>
+From: Andrew Jones <drjones@redhat.com>
-Add basic USB PHY support as implemented in i.MX23, i.MX28, i.MX6,
+The removal of the selection of A15MPCORE from ARM_VIRT also
-and i.MX7 SoCs.
+removed what A15MPCORE selects, ARM_GIC. We still need ARM_GIC.
-The only support really needed - at least to boot Linux - is support
+Fixes: bec3c97e0cf9 ("hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals")
-for soft reset, which needs to reset various registers to their initial
+Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
-value. Otherwise, just record register values.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Message-id: 20201111143440.112763-1-drjones@redhat.com
 Message-id: 20200313014551.12554-2-linux@roeck-us.net
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/usb/Makefile.objs         |   2 +
+ hw/arm/Kconfig | 1 +
- include/hw/usb/imx-usb-phy.h |  53 +++++++++
+file changed, 1 insertion(+)
  hw/usb/imx-usb-phy.c         | 225 +++++++++++++++++++++++++++++++++++
  MAINTAINERS                  |   2 +
  hw/arm/Kconfig               |   1 +
  hw/usb/Kconfig               |   5 +
 files changed, 288 insertions(+)
  create mode 100644 include/hw/usb/imx-usb-phy.h
  create mode 100644 hw/usb/imx-usb-phy.c
-diff --git a/hw/usb/Makefile.objs b/hw/usb/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/hw/usb/Makefile.objs
-+++ b/hw/usb/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_XEN) += xen-usb.o
- xen-usb.o-cflags := $(LIBUSB_CFLAGS)
- xen-usb.o-libs := $(LIBUSB_LIBS)
- endif
-+
-+common-obj-$(CONFIG_IMX_USBPHY) += imx-usb-phy.o
-diff --git a/include/hw/usb/imx-usb-phy.h b/include/hw/usb/imx-usb-phy.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/usb/imx-usb-phy.h
-@@ -XXX,XX +XXX,XX @@
-+#ifndef IMX_USB_PHY_H
-+#define IMX_USB_PHY_H
-+
-+#include "hw/sysbus.h"
-+#include "qemu/bitops.h"
-+
-+enum IMXUsbPhyRegisters {
-+    USBPHY_PWD,
-+    USBPHY_PWD_SET,
-+    USBPHY_PWD_CLR,
-+    USBPHY_PWD_TOG,
-+    USBPHY_TX,
-+    USBPHY_TX_SET,
-+    USBPHY_TX_CLR,
-+    USBPHY_TX_TOG,
-+    USBPHY_RX,
-+    USBPHY_RX_SET,
-+    USBPHY_RX_CLR,
-+    USBPHY_RX_TOG,
-+    USBPHY_CTRL,
-+    USBPHY_CTRL_SET,
-+    USBPHY_CTRL_CLR,
-+    USBPHY_CTRL_TOG,
-+    USBPHY_STATUS,
-+    USBPHY_DEBUG = 0x14,
-+    USBPHY_DEBUG_SET,
-+    USBPHY_DEBUG_CLR,
-+    USBPHY_DEBUG_TOG,
-+    USBPHY_DEBUG0_STATUS,
-+    USBPHY_DEBUG1 = 0x1c,
-+    USBPHY_DEBUG1_SET,
-+    USBPHY_DEBUG1_CLR,
-+    USBPHY_DEBUG1_TOG,
-+    USBPHY_VERSION,
-+    USBPHY_MAX
-+};
-+
-+#define USBPHY_CTRL_SFTRST BIT(31)
-+
-+#define TYPE_IMX_USBPHY "imx.usbphy"
-+#define IMX_USBPHY(obj) OBJECT_CHECK(IMXUSBPHYState, (obj), TYPE_IMX_USBPHY)
-+
-+typedef struct IMXUSBPHYState {
-+    /* <private> */
-+    SysBusDevice parent_obj;
-+
-+    /* <public> */
-+    MemoryRegion iomem;
-+
-+    uint32_t usbphy[USBPHY_MAX];
-+} IMXUSBPHYState;
-+
-+#endif /* IMX_USB_PHY_H */
-diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/usb/imx-usb-phy.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * i.MX USB PHY
-+ *
-+ * Copyright (c) 2020 Guenter Roeck <linux@roeck-us.net>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ *
-+ * We need to implement basic reset control in the PHY control register.
-+ * For everything else, it is sufficient to set whatever is written.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "hw/usb/imx-usb-phy.h"
-+#include "migration/vmstate.h"
-+#include "qemu/log.h"
-+#include "qemu/module.h"
-+
-+static const VMStateDescription vmstate_imx_usbphy = {
-+    .name = TYPE_IMX_USBPHY,
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT32_ARRAY(usbphy, IMXUSBPHYState, USBPHY_MAX),
-+        VMSTATE_END_OF_LIST()
-+    },
-+};
-+
-+static void imx_usbphy_softreset(IMXUSBPHYState *s)
-+{
-+    s->usbphy[USBPHY_PWD] = 0x001e1c00;
-+    s->usbphy[USBPHY_TX] = 0x10060607;
-+    s->usbphy[USBPHY_RX] = 0x00000000;
-+    s->usbphy[USBPHY_CTRL] = 0xc0200000;
-+}
-+
-+static void imx_usbphy_reset(DeviceState *dev)
-+{
-+    IMXUSBPHYState *s = IMX_USBPHY(dev);
-+
-+    s->usbphy[USBPHY_STATUS] = 0x00000000;
-+    s->usbphy[USBPHY_DEBUG] = 0x7f180000;
-+    s->usbphy[USBPHY_DEBUG0_STATUS] = 0x00000000;
-+    s->usbphy[USBPHY_DEBUG1] = 0x00001000;
-+    s->usbphy[USBPHY_VERSION] = 0x04020000;
-+
-+    imx_usbphy_softreset(s);
-+}
-+
-+static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
-+{
-+    IMXUSBPHYState *s = (IMXUSBPHYState *)opaque;
-+    uint32_t index = offset >> 2;
-+    uint32_t value;
-+
-+    switch (index) {
-+    case USBPHY_PWD_SET:
-+    case USBPHY_TX_SET:
-+    case USBPHY_RX_SET:
-+    case USBPHY_CTRL_SET:
-+    case USBPHY_DEBUG_SET:
-+    case USBPHY_DEBUG1_SET:
-+        /*
-+         * All REG_NAME_SET register access are in fact targeting the
-+         * REG_NAME register.
-+         */
-+        value = s->usbphy[index - 1];
-+        break;
-+    case USBPHY_PWD_CLR:
-+    case USBPHY_TX_CLR:
-+    case USBPHY_RX_CLR:
-+    case USBPHY_CTRL_CLR:
-+    case USBPHY_DEBUG_CLR:
-+    case USBPHY_DEBUG1_CLR:
-+        /*
-+         * All REG_NAME_CLR register access are in fact targeting the
-+         * REG_NAME register.
-+         */
-+        value = s->usbphy[index - 2];
-+        break;
-+    case USBPHY_PWD_TOG:
-+    case USBPHY_TX_TOG:
-+    case USBPHY_RX_TOG:
-+    case USBPHY_CTRL_TOG:
-+    case USBPHY_DEBUG_TOG:
-+    case USBPHY_DEBUG1_TOG:
-+        /*
-+         * All REG_NAME_TOG register access are in fact targeting the
-+         * REG_NAME register.
-+         */
-+        value = s->usbphy[index - 3];
-+        break;
-+    default:
-+        value = s->usbphy[index];
-+        break;
-+    }
-+    return (uint64_t)value;
-+}
-+
-+static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
-+                             unsigned size)
-+{
-+    IMXUSBPHYState *s = (IMXUSBPHYState *)opaque;
-+    uint32_t index = offset >> 2;
-+
-+    switch (index) {
-+    case USBPHY_CTRL:
-+        s->usbphy[index] = value;
-+        if (value & USBPHY_CTRL_SFTRST) {
-+            imx_usbphy_softreset(s);
-+        }
-+        break;
-+    case USBPHY_PWD:
-+    case USBPHY_TX:
-+    case USBPHY_RX:
-+    case USBPHY_STATUS:
-+    case USBPHY_DEBUG:
-+    case USBPHY_DEBUG1:
-+        s->usbphy[index] = value;
-+        break;
-+    case USBPHY_CTRL_SET:
-+        s->usbphy[index - 1] |= value;
-+        if (value & USBPHY_CTRL_SFTRST) {
-+            imx_usbphy_softreset(s);
-+        }
-+        break;
-+    case USBPHY_PWD_SET:
-+    case USBPHY_TX_SET:
-+    case USBPHY_RX_SET:
-+    case USBPHY_DEBUG_SET:
-+    case USBPHY_DEBUG1_SET:
-+        /*
-+         * All REG_NAME_SET register access are in fact targeting the
-+         * REG_NAME register. So we change the value of the REG_NAME
-+         * register, setting bits passed in the value.
-+         */
-+        s->usbphy[index - 1] |= value;
-+        break;
-+    case USBPHY_PWD_CLR:
-+    case USBPHY_TX_CLR:
-+    case USBPHY_RX_CLR:
-+    case USBPHY_CTRL_CLR:
-+    case USBPHY_DEBUG_CLR:
-+    case USBPHY_DEBUG1_CLR:
-+        /*
-+         * All REG_NAME_CLR register access are in fact targeting the
-+         * REG_NAME register. So we change the value of the REG_NAME
-+         * register, unsetting bits passed in the value.
-+         */
-+        s->usbphy[index - 2] &= ~value;
-+        break;
-+    case USBPHY_CTRL_TOG:
-+        s->usbphy[index - 3] ^= value;
-+        if ((value & USBPHY_CTRL_SFTRST) &&
-+            (s->usbphy[index - 3] & USBPHY_CTRL_SFTRST)) {
-+            imx_usbphy_softreset(s);
-+        }
-+        break;
-+    case USBPHY_PWD_TOG:
-+    case USBPHY_TX_TOG:
-+    case USBPHY_RX_TOG:
-+    case USBPHY_DEBUG_TOG:
-+    case USBPHY_DEBUG1_TOG:
-+        /*
-+         * All REG_NAME_TOG register access are in fact targeting the
-+         * REG_NAME register. So we change the value of the REG_NAME
-+         * register, toggling bits passed in the value.
-+         */
-+        s->usbphy[index - 3] ^= value;
-+        break;
-+    default:
-+        /* Other registers are read-only */
-+        break;
-+    }
-+}
-+
-+static const struct MemoryRegionOps imx_usbphy_ops = {
-+    .read = imx_usbphy_read,
-+    .write = imx_usbphy_write,
-+    .endianness = DEVICE_NATIVE_ENDIAN,
-+    .valid = {
-+        /*
-+         * Our device would not work correctly if the guest was doing
-+         * unaligned access. This might not be a limitation on the real
-+         * device but in practice there is no reason for a guest to access
-+         * this device unaligned.
-+         */
-+        .min_access_size = 4,
-+        .max_access_size = 4,
-+        .unaligned = false,
-+    },
-+};
-+
-+static void imx_usbphy_realize(DeviceState *dev, Error **errp)
-+{
-+    IMXUSBPHYState *s = IMX_USBPHY(dev);
-+
-+    memory_region_init_io(&s->iomem, OBJECT(s), &imx_usbphy_ops, s,
-+                          "imx-usbphy", 0x1000);
-+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
-+}
-+
-+static void imx_usbphy_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+
-+    dc->reset = imx_usbphy_reset;
-+    dc->vmsd = &vmstate_imx_usbphy;
-+    dc->desc = "i.MX USB PHY Module";
-+    dc->realize = imx_usbphy_realize;
-+}
-+
-+static const TypeInfo imx_usbphy_info = {
-+    .name          = TYPE_IMX_USBPHY,
-+    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .instance_size = sizeof(IMXUSBPHYState),
-+    .class_init    = imx_usbphy_class_init,
-+};
-+
-+static void imx_usbphy_register_types(void)
-+{
-+    type_register_static(&imx_usbphy_info);
-+}
-+
-+type_init(imx_usbphy_register_types)
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: hw/arm/sabrelite.c
- F: hw/arm/fsl-imx6.c
- F: hw/misc/imx6_*.c
- F: hw/ssi/imx_spi.c
-+F: hw/usb/imx-usb-phy.c
-+F: include/hw/usb/imx-usb-phy.h
- F: include/hw/arm/fsl-imx6.h
- F: include/hw/misc/imx6_*.h
- F: include/hw/ssi/imx_spi.h
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
-     select IMX
+     imply VFIO_PLATFORM
-     select IMX_FEC
+     imply VFIO_XGMAC
-     select IMX_I2C
+     imply TPM_TIS_SYSBUS
-+    select IMX_USBPHY
++    select ARM_GIC
-     select SDHCI
+     select ACPI
+     select ARM_SMMUV3
- config ASPEED_SOC
+     select GPIO_KEY
 diff --git a/hw/usb/Kconfig b/hw/usb/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/usb/Kconfig
 +++ b/hw/usb/Kconfig
@@ -XXX,XX +XXX,XX @@ config USB_STORAGE_MTP
      bool
      default y
      depends on USB
 +
 +config IMX_USBPHY
 +    bool
 +    default y
 +    depends on USB
 --
 .20.1

-[PULL 02/11] hw/arm/fsl-imx6ul: Fix USB interrupt numbers
+Deleted patch
-From: Guenter Roeck <linux@roeck-us.net>
-USB1 and USB2 interrupt numbers were swapped. USB_PHY2 interrupt number
-is 45. That didn't really matter up to now since the interrupts were not
-used, but it needs to be fixed to be able to wire up the USB controllers.
-Fixes: 31cbf933f0e ("i.MX6UL: Add i.MX6UL SOC")
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Message-id: 20200313014551.12554-3-linux@roeck-us.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/fsl-imx6ul.h | 6 +++---
-file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6ul.h
-+++ b/include/hw/arm/fsl-imx6ul.h
-@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULIRQs {
-     FSL_IMX6UL_UART7_IRQ    = 39,
-     FSL_IMX6UL_UART8_IRQ    = 40,
--    FSL_IMX6UL_USB1_IRQ     = 42,
--    FSL_IMX6UL_USB2_IRQ     = 43,
-+    FSL_IMX6UL_USB1_IRQ     = 43,
-+    FSL_IMX6UL_USB2_IRQ     = 42,
-     FSL_IMX6UL_USB_PHY1_IRQ = 44,
--    FSL_IMX6UL_USB_PHY2_IRQ = 44,
-+    FSL_IMX6UL_USB_PHY2_IRQ = 45,
-     FSL_IMX6UL_CAAM_JQ2_IRQ = 46,
-     FSL_IMX6UL_CAAM_ERR_IRQ = 47,
---
-.20.1

-[PULL 03/11] hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices
+Deleted patch
-From: Guenter Roeck <linux@roeck-us.net>
-Recent Linux kernels (post v4.20) crash due to accesses to flexcan
-and pwm controllers. Instantiate as unimplemented devices to work
-around the problem.
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Message-id: 20200313014551.12554-4-linux@roeck-us.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/fsl-imx6ul.c | 14 ++++++++++++++
-file changed, 14 insertions(+)
-diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx6ul.c
-+++ b/hw/arm/fsl-imx6ul.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
-      */
-     create_unimplemented_device("sdma", FSL_IMX6UL_SDMA_ADDR, 0x4000);
-+    /*
-+     * PWM
-+     */
-+    create_unimplemented_device("pwm1", FSL_IMX6UL_PWM1_ADDR, 0x4000);
-+    create_unimplemented_device("pwm2", FSL_IMX6UL_PWM2_ADDR, 0x4000);
-+    create_unimplemented_device("pwm3", FSL_IMX6UL_PWM3_ADDR, 0x4000);
-+    create_unimplemented_device("pwm4", FSL_IMX6UL_PWM4_ADDR, 0x4000);
-+
-+    /*
-+     * CAN
-+     */
-+    create_unimplemented_device("can1", FSL_IMX6UL_CAN1_ADDR, 0x4000);
-+    create_unimplemented_device("can2", FSL_IMX6UL_CAN2_ADDR, 0x4000);
-+
-     /*
-      * APHB_DMA
-      */
---
-.20.1

-[PULL 06/11] hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()
+[PULL 2/9] exynos: Fix bad printf format specifiers
-From: Chen Qun <kuhn.chenqun@huawei.com>
+From: Alex Chen <alex.chen@huawei.com>
-The current code causes clang static code analyzer generate warning:
+We should use printf format specifier "%u" instead of "%d" for
-hw/net/imx_fec.c:858:9: warning: Value stored to 'value' is never read
+argument of type "unsigned int".
         value = value & 0x0000000f;
         ^       ~~~~~~~~~~~~~~~~~~
 hw/net/imx_fec.c:864:9: warning: Value stored to 'value' is never read
         value = value & 0x000000fd;
         ^       ~~~~~~~~~~~~~~~~~~
 According to the definition of the function, the two “value” assignments
  should be written to registers.
 Reported-by: Euler Robot <euler.robot@huawei.com>
-Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
-Message-id: 20200313123242.13236-1-kuhn.chenqun@huawei.com
+Message-id: 20201111073651.72804-1-alex.chen@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/imx_fec.c | 6 ++++--
+ hw/timer/exynos4210_mct.c | 4 ++--
-file changed, 4 insertions(+), 2 deletions(-)
+ hw/timer/exynos4210_pwm.c | 8 ++++----
 files changed, 6 insertions(+), 6 deletions(-)
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
+--- a/hw/timer/exynos4210_mct.c
-+++ b/hw/net/imx_fec.c
++++ b/hw/timer/exynos4210_mct.c
-@@ -XXX,XX +XXX,XX @@ static void imx_enet_write(IMXFECState *s, uint32_t index, uint32_t value)
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
-         break;
+     /* If CSTAT is pending and IRQ is enabled */
-     case ENET_TGSR:
+     if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
-         /* implement clear timer flag */
+             (s->reg.int_enb & G_INT_ENABLE(id))) {
--        value = value & 0x0000000f;
+-        DPRINTF("gcmp timer[%d] IRQ\n", id);
-+        s->regs[index] &= ~(value & 0x0000000f); /* all bits W1C */
++        DPRINTF("gcmp timer[%u] IRQ\n", id);
-         break;
+         qemu_irq_raise(s->irq[id]);
-     case ENET_TCSR0:
+     }
-     case ENET_TCSR1:
+ }
-     case ENET_TCSR2:
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
-     case ENET_TCSR3:
+                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
--        value = value & 0x000000fd;
-+        s->regs[index] &= ~(value & 0x00000080); /* W1C bits */
+     if (freq != s->freq) {
-+        s->regs[index] &= ~0x0000007d; /* writable fields */
+-        DPRINTF("freq=%dHz\n", s->freq);
-+        s->regs[index] |= (value & 0x0000007d);
++        DPRINTF("freq=%uHz\n", s->freq);
-         break;
-     case ENET_TCCR0:
+         /* global timer */
-     case ENET_TCCR1:
+         tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
 diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/exynos4210_pwm.c
 +++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
      if (freq != s->timer[id].freq) {
          ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
 -        DPRINTF("freq=%dHz\n", s->timer[id].freq);
 +        DPRINTF("freq=%uHz\n", s->timer[id].freq);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
      uint32_t id = s->id;
      bool cmp;
 -    DPRINTF("timer %d tick\n", id);
 +    DPRINTF("timer %u tick\n", id);
      /* set irq status */
      p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
      /* raise IRQ */
      if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
 -        DPRINTF("timer %d IRQ\n", id);
 +        DPRINTF("timer %u IRQ\n", id);
          qemu_irq_raise(p->timer[id].irq);
      }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
      }
      if (cmp) {
 -        DPRINTF("auto reload timer %d count to %x\n", id,
 +        DPRINTF("auto reload timer %u count to %x\n", id,
                  p->timer[id].reg_tcntb);
          ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
          ptimer_run(p->timer[id].ptimer, 1);
 --
 .20.1

-[PULL 10/11] aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command
+[PULL 3/9] hw/input/ps2.c: Remove remnants of printf debug
-From: Guenter Roeck <linux@roeck-us.net>
+In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
 and mouse emulation. However we didn't remove all the debug-by-printf
 support. In fact there is only one printf() remaining, and it is
 redundant with the trace_ps2_write_mouse() event next to it.
 Remove the printf() and the now-unused DEBUG* macros.
-The Linux kernel recently started using FAST_READ_4 commands.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-This results in flash read failures. At the same time, the m25p80
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-emulation is seen to read 8 more bytes than expected. Adjusting the
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
-expected number of dummy cycles to match FAST_READ fixes the problem.
+Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
 ---
  hw/input/ps2.c | 9 ---------
 file changed, 9 deletions(-)
-Fixes: f95c4bffdc4c ("aspeed/smc: snoop SPI transfers to fake dummy cycles")
+diff --git a/hw/input/ps2.c b/hw/input/ps2.c
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/ssi/aspeed_smc.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/aspeed_smc.c
+--- a/hw/input/ps2.c
-+++ b/hw/ssi/aspeed_smc.c
++++ b/hw/input/ps2.c
-@@ -XXX,XX +XXX,XX @@ static int aspeed_smc_num_dummies(uint8_t command)
+@@ -XXX,XX +XXX,XX @@
-     case FAST_READ:
-     case DOR:
+ #include "trace.h"
-     case QOR:
-+    case FAST_READ_4:
+-/* debug PC keyboard */
-     case DOR_4:
+-//#define DEBUG_KBD
-     case QOR_4:
+-
-         return 1;
+-/* debug PC keyboard : only mouse */
-     case DIOR:
+-//#define DEBUG_MOUSE
--    case FAST_READ_4:
+-
-     case DIOR_4:
+ /* Keyboard Commands */
-         return 2;
+ #define KBD_CMD_SET_LEDS    0xED    /* Set keyboard leds */
-     case QIOR:
+ #define KBD_CMD_ECHO         0xEE
@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
      PS2MouseState *s = (PS2MouseState *)opaque;
      trace_ps2_write_mouse(opaque, val);
 -#ifdef DEBUG_MOUSE
 -    printf("kbd: write mouse 0x%02x\n", val);
 -#endif
      switch(s->common.write_cmd) {
      default:
      case -1:
 --
 .20.1

-[PULL 09/11] m25p80: Improve command handling for unsupported commands
+[PULL 4/9] target/openrisc: Remove dead code attempting to check "is timer disabled"
-From: Guenter Roeck <linux@roeck-us.net>
+In the mtspr helper we attempt to check for "is the timer disabled"
 with "if (env->ttmr & TIMER_NONE)".  This is wrong because TIMER_NONE
 is zero and the condition is always false (Coverity complains about
 the dead code.)
-Whenever an unsupported command is encountered, the current code
+The correct check would be to test whether the TTMR_M field in the
-interprets each transferred byte as new command. Most of the time, those
+register is equal to TIMER_NONE instead.  However, the
-'commands' are interpreted as new unknown commands. However, in rare
+cpu_openrisc_timer_update() function checks whether the timer is
-cases, it may be that for example address or length information
+enabled (it looks at cpu->env.is_counting, which is set to 0 via
-passed with the original command is by itself a valid command.
+cpu_openrisc_count_stop() when the TTMR_M field is set to
-If that happens, the state machine may get completely confused and,
+TIMER_NONE), so there's no need to check for "timer disabled" in the
-worst case, start writing data into the flash or even erase it.
+target/openrisc code.  Instead, simply remove the dead code.
-To avoid the problem, transition into STATE_READING_DATA and keep
+Fixes: Coverity CID 1005812
-sending a value of 0 until the chip is deselected after encountering
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-an unsupported command.
+Acked-by: Stafford Horne <shorne@gmail.com>
 Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
 ---
  target/openrisc/sys_helper.c | 3 ---
 file changed, 3 deletions(-)
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/block/m25p80.c | 5 +++++
 file changed, 5 insertions(+)
 diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/target/openrisc/sys_helper.c
-+++ b/hw/block/m25p80.c
++++ b/target/openrisc/sys_helper.c
-@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
+@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
-         s->quad_enable = false;
      case TO_SPR(10, 1): /* TTCR */
          cpu_openrisc_count_set(cpu, rb);
 -        if (env->ttmr & TIMER_NONE) {
 -            return;
 -        }
          cpu_openrisc_timer_update(cpu);
          break;
-     default:
+ #endif
 +        s->pos = 0;
 +        s->len = 1;
 +        s->state = STATE_READING_DATA;
 +        s->data_read_loop = true;
 +        s->data[0] = 0;
          qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Unknown cmd %x\n", value);
          break;
      }
 --
 .20.1

-[PULL 11/11] hw/arm/pxa2xx: Do not wire up OHCI for PXA255
+[PULL 5/9] register: Remove unnecessary NULL check
-From: Guenter Roeck <linux@roeck-us.net>
+From: Alistair Francis <alistair.francis@wdc.com>
-PXA255 does not support a USB OHCI controller, so don't wire it up.
+This patch fixes CID 1432800 by removing an unnecessary check.
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20200313160215.28155-1-linux@roeck-us.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/pxa2xx.c | 3 ---
+ hw/core/register.c | 4 ----
-file changed, 3 deletions(-)
+file changed, 4 deletions(-)
-diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
+diff --git a/hw/core/register.c b/hw/core/register.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/pxa2xx.c
+--- a/hw/core/register.c
-+++ b/hw/arm/pxa2xx.c
++++ b/hw/core/register.c
-@@ -XXX,XX +XXX,XX @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
+@@ -XXX,XX +XXX,XX @@ static RegisterInfoArray *register_init_block(DeviceState *owner,
-         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
+         int index = rae[i].addr / data_size;
-     }
+         RegisterInfo *r = &ri[index];
--    sysbus_create_simple("sysbus-ohci", 0x4c000000,
+-        if (data + data_size * index == 0 || !&rae[i]) {
--                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_USBH1));
+-            continue;
 -        }
 -
-     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
+         /* Init the register, this will zero it. */
-     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
+         object_initialize((void *)r, sizeof(*r), TYPE_REGISTER);
 --
 .20.1

-[PULL 08/11] m25p80: Improve command handling for Jedec commands
+[PULL 6/9] util/cutils: Fix Coverity array overrun in freq_to_str()
-From: Guenter Roeck <linux@roeck-us.net>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-When requesting JEDEC data using the JEDEC_READ command, the Linux kernel
+Fix Coverity CID 1435957:  Memory - illegal accesses (OVERRUN):
 always requests 6 bytes. The current implementation only returns three
 bytes, and interprets the remaining three bytes as new commands.
 While this does not matter most of the time, it is at the very least
 confusing. To avoid the problem, always report up to 6 bytes of JEDEC
 data. Fill remaining data with 0.
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+>>> Overrunning array "suffixes" of 7 8-byte elements at element
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+    index 7 (byte offset 63) using index "idx" (which evaluates to 7).
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
 which is ~18.446 EHz, less than 1000 EHz.
 Reported-by: Eduardo Habkost <ehabkost@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Message-id: 20201101215755.2021421-1-f4bug@amsat.org
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/block/m25p80.c | 5 ++++-
+ util/cutils.c | 3 ++-
-file changed, 4 insertions(+), 1 deletion(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
+diff --git a/util/cutils.c b/util/cutils.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/util/cutils.c
-+++ b/hw/block/m25p80.c
++++ b/util/cutils.c
-@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
+@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
-         for (i = 0; i < s->pi->id_len; i++) {
+     double freq = freq_hz;
-             s->data[i] = s->pi->id[i];
+     size_t idx = 0;
-         }
-+        for (; i < SPI_NOR_MAX_ID_LEN; i++) {
+-    while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
-+            s->data[i] = 0;
++    while (freq >= 1000.0) {
-+        }
+         freq /= 1000.0;
+         idx++;
--        s->len = s->pi->id_len;
+     }
-+        s->len = SPI_NOR_MAX_ID_LEN;
++    assert(idx < ARRAY_SIZE(suffixes));
-         s->pos = 0;
-         s->state = STATE_READING_DATA;
+     return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
-         break;
+ }
 --
 .20.1

-[PULL 05/11] hw/arm/fsl-imx6: Wire up USB controllers
+[PULL 7/9] configure: Make "does libgio work" test pull in some actual functions
-From: Guenter Roeck <linux@roeck-us.net>
+In commit 76346b6264a9b01979 we tried to add a configure check that
 the libgio pkg-config data was correct, which builds an executable
 linked against it.  Unfortunately this doesn't catch the problem
 (missing static library dependency info), because a "do nothing" test
 source file doesn't have any symbol references that cause the linker
 to pull in .o files from libgio.a, and so we don't see the "missing
 symbols from libmount" error that a full QEMU link triggers.
-With this patch, the USB controllers on 'sabrelite' are detected
+(The ineffective test went unnoticed because of a typo that
-and can be used to boot the system.
+effectively disabled libgio unconditionally, but after commit
 a5dfc11f2 fixed that, a static link of the system emulator on
 Ubuntu stopped working again.)
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Improve the gio test by having the test source fragment reference a
-Message-id: 20200313014551.12554-6-linux@roeck-us.net
+g_dbus function (which is what is indirectly causing us to end up
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+wanting functions from libmount).
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
 ---
- include/hw/arm/fsl-imx6.h |  6 ++++++
+ configure | 11 +++++++++--
- hw/arm/fsl-imx6.c         | 36 ++++++++++++++++++++++++++++++++++++
+file changed, 9 insertions(+), 2 deletions(-)
 files changed, 42 insertions(+)
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100644
+index XXXXXXX..XXXXXXX 100755
---- a/include/hw/arm/fsl-imx6.h
+--- a/configure
-+++ b/include/hw/arm/fsl-imx6.h
++++ b/configure
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
- #include "hw/sd/sdhci.h"
+     # Check that the libraries actually work -- Ubuntu 18.04 ships
- #include "hw/ssi/imx_spi.h"
+     # with pkg-config --static --libs data for gio-2.0 that is missing
- #include "hw/net/imx_fec.h"
+     # -lblkid and will give a link error.
-+#include "hw/usb/chipidea.h"
+-    write_c_skeleton
-+#include "hw/usb/imx-usb-phy.h"
+-    if compile_prog "" "$gio_libs" ; then
- #include "exec/memory.h"
++    cat > $TMPC <<EOF
- #include "cpu.h"
++#include <gio/gio.h>
++int main(void)
-@@ -XXX,XX +XXX,XX @@
++{
- #define FSL_IMX6_NUM_ESDHCS 4
++    g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
- #define FSL_IMX6_NUM_ECSPIS 5
++    return 0;
- #define FSL_IMX6_NUM_WDTS 2
++}
-+#define FSL_IMX6_NUM_USB_PHYS 2
++EOF
-+#define FSL_IMX6_NUM_USBS 4
++    if compile_prog "$gio_cflags" "$gio_libs" ; then
+         gio=yes
- typedef struct FslIMX6State {
+     else
-     /*< private >*/
+         gio=no
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
      SDHCIState     esdhc[FSL_IMX6_NUM_ESDHCS];
      IMXSPIState    spi[FSL_IMX6_NUM_ECSPIS];
      IMX2WdtState   wdt[FSL_IMX6_NUM_WDTS];
 +    IMXUSBPHYState usbphy[FSL_IMX6_NUM_USB_PHYS];
 +    ChipideaState  usb[FSL_IMX6_NUM_USBS];
      IMXFECState    eth;
      MemoryRegion   rom;
      MemoryRegion   caam;
 diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fsl-imx6.c
 +++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "hw/arm/fsl-imx6.h"
 +#include "hw/usb/imx-usb-phy.h"
  #include "hw/boards.h"
  #include "hw/qdev-properties.h"
  #include "sysemu/sysemu.h"
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
                                TYPE_IMX_USDHC);
      }
 +    for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {
 +        snprintf(name, NAME_SIZE, "usbphy%d", i);
 +        sysbus_init_child_obj(obj, name, &s->usbphy[i], sizeof(s->usbphy[i]),
 +                              TYPE_IMX_USBPHY);
 +    }
 +    for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {
 +        snprintf(name, NAME_SIZE, "usb%d", i);
 +        sysbus_init_child_obj(obj, name, &s->usb[i], sizeof(s->usb[i]),
 +                              TYPE_CHIPIDEA);
 +    }
 +
      for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {
          snprintf(name, NAME_SIZE, "spi%d", i + 1);
          sysbus_init_child_obj(obj, name, &s->spi[i], sizeof(s->spi[i]),
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                              esdhc_table[i].irq));
      }
 +    /* USB */
 +    for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {
 +        object_property_set_bool(OBJECT(&s->usbphy[i]), true, "realized",
 +                                 &error_abort);
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usbphy[i]), 0,
 +                        FSL_IMX6_USBPHY1_ADDR + i * 0x1000);
 +    }
 +    for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {
 +        static const int FSL_IMX6_USBn_IRQ[] = {
 +            FSL_IMX6_USB_OTG_IRQ,
 +            FSL_IMX6_USB_HOST1_IRQ,
 +            FSL_IMX6_USB_HOST2_IRQ,
 +            FSL_IMX6_USB_HOST3_IRQ,
 +        };
 +
 +        object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",
 +                                 &error_abort);
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
 +                        FSL_IMX6_USBOH3_USB_ADDR + i * 0x200);
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
 +                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
 +                                            FSL_IMX6_USBn_IRQ[i]));
 +    }
 +
      /* Initialize all ECSPI */
      for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {
          static const struct {
 --
 .20.1

-[PULL 04/11] hw/arm/fsl-imx6ul: Wire up USB controllers
+[PULL 8/9] hw/misc/tmp105: reset the T_low and T_High registers
-From: Guenter Roeck <linux@roeck-us.net>
+The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
 power-up reset values for the T_low and T_high registers are 80 degrees C
 and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5.  These
 values are then shifted right by four bits to give the register reset
 values, since both registers store the 12 bits of temperature data in bits
 [15..4] of a 16 bit register.
-IMX6UL USB controllers are quite similar to IMX7 USB controllers.
+We were resetting these registers to zero, which is problematic for Linux
-Wire them up the same way.
+guests which enable the alert interrupt and then immediately take an
 unexpected overtemperature alert because the current temperature is above
 freezing...
-The only real difference is that wiring up phy devices is necessary
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-to avoid phy reset timeouts in the Linux kernel.
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
 ---
  hw/misc/tmp105.c | 3 +++
 file changed, 3 insertions(+)
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
 Message-id: 20200313014551.12554-5-linux@roeck-us.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/arm/fsl-imx6ul.h | 10 ++++++++++
  hw/arm/fsl-imx6ul.c         | 35 +++++++++++++++++++++++++++++++++++
 files changed, 45 insertions(+)
 diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6ul.h
+--- a/hw/misc/tmp105.c
-+++ b/include/hw/arm/fsl-imx6ul.h
++++ b/hw/misc/tmp105.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
- #include "hw/sd/sdhci.h"
+     s->faults = tmp105_faultq[(s->config >> 3) & 3];
- #include "hw/ssi/imx_spi.h"
+     s->alarm = 0;
- #include "hw/net/imx_fec.h"
-+#include "hw/usb/chipidea.h"
++    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
-+#include "hw/usb/imx-usb-phy.h"
++    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
  #include "exec/memory.h"
  #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULConfiguration {
      FSL_IMX6UL_NUM_I2CS         = 4,
      FSL_IMX6UL_NUM_ECSPIS       = 4,
      FSL_IMX6UL_NUM_ADCS         = 2,
 +    FSL_IMX6UL_NUM_USB_PHYS     = 2,
 +    FSL_IMX6UL_NUM_USBS         = 2,
  };
  typedef struct FslIMX6ULState {
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6ULState {
      IMXFECState        eth[FSL_IMX6UL_NUM_ETHS];
      SDHCIState         usdhc[FSL_IMX6UL_NUM_USDHCS];
      IMX2WdtState       wdt[FSL_IMX6UL_NUM_WDTS];
 +    IMXUSBPHYState     usbphy[FSL_IMX6UL_NUM_USB_PHYS];
 +    ChipideaState      usb[FSL_IMX6UL_NUM_USBS];
      MemoryRegion       rom;
      MemoryRegion       caam;
      MemoryRegion       ocram;
@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULMemoryMap {
      FSL_IMX6UL_EPIT2_ADDR           = 0x020D4000,
      FSL_IMX6UL_EPIT1_ADDR           = 0x020D0000,
      FSL_IMX6UL_SNVS_HP_ADDR         = 0x020CC000,
 +    FSL_IMX6UL_USBPHY2_ADDR         = 0x020CA000,
 +    FSL_IMX6UL_USBPHY2_SIZE         = (4 * 1024),
 +    FSL_IMX6UL_USBPHY1_ADDR         = 0x020C9000,
 +    FSL_IMX6UL_USBPHY1_SIZE         = (4 * 1024),
      FSL_IMX6UL_ANALOG_ADDR          = 0x020C8000,
      FSL_IMX6UL_CCM_ADDR             = 0x020C4000,
      FSL_IMX6UL_WDOG2_ADDR           = 0x020C0000,
 diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fsl-imx6ul.c
 +++ b/hw/arm/fsl-imx6ul.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/arm/fsl-imx6ul.h"
  #include "hw/misc/unimp.h"
 +#include "hw/usb/imx-usb-phy.h"
  #include "hw/boards.h"
  #include "sysemu/sysemu.h"
  #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_init(Object *obj)
                                TYPE_IMX_ENET);
      }
 +    /* USB */
 +    for (i = 0; i < FSL_IMX6UL_NUM_USB_PHYS; i++) {
 +        snprintf(name, NAME_SIZE, "usbphy%d", i);
 +        sysbus_init_child_obj(obj, name, &s->usbphy[i], sizeof(s->usbphy[i]),
 +                              TYPE_IMX_USBPHY);
 +    }
 +    for (i = 0; i < FSL_IMX6UL_NUM_USBS; i++) {
 +        snprintf(name, NAME_SIZE, "usb%d", i);
 +        sysbus_init_child_obj(obj, name, &s->usb[i], sizeof(s->usb[i]),
 +                              TYPE_CHIPIDEA);
 +    }
 +
-     /*
+     tmp105_interrupt_update(s);
-      * SDHCI
+ }
-      */
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                                              FSL_IMX6UL_ENETn_TIMER_IRQ[i]));
      }
 +    /* USB */
 +    for (i = 0; i < FSL_IMX6UL_NUM_USB_PHYS; i++) {
 +        object_property_set_bool(OBJECT(&s->usbphy[i]), true, "realized",
 +                                 &error_abort);
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usbphy[i]), 0,
 +                        FSL_IMX6UL_USBPHY1_ADDR + i * 0x1000);
 +    }
 +
 +    for (i = 0; i < FSL_IMX6UL_NUM_USBS; i++) {
 +        static const int FSL_IMX6UL_USBn_IRQ[] = {
 +            FSL_IMX6UL_USB1_IRQ,
 +            FSL_IMX6UL_USB2_IRQ,
 +        };
 +        object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",
 +                                 &error_abort);
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
 +                        FSL_IMX6UL_USBO2_USB_ADDR + i * 0x200);
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
 +                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 +                                            FSL_IMX6UL_USBn_IRQ[i]));
 +    }
 +
      /*
       * USDHC
       */
 --
 .20.1

-[PULL 07/11] m25p80: Convert to support tracing
+[PULL 9/9] tmp105: Correct handling of temperature limit checks
-From: Guenter Roeck <linux@roeck-us.net>
+The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
 signals an alert when the temperature equals or exceeds the T_high value and
 then remains high until a device register is read or the device responds to
 the SMBUS Alert Response address, or the device is put into Shutdown Mode.
 Thereafter the Alert pin will only be re-signalled when temperature falls
 below T_low; alert can then be cleared in the same set of ways, and the
 device returns to its initial "alert when temperature goes above T_high"
 mode. (If this textual description is confusing, see figure 3 in the
 TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)
-While at it, add some trace messages to help debug problems
+We were misimplementing this as a simple "always alert if temperature is
-seen when running the latest Linux kernel.
+above T_high or below T_low" condition, which gives a spurious alert on
 startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
 limit values.
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Implement the correct (hysteresis) behaviour by tracking whether we
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+are currently looking for the temperature to rise over T_high or
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+for it to fall below T_low. Our implementation of the comparator
 mode (TM==0) wasn't wrong, but rephrase it to match the way that
 interrupt mode is now handled for clarity.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
 ---
- hw/block/m25p80.c     | 48 ++++++++++++++++++++-----------------------
+ hw/misc/tmp105.h |  7 +++++
- hw/block/trace-events | 16 +++++++++++++++
+ hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
-files changed, 38 insertions(+), 26 deletions(-)
+files changed, 68 insertions(+), 9 deletions(-)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
+diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/hw/misc/tmp105.h
-+++ b/hw/block/m25p80.c
++++ b/hw/misc/tmp105.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct TMP105State {
- #include "qemu/module.h"
+     int16_t limit[2];
- #include "qemu/error-report.h"
+     int faults;
- #include "qapi/error.h"
+     uint8_t alarm;
--
++    /*
--#ifndef M25P80_ERR_DEBUG
++     * The TMP105 initially looks for a temperature rising above T_high;
--#define M25P80_ERR_DEBUG 0
++     * once this is detected, the condition it looks for next is the
--#endif
++     * temperature falling below T_low. This flag is false when initially
--
++     * looking for T_high, true when looking for T_low.
--#define DB_PRINT_L(level, ...) do { \
++     */
--    if (M25P80_ERR_DEBUG > (level)) { \
++    bool detect_falling;
--        fprintf(stderr,  ": %s: ", __func__); \
+ };
--        fprintf(stderr, ## __VA_ARGS__); \
--    } \
+ #endif
--} while (0)
+diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
-+#include "trace.h"
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/tmp105.c
- /* Fields for FlashPartInfo->flags */
++++ b/hw/misc/tmp105.c
+@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
-@@ -XXX,XX +XXX,XX @@ static void flash_erase(Flash *s, int offset, FlashCMD cmd)
+             return;
          abort();
      }
--    DB_PRINT_L(0, "offset = %#x, len = %d\n", offset, len);
+-    if ((s->config >> 1) & 1) {                    /* TM */
-+    trace_m25p80_flash_erase(s, offset, len);
+-        if (s->temperature >= s->limit[1])
-+
+-            s->alarm = 1;
-     if ((s->pi->flags & capa_to_assert) != capa_to_assert) {
+-        else if (s->temperature < s->limit[0])
-         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: %d erase size not supported by"
+-            s->alarm = 1;
-                       " device\n", len);
++    if (s->config >> 1 & 1) {
-@@ -XXX,XX +XXX,XX @@ void flash_write8(Flash *s, uint32_t addr, uint8_t data)
++        /*
 +         * TM == 1 : Interrupt mode. We signal Alert when the
 +         * temperature rises above T_high, and expect the guest to clear
 +         * it (eg by reading a device register).
 +         */
 +        if (s->detect_falling) {
 +            if (s->temperature < s->limit[0]) {
 +                s->alarm = 1;
 +                s->detect_falling = false;
 +            }
 +        } else {
 +            if (s->temperature >= s->limit[1]) {
 +                s->alarm = 1;
 +                s->detect_falling = true;
 +            }
 +        }
      } else {
 -        if (s->temperature >= s->limit[1])
 -            s->alarm = 1;
 -        else if (s->temperature < s->limit[0])
 -            s->alarm = 0;
 +        /*
 +         * TM == 0 : Comparator mode. We signal Alert when the temperature
 +         * rises above T_high, and stop signalling it when the temperature
 +         * falls below T_low.
 +         */
 +        if (s->detect_falling) {
 +            if (s->temperature < s->limit[0]) {
 +                s->alarm = 0;
 +                s->detect_falling = false;
 +            }
 +        } else {
 +            if (s->temperature >= s->limit[1]) {
 +                s->alarm = 1;
 +                s->detect_falling = true;
 +            }
 +        }
      }
-     if ((prev ^ data) & data) {
+     tmp105_interrupt_update(s);
--        DB_PRINT_L(1, "programming zero to one! addr=%" PRIx32 "  %" PRIx8
+@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
 -                   " -> %" PRIx8 "\n", addr, prev, data);
 +        trace_m25p80_programming_zero_to_one(s, addr, prev, data);
      }
      if (s->pi->flags & EEPROM) {
@@ -XXX,XX +XXX,XX @@ static void complete_collecting_data(Flash *s)
      s->state = STATE_IDLE;
 +    trace_m25p80_complete_collecting(s, s->cmd_in_progress, n, s->ear,
 +                                     s->cur_addr);
 +
      switch (s->cmd_in_progress) {
      case DPP:
      case QPP:
@@ -XXX,XX +XXX,XX @@ static void reset_memory(Flash *s)
          break;
      }
 -    DB_PRINT_L(0, "Reset done.\n");
 +    trace_m25p80_reset_done(s);
  }
  static void decode_fast_read_cmd(Flash *s)
@@ -XXX,XX +XXX,XX @@ static void decode_qio_read_cmd(Flash *s)
  static void decode_new_cmd(Flash *s, uint32_t value)
  {
 -    s->cmd_in_progress = value;
      int i;
 -    DB_PRINT_L(0, "decoded new command:%x\n", value);
 +
 +    s->cmd_in_progress = value;
 +    trace_m25p80_command_decoded(s, value);
      if (value != RESET_MEMORY) {
          s->reset_enable = false;
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
          break;
      case JEDEC_READ:
 -        DB_PRINT_L(0, "populated jedec code\n");
 +        trace_m25p80_populated_jedec(s);
          for (i = 0; i < s->pi->id_len; i++) {
              s->data[i] = s->pi->id[i];
          }
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
      case BULK_ERASE_60:
      case BULK_ERASE:
          if (s->write_enable) {
 -            DB_PRINT_L(0, "chip erase\n");
 +            trace_m25p80_chip_erase(s);
              flash_erase(s, 0, BULK_ERASE);
          } else {
              qemu_log_mask(LOG_GUEST_ERROR, "M25P80: chip erase with write "
@@ -XXX,XX +XXX,XX @@ static int m25p80_cs(SSISlave *ss, bool select)
          s->data_read_loop = false;
      }
 -    DB_PRINT_L(0, "%sselect\n", select ? "de" : "");
 +    trace_m25p80_select(s, select ? "de" : "");
      return 0;
  }
-@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)
-     Flash *s = M25P80(ss);
++static bool detect_falling_needed(void *opaque)
-     uint32_t r = 0;
++{
++    TMP105State *s = opaque;
 +    trace_m25p80_transfer(s, s->state, s->len, s->needed_bytes, s->pos,
 +                          s->cur_addr, (uint8_t)tx);
 +
-     switch (s->state) {
++    /*
++     * We only need to migrate the detect_falling bool if it's set;
-     case STATE_PAGE_PROGRAM:
++     * for migration from older machines we assume that it is false
--        DB_PRINT_L(1, "page program cur_addr=%#" PRIx32 " data=%" PRIx8 "\n",
++     * (ie temperature is not out of range).
--                   s->cur_addr, (uint8_t)tx);
++     */
-+        trace_m25p80_page_program(s, s->cur_addr, (uint8_t)tx);
++    return s->detect_falling;
-         flash_write8(s, s->cur_addr, (uint8_t)tx);
++}
-         s->cur_addr = (s->cur_addr + 1) & (s->size - 1);
++
-         break;
++static const VMStateDescription vmstate_tmp105_detect_falling = {
++    .name = "TMP105/detect-falling",
-     case STATE_READ:
++    .version_id = 1,
-         r = s->storage[s->cur_addr];
++    .minimum_version_id = 1,
--        DB_PRINT_L(1, "READ 0x%" PRIx32 "=%" PRIx8 "\n", s->cur_addr,
++    .needed = detect_falling_needed,
--                   (uint8_t)r);
++    .fields = (VMStateField[]) {
-+        trace_m25p80_read_byte(s, s->cur_addr, (uint8_t)r);
++        VMSTATE_BOOL(detect_falling, TMP105State),
-         s->cur_addr = (s->cur_addr + 1) & (s->size - 1);
++        VMSTATE_END_OF_LIST()
-         break;
++    }
++};
-@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)
++
-         }
+ static const VMStateDescription vmstate_tmp105 = {
+     .name = "TMP105",
-         r = s->data[s->pos];
+     .version_id = 0,
-+        trace_m25p80_read_data(s, s->pos, (uint8_t)r);
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
-         s->pos++;
+         VMSTATE_UINT8(alarm, TMP105State),
-         if (s->pos == s->len) {
+         VMSTATE_I2C_SLAVE(i2c, TMP105State),
-             s->pos = 0;
+         VMSTATE_END_OF_LIST()
-@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)
++    },
-             return;
++    .subsections = (const VMStateDescription*[]) {
-         }
++        &vmstate_tmp105_detect_falling,
++        NULL
 -        DB_PRINT_L(0, "Binding to IF_MTD drive\n");
 +        trace_m25p80_binding(s);
          s->storage = blk_blockalign(s->blk, s->size);
          if (blk_pread(s->blk, 0, s->storage, s->size) != s->size) {
@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)
              return;
          }
      } else {
 -        DB_PRINT_L(0, "No BDRV - binding to RAM\n");
 +        trace_m25p80_binding_no_bdrv(s);
          s->storage = blk_blockalign(NULL, s->size);
          memset(s->storage, 0xFF, s->size);
      }
-diff --git a/hw/block/trace-events b/hw/block/trace-events
+ };
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/trace-events
+@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
-+++ b/hw/block/trace-events
+     s->config = 0;
-@@ -XXX,XX +XXX,XX @@ xen_block_blockdev_add(char *str) "%s"
+     s->faults = tmp105_faultq[(s->config >> 3) & 3];
- xen_block_blockdev_del(const char *node_name) "%s"
+     s->alarm = 0;
- xen_block_device_create(unsigned int number) "%u"
++    s->detect_falling = false;
- xen_block_device_destroy(unsigned int number) "%u"
-+
+     s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
-+# m25p80.c
+     s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
 +m25p80_flash_erase(void *s, int offset, uint32_t len) "[%p] offset = 0x%"PRIx32", len = %u"
 +m25p80_programming_zero_to_one(void *s, uint32_t addr, uint8_t prev, uint8_t data) "[%p] programming zero to one! addr=0x%"PRIx32"  0x%"PRIx8" -> 0x%"PRIx8
 +m25p80_reset_done(void *s) "[%p] Reset done."
 +m25p80_command_decoded(void *s, uint32_t cmd) "[%p] new command:0x%"PRIx32
 +m25p80_complete_collecting(void *s, uint32_t cmd, int n, uint8_t ear, uint32_t cur_addr) "[%p] decode cmd: 0x%"PRIx32" len %d ear 0x%"PRIx8" addr 0x%"PRIx32
 +m25p80_populated_jedec(void *s) "[%p] populated jedec code"
 +m25p80_chip_erase(void *s) "[%p] chip erase"
 +m25p80_select(void *s, const char *what) "[%p] %sselect"
 +m25p80_page_program(void *s, uint32_t addr, uint8_t tx) "[%p] page program cur_addr=0x%"PRIx32" data=0x%"PRIx8
 +m25p80_transfer(void *s, uint8_t state, uint32_t len, uint8_t needed, uint32_t pos, uint32_t cur_addr, uint8_t t) "[%p] Transfer state 0x%"PRIx8" len 0x%"PRIx32" needed 0x%"PRIx8" pos 0x%"PRIx32" addr 0x%"PRIx32" tx 0x%"PRIx8
 +m25p80_read_byte(void *s, uint32_t addr, uint8_t v) "[%p] Read byte 0x%"PRIx32"=0x%"PRIx8
 +m25p80_read_data(void *s, uint32_t pos, uint8_t v) "[%p] Read data 0x%"PRIx32"=0x%"PRIx8
 +m25p80_binding(void *s) "[%p] Binding to IF_MTD drive"
 +m25p80_binding_no_bdrv(void *s) "[%p] No BDRV - binding to RAM"
 --
 .20.1

Last handful of arm patches before softfreeze...

The following changes since commit a98135f727595382e200d04c2996e868b7925a01:

Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200316-pull-request' into staging (2020-03-16 14:55:59 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200317

for you to fetch changes up to e88d3671e3bbd59d385838a4101ea19cdcf47309:

hw/arm/pxa2xx: Do not wire up OHCI for PXA255 (2020-03-17 11:36:48 +0000)

----------------------------------------------------------------
target-arm:
 * hw/arm/pxa2xx: Do not wire up OHCI for PXA255
 * aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command
 * m25p80: Improve command handling for Jedec and unsupported commands
 * hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()
 * hw/arm/fsl-imx6, imx6ul: Wire up USB controllers
 * hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices

----------------------------------------------------------------
Chen Qun (1):
      hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()

Guenter Roeck (10):
      hw/usb: Add basic i.MX USB Phy support
      hw/arm/fsl-imx6ul: Fix USB interrupt numbers
      hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices
      hw/arm/fsl-imx6ul: Wire up USB controllers
      hw/arm/fsl-imx6: Wire up USB controllers
      m25p80: Convert to support tracing
      m25p80: Improve command handling for Jedec commands
      m25p80: Improve command handling for unsupported commands
      aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command
      hw/arm/pxa2xx: Do not wire up OHCI for PXA255

From: Guenter Roeck <linux@roeck-us.net>

Add basic USB PHY support as implemented in i.MX23, i.MX28, i.MX6,
and i.MX7 SoCs.

The only support really needed - at least to boot Linux - is support
for soft reset, which needs to reset various registers to their initial
value. Otherwise, just record register values.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200313014551.12554-2-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/Makefile.objs         |   2 +
 include/hw/usb/imx-usb-phy.h |  53 +++++++++
 hw/usb/imx-usb-phy.c         | 225 +++++++++++++++++++++++++++++++++++
 MAINTAINERS                  |   2 +
 hw/arm/Kconfig               |   1 +
 hw/usb/Kconfig               |   5 +
 6 files changed, 288 insertions(+)
 create mode 100644 include/hw/usb/imx-usb-phy.h
 create mode 100644 hw/usb/imx-usb-phy.c

diff --git a/hw/usb/Makefile.objs b/hw/usb/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/Makefile.objs
+++ b/hw/usb/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_XEN) += xen-usb.o
 xen-usb.o-cflags := $(LIBUSB_CFLAGS)
 xen-usb.o-libs := $(LIBUSB_LIBS)
 endif
+
+common-obj-$(CONFIG_IMX_USBPHY) += imx-usb-phy.o
diff --git a/include/hw/usb/imx-usb-phy.h b/include/hw/usb/imx-usb-phy.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/usb/imx-usb-phy.h
@@ -XXX,XX +XXX,XX @@
+#ifndef IMX_USB_PHY_H
+#define IMX_USB_PHY_H
+
+#include "hw/sysbus.h"
+#include "qemu/bitops.h"
+
+enum IMXUsbPhyRegisters {
+    USBPHY_PWD,
+    USBPHY_PWD_SET,
+    USBPHY_PWD_CLR,
+    USBPHY_PWD_TOG,
+    USBPHY_TX,
+    USBPHY_TX_SET,
+    USBPHY_TX_CLR,
+    USBPHY_TX_TOG,
+    USBPHY_RX,
+    USBPHY_RX_SET,
+    USBPHY_RX_CLR,
+    USBPHY_RX_TOG,
+    USBPHY_CTRL,
+    USBPHY_CTRL_SET,
+    USBPHY_CTRL_CLR,
+    USBPHY_CTRL_TOG,
+    USBPHY_STATUS,
+    USBPHY_DEBUG = 0x14,
+    USBPHY_DEBUG_SET,
+    USBPHY_DEBUG_CLR,
+    USBPHY_DEBUG_TOG,
+    USBPHY_DEBUG0_STATUS,
+    USBPHY_DEBUG1 = 0x1c,
+    USBPHY_DEBUG1_SET,
+    USBPHY_DEBUG1_CLR,
+    USBPHY_DEBUG1_TOG,
+    USBPHY_VERSION,
+    USBPHY_MAX
+};
+
+#define USBPHY_CTRL_SFTRST BIT(31)
+
+#define TYPE_IMX_USBPHY "imx.usbphy"
+#define IMX_USBPHY(obj) OBJECT_CHECK(IMXUSBPHYState, (obj), TYPE_IMX_USBPHY)
+
+typedef struct IMXUSBPHYState {
+    /* <private> */
+    SysBusDevice parent_obj;
+
+    /* <public> */
+    MemoryRegion iomem;
+
+    uint32_t usbphy[USBPHY_MAX];
+} IMXUSBPHYState;
+
+#endif /* IMX_USB_PHY_H */
diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/usb/imx-usb-phy.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * i.MX USB PHY
+ *
+ * Copyright (c) 2020 Guenter Roeck <linux@roeck-us.net>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ * We need to implement basic reset control in the PHY control register.
+ * For everything else, it is sufficient to set whatever is written.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/usb/imx-usb-phy.h"
+#include "migration/vmstate.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+
+static const VMStateDescription vmstate_imx_usbphy = {
+    .name = TYPE_IMX_USBPHY,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(usbphy, IMXUSBPHYState, USBPHY_MAX),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static void imx_usbphy_softreset(IMXUSBPHYState *s)
+{
+    s->usbphy[USBPHY_PWD] = 0x001e1c00;
+    s->usbphy[USBPHY_TX] = 0x10060607;
+    s->usbphy[USBPHY_RX] = 0x00000000;
+    s->usbphy[USBPHY_CTRL] = 0xc0200000;
+}
+
+static void imx_usbphy_reset(DeviceState *dev)
+{
+    IMXUSBPHYState *s = IMX_USBPHY(dev);
+
+    s->usbphy[USBPHY_STATUS] = 0x00000000;
+    s->usbphy[USBPHY_DEBUG] = 0x7f180000;
+    s->usbphy[USBPHY_DEBUG0_STATUS] = 0x00000000;
+    s->usbphy[USBPHY_DEBUG1] = 0x00001000;
+    s->usbphy[USBPHY_VERSION] = 0x04020000;
+
+    imx_usbphy_softreset(s);
+}
+
+static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
+{
+    IMXUSBPHYState *s = (IMXUSBPHYState *)opaque;
+    uint32_t index = offset >> 2;
+    uint32_t value;
+
+    switch (index) {
+    case USBPHY_PWD_SET:
+    case USBPHY_TX_SET:
+    case USBPHY_RX_SET:
+    case USBPHY_CTRL_SET:
+    case USBPHY_DEBUG_SET:
+    case USBPHY_DEBUG1_SET:
+        /*
+         * All REG_NAME_SET register access are in fact targeting the
+         * REG_NAME register.
+         */
+        value = s->usbphy[index - 1];
+        break;
+    case USBPHY_PWD_CLR:
+    case USBPHY_TX_CLR:
+    case USBPHY_RX_CLR:
+    case USBPHY_CTRL_CLR:
+    case USBPHY_DEBUG_CLR:
+    case USBPHY_DEBUG1_CLR:
+        /*
+         * All REG_NAME_CLR register access are in fact targeting the
+         * REG_NAME register.
+         */
+        value = s->usbphy[index - 2];
+        break;
+    case USBPHY_PWD_TOG:
+    case USBPHY_TX_TOG:
+    case USBPHY_RX_TOG:
+    case USBPHY_CTRL_TOG:
+    case USBPHY_DEBUG_TOG:
+    case USBPHY_DEBUG1_TOG:
+        /*
+         * All REG_NAME_TOG register access are in fact targeting the
+         * REG_NAME register.
+         */
+        value = s->usbphy[index - 3];
+        break;
+    default:
+        value = s->usbphy[index];
+        break;
+    }
+    return (uint64_t)value;
+}
+
+static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
+                             unsigned size)
+{
+    IMXUSBPHYState *s = (IMXUSBPHYState *)opaque;
+    uint32_t index = offset >> 2;
+
+    switch (index) {
+    case USBPHY_CTRL:
+        s->usbphy[index] = value;
+        if (value & USBPHY_CTRL_SFTRST) {
+            imx_usbphy_softreset(s);
+        }
+        break;
+    case USBPHY_PWD:
+    case USBPHY_TX:
+    case USBPHY_RX:
+    case USBPHY_STATUS:
+    case USBPHY_DEBUG:
+    case USBPHY_DEBUG1:
+        s->usbphy[index] = value;
+        break;
+    case USBPHY_CTRL_SET:
+        s->usbphy[index - 1] |= value;
+        if (value & USBPHY_CTRL_SFTRST) {
+            imx_usbphy_softreset(s);
+        }
+        break;
+    case USBPHY_PWD_SET:
+    case USBPHY_TX_SET:
+    case USBPHY_RX_SET:
+    case USBPHY_DEBUG_SET:
+    case USBPHY_DEBUG1_SET:
+        /*
+         * All REG_NAME_SET register access are in fact targeting the
+         * REG_NAME register. So we change the value of the REG_NAME
+         * register, setting bits passed in the value.
+         */
+        s->usbphy[index - 1] |= value;
+        break;
+    case USBPHY_PWD_CLR:
+    case USBPHY_TX_CLR:
+    case USBPHY_RX_CLR:
+    case USBPHY_CTRL_CLR:
+    case USBPHY_DEBUG_CLR:
+    case USBPHY_DEBUG1_CLR:
+        /*
+         * All REG_NAME_CLR register access are in fact targeting the
+         * REG_NAME register. So we change the value of the REG_NAME
+         * register, unsetting bits passed in the value.
+         */
+        s->usbphy[index - 2] &= ~value;
+        break;
+    case USBPHY_CTRL_TOG:
+        s->usbphy[index - 3] ^= value;
+        if ((value & USBPHY_CTRL_SFTRST) &&
+            (s->usbphy[index - 3] & USBPHY_CTRL_SFTRST)) {
+            imx_usbphy_softreset(s);
+        }
+        break;
+    case USBPHY_PWD_TOG:
+    case USBPHY_TX_TOG:
+    case USBPHY_RX_TOG:
+    case USBPHY_DEBUG_TOG:
+    case USBPHY_DEBUG1_TOG:
+        /*
+         * All REG_NAME_TOG register access are in fact targeting the
+         * REG_NAME register. So we change the value of the REG_NAME
+         * register, toggling bits passed in the value.
+         */
+        s->usbphy[index - 3] ^= value;
+        break;
+    default:
+        /* Other registers are read-only */
+        break;
+    }
+}
+
+static const struct MemoryRegionOps imx_usbphy_ops = {
+    .read = imx_usbphy_read,
+    .write = imx_usbphy_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        /*
+         * Our device would not work correctly if the guest was doing
+         * unaligned access. This might not be a limitation on the real
+         * device but in practice there is no reason for a guest to access
+         * this device unaligned.
+         */
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+};
+
+static void imx_usbphy_realize(DeviceState *dev, Error **errp)
+{
+    IMXUSBPHYState *s = IMX_USBPHY(dev);
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &imx_usbphy_ops, s,
+                          "imx-usbphy", 0x1000);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+}
+
+static void imx_usbphy_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = imx_usbphy_reset;
+    dc->vmsd = &vmstate_imx_usbphy;
+    dc->desc = "i.MX USB PHY Module";
+    dc->realize = imx_usbphy_realize;
+}
+
+static const TypeInfo imx_usbphy_info = {
+    .name          = TYPE_IMX_USBPHY,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(IMXUSBPHYState),
+    .class_init    = imx_usbphy_class_init,
+};
+
+static void imx_usbphy_register_types(void)
+{
+    type_register_static(&imx_usbphy_info);
+}
+
+type_init(imx_usbphy_register_types)
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/arm/sabrelite.c
 F: hw/arm/fsl-imx6.c
 F: hw/misc/imx6_*.c
 F: hw/ssi/imx_spi.c
+F: hw/usb/imx-usb-phy.c
+F: include/hw/usb/imx-usb-phy.h
 F: include/hw/arm/fsl-imx6.h
 F: include/hw/misc/imx6_*.h
 F: include/hw/ssi/imx_spi.h
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
     select IMX
     select IMX_FEC
     select IMX_I2C
+    select IMX_USBPHY
     select SDHCI
 
 config ASPEED_SOC
diff --git a/hw/usb/Kconfig b/hw/usb/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/Kconfig
+++ b/hw/usb/Kconfig
@@ -XXX,XX +XXX,XX @@ config USB_STORAGE_MTP
     bool
     default y
     depends on USB
+
+config IMX_USBPHY
+    bool
+    default y
+    depends on USB
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

USB1 and USB2 interrupt numbers were swapped. USB_PHY2 interrupt number
is 45. That didn't really matter up to now since the interrupts were not
used, but it needs to be fixed to be able to wire up the USB controllers.

Fixes: 31cbf933f0e ("i.MX6UL: Add i.MX6UL SOC")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200313014551.12554-3-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6ul.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULIRQs {
     FSL_IMX6UL_UART7_IRQ    = 39,
     FSL_IMX6UL_UART8_IRQ    = 40,
 
-    FSL_IMX6UL_USB1_IRQ     = 42,
-    FSL_IMX6UL_USB2_IRQ     = 43,
+    FSL_IMX6UL_USB1_IRQ     = 43,
+    FSL_IMX6UL_USB2_IRQ     = 42,
     FSL_IMX6UL_USB_PHY1_IRQ = 44,
-    FSL_IMX6UL_USB_PHY2_IRQ = 44,
+    FSL_IMX6UL_USB_PHY2_IRQ = 45,
 
     FSL_IMX6UL_CAAM_JQ2_IRQ = 46,
     FSL_IMX6UL_CAAM_ERR_IRQ = 47,
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Recent Linux kernels (post v4.20) crash due to accesses to flexcan
and pwm controllers. Instantiate as unimplemented devices to work
around the problem.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200313014551.12554-4-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx6ul.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6ul.c
+++ b/hw/arm/fsl-imx6ul.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
      */
     create_unimplemented_device("sdma", FSL_IMX6UL_SDMA_ADDR, 0x4000);
 
+    /*
+     * PWM
+     */
+    create_unimplemented_device("pwm1", FSL_IMX6UL_PWM1_ADDR, 0x4000);
+    create_unimplemented_device("pwm2", FSL_IMX6UL_PWM2_ADDR, 0x4000);
+    create_unimplemented_device("pwm3", FSL_IMX6UL_PWM3_ADDR, 0x4000);
+    create_unimplemented_device("pwm4", FSL_IMX6UL_PWM4_ADDR, 0x4000);
+
+    /*
+     * CAN
+     */
+    create_unimplemented_device("can1", FSL_IMX6UL_CAN1_ADDR, 0x4000);
+    create_unimplemented_device("can2", FSL_IMX6UL_CAN2_ADDR, 0x4000);
+
     /*
      * APHB_DMA
      */
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

IMX6UL USB controllers are quite similar to IMX7 USB controllers.
Wire them up the same way.

The only real difference is that wiring up phy devices is necessary
to avoid phy reset timeouts in the Linux kernel.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200313014551.12554-5-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6ul.h | 10 ++++++++++
 hw/arm/fsl-imx6ul.c         | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sd/sdhci.h"
 #include "hw/ssi/imx_spi.h"
 #include "hw/net/imx_fec.h"
+#include "hw/usb/chipidea.h"
+#include "hw/usb/imx-usb-phy.h"
 #include "exec/memory.h"
 #include "cpu.h"
 
@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULConfiguration {
     FSL_IMX6UL_NUM_I2CS         = 4,
     FSL_IMX6UL_NUM_ECSPIS       = 4,
     FSL_IMX6UL_NUM_ADCS         = 2,
+    FSL_IMX6UL_NUM_USB_PHYS     = 2,
+    FSL_IMX6UL_NUM_USBS         = 2,
 };
 
 typedef struct FslIMX6ULState {
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6ULState {
     IMXFECState        eth[FSL_IMX6UL_NUM_ETHS];
     SDHCIState         usdhc[FSL_IMX6UL_NUM_USDHCS];
     IMX2WdtState       wdt[FSL_IMX6UL_NUM_WDTS];
+    IMXUSBPHYState     usbphy[FSL_IMX6UL_NUM_USB_PHYS];
+    ChipideaState      usb[FSL_IMX6UL_NUM_USBS];
     MemoryRegion       rom;
     MemoryRegion       caam;
     MemoryRegion       ocram;
@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULMemoryMap {
     FSL_IMX6UL_EPIT2_ADDR           = 0x020D4000,
     FSL_IMX6UL_EPIT1_ADDR           = 0x020D0000,
     FSL_IMX6UL_SNVS_HP_ADDR         = 0x020CC000,
+    FSL_IMX6UL_USBPHY2_ADDR         = 0x020CA000,
+    FSL_IMX6UL_USBPHY2_SIZE         = (4 * 1024),
+    FSL_IMX6UL_USBPHY1_ADDR         = 0x020C9000,
+    FSL_IMX6UL_USBPHY1_SIZE         = (4 * 1024),
     FSL_IMX6UL_ANALOG_ADDR          = 0x020C8000,
     FSL_IMX6UL_CCM_ADDR             = 0x020C4000,
     FSL_IMX6UL_WDOG2_ADDR           = 0x020C0000,
diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6ul.c
+++ b/hw/arm/fsl-imx6ul.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/arm/fsl-imx6ul.h"
 #include "hw/misc/unimp.h"
+#include "hw/usb/imx-usb-phy.h"
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_init(Object *obj)
                               TYPE_IMX_ENET);
     }
 
+    /* USB */
+    for (i = 0; i < FSL_IMX6UL_NUM_USB_PHYS; i++) {
+        snprintf(name, NAME_SIZE, "usbphy%d", i);
+        sysbus_init_child_obj(obj, name, &s->usbphy[i], sizeof(s->usbphy[i]),
+                              TYPE_IMX_USBPHY);
+    }
+    for (i = 0; i < FSL_IMX6UL_NUM_USBS; i++) {
+        snprintf(name, NAME_SIZE, "usb%d", i);
+        sysbus_init_child_obj(obj, name, &s->usb[i], sizeof(s->usb[i]),
+                              TYPE_CHIPIDEA);
+    }
+
     /*
      * SDHCI
      */
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                                             FSL_IMX6UL_ENETn_TIMER_IRQ[i]));
     }
 
+    /* USB */
+    for (i = 0; i < FSL_IMX6UL_NUM_USB_PHYS; i++) {
+        object_property_set_bool(OBJECT(&s->usbphy[i]), true, "realized",
+                                 &error_abort);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usbphy[i]), 0,
+                        FSL_IMX6UL_USBPHY1_ADDR + i * 0x1000);
+    }
+
+    for (i = 0; i < FSL_IMX6UL_NUM_USBS; i++) {
+        static const int FSL_IMX6UL_USBn_IRQ[] = {
+            FSL_IMX6UL_USB1_IRQ,
+            FSL_IMX6UL_USB2_IRQ,
+        };
+        object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",
+                                 &error_abort);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
+                        FSL_IMX6UL_USBO2_USB_ADDR + i * 0x200);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
+                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+                                            FSL_IMX6UL_USBn_IRQ[i]));
+    }
+
     /*
      * USDHC
      */
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

With this patch, the USB controllers on 'sabrelite' are detected
and can be used to boot the system.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200313014551.12554-6-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h |  6 ++++++
 hw/arm/fsl-imx6.c         | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sd/sdhci.h"
 #include "hw/ssi/imx_spi.h"
 #include "hw/net/imx_fec.h"
+#include "hw/usb/chipidea.h"
+#include "hw/usb/imx-usb-phy.h"
 #include "exec/memory.h"
 #include "cpu.h"
 
@@ -XXX,XX +XXX,XX @@
 #define FSL_IMX6_NUM_ESDHCS 4
 #define FSL_IMX6_NUM_ECSPIS 5
 #define FSL_IMX6_NUM_WDTS 2
+#define FSL_IMX6_NUM_USB_PHYS 2
+#define FSL_IMX6_NUM_USBS 4
 
 typedef struct FslIMX6State {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
     SDHCIState     esdhc[FSL_IMX6_NUM_ESDHCS];
     IMXSPIState    spi[FSL_IMX6_NUM_ECSPIS];
     IMX2WdtState   wdt[FSL_IMX6_NUM_WDTS];
+    IMXUSBPHYState usbphy[FSL_IMX6_NUM_USB_PHYS];
+    ChipideaState  usb[FSL_IMX6_NUM_USBS];
     IMXFECState    eth;
     MemoryRegion   rom;
     MemoryRegion   caam;
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/arm/fsl-imx6.h"
+#include "hw/usb/imx-usb-phy.h"
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"
 #include "sysemu/sysemu.h"
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
                               TYPE_IMX_USDHC);
     }
 
+    for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {
+        snprintf(name, NAME_SIZE, "usbphy%d", i);
+        sysbus_init_child_obj(obj, name, &s->usbphy[i], sizeof(s->usbphy[i]),
+                              TYPE_IMX_USBPHY);
+    }
+    for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {
+        snprintf(name, NAME_SIZE, "usb%d", i);
+        sysbus_init_child_obj(obj, name, &s->usb[i], sizeof(s->usb[i]),
+                              TYPE_CHIPIDEA);
+    }
+
     for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {
         snprintf(name, NAME_SIZE, "spi%d", i + 1);
         sysbus_init_child_obj(obj, name, &s->spi[i], sizeof(s->spi[i]),
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                             esdhc_table[i].irq));
     }
 
+    /* USB */
+    for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {
+        object_property_set_bool(OBJECT(&s->usbphy[i]), true, "realized",
+                                 &error_abort);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usbphy[i]), 0,
+                        FSL_IMX6_USBPHY1_ADDR + i * 0x1000);
+    }
+    for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {
+        static const int FSL_IMX6_USBn_IRQ[] = {
+            FSL_IMX6_USB_OTG_IRQ,
+            FSL_IMX6_USB_HOST1_IRQ,
+            FSL_IMX6_USB_HOST2_IRQ,
+            FSL_IMX6_USB_HOST3_IRQ,
+        };
+
+        object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",
+                                 &error_abort);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
+                        FSL_IMX6_USBOH3_USB_ADDR + i * 0x200);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
+                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
+                                            FSL_IMX6_USBn_IRQ[i]));
+    }
+
     /* Initialize all ECSPI */
     for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {
         static const struct {
-- 
2.20.1

From: Chen Qun <kuhn.chenqun@huawei.com>

The current code causes clang static code analyzer generate warning:
hw/net/imx_fec.c:858:9: warning: Value stored to 'value' is never read
        value = value & 0x0000000f;
        ^       ~~~~~~~~~~~~~~~~~~
hw/net/imx_fec.c:864:9: warning: Value stored to 'value' is never read
        value = value & 0x000000fd;
        ^       ~~~~~~~~~~~~~~~~~~

According to the definition of the function, the two “value” assignments
 should be written to registers.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
Message-id: 20200313123242.13236-1-kuhn.chenqun@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/imx_fec.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_enet_write(IMXFECState *s, uint32_t index, uint32_t value)
         break;
     case ENET_TGSR:
         /* implement clear timer flag */
-        value = value & 0x0000000f;
+        s->regs[index] &= ~(value & 0x0000000f); /* all bits W1C */
         break;
     case ENET_TCSR0:
     case ENET_TCSR1:
     case ENET_TCSR2:
     case ENET_TCSR3:
-        value = value & 0x000000fd;
+        s->regs[index] &= ~(value & 0x00000080); /* W1C bits */
+        s->regs[index] &= ~0x0000007d; /* writable fields */
+        s->regs[index] |= (value & 0x0000007d);
         break;
     case ENET_TCCR0:
     case ENET_TCCR1:
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

While at it, add some trace messages to help debug problems
seen when running the latest Linux kernel.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/block/m25p80.c     | 48 ++++++++++++++++++++-----------------------
 hw/block/trace-events | 16 +++++++++++++++
 2 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
-
-#ifndef M25P80_ERR_DEBUG
-#define M25P80_ERR_DEBUG 0
-#endif
-
-#define DB_PRINT_L(level, ...) do { \
-    if (M25P80_ERR_DEBUG > (level)) { \
-        fprintf(stderr,  ": %s: ", __func__); \
-        fprintf(stderr, ## __VA_ARGS__); \
-    } \
-} while (0)
+#include "trace.h"
 
 /* Fields for FlashPartInfo->flags */
 
@@ -XXX,XX +XXX,XX @@ static void flash_erase(Flash *s, int offset, FlashCMD cmd)
         abort();
     }
 
-    DB_PRINT_L(0, "offset = %#x, len = %d\n", offset, len);
+    trace_m25p80_flash_erase(s, offset, len);
+
     if ((s->pi->flags & capa_to_assert) != capa_to_assert) {
         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: %d erase size not supported by"
                       " device\n", len);
@@ -XXX,XX +XXX,XX @@ void flash_write8(Flash *s, uint32_t addr, uint8_t data)
     }
 
     if ((prev ^ data) & data) {
-        DB_PRINT_L(1, "programming zero to one! addr=%" PRIx32 "  %" PRIx8
-                   " -> %" PRIx8 "\n", addr, prev, data);
+        trace_m25p80_programming_zero_to_one(s, addr, prev, data);
     }
 
     if (s->pi->flags & EEPROM) {
@@ -XXX,XX +XXX,XX @@ static void complete_collecting_data(Flash *s)
 
     s->state = STATE_IDLE;
 
+    trace_m25p80_complete_collecting(s, s->cmd_in_progress, n, s->ear,
+                                     s->cur_addr);
+
     switch (s->cmd_in_progress) {
     case DPP:
     case QPP:
@@ -XXX,XX +XXX,XX @@ static void reset_memory(Flash *s)
         break;
     }
 
-    DB_PRINT_L(0, "Reset done.\n");
+    trace_m25p80_reset_done(s);
 }
 
 static void decode_fast_read_cmd(Flash *s)
@@ -XXX,XX +XXX,XX @@ static void decode_qio_read_cmd(Flash *s)
 
 static void decode_new_cmd(Flash *s, uint32_t value)
 {
-    s->cmd_in_progress = value;
     int i;
-    DB_PRINT_L(0, "decoded new command:%x\n", value);
+
+    s->cmd_in_progress = value;
+    trace_m25p80_command_decoded(s, value);
 
     if (value != RESET_MEMORY) {
         s->reset_enable = false;
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
         break;
 
     case JEDEC_READ:
-        DB_PRINT_L(0, "populated jedec code\n");
+        trace_m25p80_populated_jedec(s);
         for (i = 0; i < s->pi->id_len; i++) {
             s->data[i] = s->pi->id[i];
         }
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
     case BULK_ERASE_60:
     case BULK_ERASE:
         if (s->write_enable) {
-            DB_PRINT_L(0, "chip erase\n");
+            trace_m25p80_chip_erase(s);
             flash_erase(s, 0, BULK_ERASE);
         } else {
             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: chip erase with write "
@@ -XXX,XX +XXX,XX @@ static int m25p80_cs(SSISlave *ss, bool select)
         s->data_read_loop = false;
     }
 
-    DB_PRINT_L(0, "%sselect\n", select ? "de" : "");
+    trace_m25p80_select(s, select ? "de" : "");
 
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)
     Flash *s = M25P80(ss);
     uint32_t r = 0;
 
+    trace_m25p80_transfer(s, s->state, s->len, s->needed_bytes, s->pos,
+                          s->cur_addr, (uint8_t)tx);
+
     switch (s->state) {
 
     case STATE_PAGE_PROGRAM:
-        DB_PRINT_L(1, "page program cur_addr=%#" PRIx32 " data=%" PRIx8 "\n",
-                   s->cur_addr, (uint8_t)tx);
+        trace_m25p80_page_program(s, s->cur_addr, (uint8_t)tx);
         flash_write8(s, s->cur_addr, (uint8_t)tx);
         s->cur_addr = (s->cur_addr + 1) & (s->size - 1);
         break;
 
     case STATE_READ:
         r = s->storage[s->cur_addr];
-        DB_PRINT_L(1, "READ 0x%" PRIx32 "=%" PRIx8 "\n", s->cur_addr,
-                   (uint8_t)r);
+        trace_m25p80_read_byte(s, s->cur_addr, (uint8_t)r);
         s->cur_addr = (s->cur_addr + 1) & (s->size - 1);
         break;
 
@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)
         }
 
         r = s->data[s->pos];
+        trace_m25p80_read_data(s, s->pos, (uint8_t)r);
         s->pos++;
         if (s->pos == s->len) {
             s->pos = 0;
@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)
             return;
         }
 
-        DB_PRINT_L(0, "Binding to IF_MTD drive\n");
+        trace_m25p80_binding(s);
         s->storage = blk_blockalign(s->blk, s->size);
 
         if (blk_pread(s->blk, 0, s->storage, s->size) != s->size) {
@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)
             return;
         }
     } else {
-        DB_PRINT_L(0, "No BDRV - binding to RAM\n");
+        trace_m25p80_binding_no_bdrv(s);
         s->storage = blk_blockalign(NULL, s->size);
         memset(s->storage, 0xFF, s->size);
     }
diff --git a/hw/block/trace-events b/hw/block/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/trace-events
+++ b/hw/block/trace-events
@@ -XXX,XX +XXX,XX @@ xen_block_blockdev_add(char *str) "%s"
 xen_block_blockdev_del(const char *node_name) "%s"
 xen_block_device_create(unsigned int number) "%u"
 xen_block_device_destroy(unsigned int number) "%u"
+
+# m25p80.c
+m25p80_flash_erase(void *s, int offset, uint32_t len) "[%p] offset = 0x%"PRIx32", len = %u"
+m25p80_programming_zero_to_one(void *s, uint32_t addr, uint8_t prev, uint8_t data) "[%p] programming zero to one! addr=0x%"PRIx32"  0x%"PRIx8" -> 0x%"PRIx8
+m25p80_reset_done(void *s) "[%p] Reset done."
+m25p80_command_decoded(void *s, uint32_t cmd) "[%p] new command:0x%"PRIx32
+m25p80_complete_collecting(void *s, uint32_t cmd, int n, uint8_t ear, uint32_t cur_addr) "[%p] decode cmd: 0x%"PRIx32" len %d ear 0x%"PRIx8" addr 0x%"PRIx32
+m25p80_populated_jedec(void *s) "[%p] populated jedec code"
+m25p80_chip_erase(void *s) "[%p] chip erase"
+m25p80_select(void *s, const char *what) "[%p] %sselect"
+m25p80_page_program(void *s, uint32_t addr, uint8_t tx) "[%p] page program cur_addr=0x%"PRIx32" data=0x%"PRIx8
+m25p80_transfer(void *s, uint8_t state, uint32_t len, uint8_t needed, uint32_t pos, uint32_t cur_addr, uint8_t t) "[%p] Transfer state 0x%"PRIx8" len 0x%"PRIx32" needed 0x%"PRIx8" pos 0x%"PRIx32" addr 0x%"PRIx32" tx 0x%"PRIx8
+m25p80_read_byte(void *s, uint32_t addr, uint8_t v) "[%p] Read byte 0x%"PRIx32"=0x%"PRIx8
+m25p80_read_data(void *s, uint32_t pos, uint8_t v) "[%p] Read data 0x%"PRIx32"=0x%"PRIx8
+m25p80_binding(void *s) "[%p] Binding to IF_MTD drive"
+m25p80_binding_no_bdrv(void *s) "[%p] No BDRV - binding to RAM"
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

When requesting JEDEC data using the JEDEC_READ command, the Linux kernel
always requests 6 bytes. The current implementation only returns three
bytes, and interprets the remaining three bytes as new commands.
While this does not matter most of the time, it is at the very least
confusing. To avoid the problem, always report up to 6 bytes of JEDEC
data. Fill remaining data with 0.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/block/m25p80.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
         for (i = 0; i < s->pi->id_len; i++) {
             s->data[i] = s->pi->id[i];
         }
+        for (; i < SPI_NOR_MAX_ID_LEN; i++) {
+            s->data[i] = 0;
+        }
 
-        s->len = s->pi->id_len;
+        s->len = SPI_NOR_MAX_ID_LEN;
         s->pos = 0;
         s->state = STATE_READING_DATA;
         break;
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Whenever an unsupported command is encountered, the current code
interprets each transferred byte as new command. Most of the time, those
'commands' are interpreted as new unknown commands. However, in rare
cases, it may be that for example address or length information
passed with the original command is by itself a valid command.
If that happens, the state machine may get completely confused and,
worst case, start writing data into the flash or even erase it.

To avoid the problem, transition into STATE_READING_DATA and keep
sending a value of 0 until the chip is deselected after encountering
an unsupported command.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/block/m25p80.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
         s->quad_enable = false;
         break;
     default:
+        s->pos = 0;
+        s->len = 1;
+        s->state = STATE_READING_DATA;
+        s->data_read_loop = true;
+        s->data[0] = 0;
         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Unknown cmd %x\n", value);
         break;
     }
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

The Linux kernel recently started using FAST_READ_4 commands.
This results in flash read failures. At the same time, the m25p80
emulation is seen to read 8 more bytes than expected. Adjusting the
expected number of dummy cycles to match FAST_READ fixes the problem.

Fixes: f95c4bffdc4c ("aspeed/smc: snoop SPI transfers to fake dummy cycles")
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/aspeed_smc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static int aspeed_smc_num_dummies(uint8_t command)
     case FAST_READ:
     case DOR:
     case QOR:
+    case FAST_READ_4:
     case DOR_4:
     case QOR_4:
         return 1;
     case DIOR:
-    case FAST_READ_4:
     case DIOR_4:
         return 2;
     case QIOR:
-- 
2.20.1

Arm queue; bugfixes only.

thanks
-- PMM

The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117

for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:

tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/virt: ARM_VIRT must select ARM_GIC
 * exynos: Fix bad printf format specifiers
 * hw/input/ps2.c: Remove remnants of printf debug
 * target/openrisc: Remove dead code attempting to check "is timer disabled"
 * register: Remove unnecessary NULL check
 * util/cutils: Fix Coverity array overrun in freq_to_str()
 * configure: Make "does libgio work" test pull in some actual functions
 * tmp105: reset the T_low and T_High registers
 * tmp105: Correct handling of temperature limit checks

----------------------------------------------------------------
Alex Chen (1):
      exynos: Fix bad printf format specifiers

Alistair Francis (1):
      register: Remove unnecessary NULL check

Andrew Jones (1):
      hw/arm/virt: ARM_VIRT must select ARM_GIC

Peter Maydell (5):
      hw/input/ps2.c: Remove remnants of printf debug
      target/openrisc: Remove dead code attempting to check "is timer disabled"
      configure: Make "does libgio work" test pull in some actual functions
      hw/misc/tmp105: reset the T_low and T_High registers
      tmp105: Correct handling of temperature limit checks

Philippe Mathieu-Daudé (1):
      util/cutils: Fix Coverity array overrun in freq_to_str()

From: Alex Chen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 20201111073651.72804-1-alex.chen@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/exynos4210_mct.c | 4 ++--
 hw/timer/exynos4210_pwm.c | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
     /* If CSTAT is pending and IRQ is enabled */
     if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
             (s->reg.int_enb & G_INT_ENABLE(id))) {
-        DPRINTF("gcmp timer[%d] IRQ\n", id);
+        DPRINTF("gcmp timer[%u] IRQ\n", id);
         qemu_irq_raise(s->irq[id]);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
 
     if (freq != s->freq) {
-        DPRINTF("freq=%dHz\n", s->freq);
+        DPRINTF("freq=%uHz\n", s->freq);
 
         /* global timer */
         tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
 
     if (freq != s->timer[id].freq) {
         ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
-        DPRINTF("freq=%dHz\n", s->timer[id].freq);
+        DPRINTF("freq=%uHz\n", s->timer[id].freq);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
     uint32_t id = s->id;
     bool cmp;
 
-    DPRINTF("timer %d tick\n", id);
+    DPRINTF("timer %u tick\n", id);
 
     /* set irq status */
     p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
 
     /* raise IRQ */
     if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
-        DPRINTF("timer %d IRQ\n", id);
+        DPRINTF("timer %u IRQ\n", id);
         qemu_irq_raise(p->timer[id].irq);
     }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
     }
 
     if (cmp) {
-        DPRINTF("auto reload timer %d count to %x\n", id,
+        DPRINTF("auto reload timer %u count to %x\n", id,
                 p->timer[id].reg_tcntb);
         ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
         ptimer_run(p->timer[id].ptimer, 1);
-- 
2.20.1

In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
and mouse emulation. However we didn't remove all the debug-by-printf
support. In fact there is only one printf() remaining, and it is
redundant with the trace_ps2_write_mouse() event next to it.
Remove the printf() and the now-unused DEBUG* macros.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
---
 hw/input/ps2.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -XXX,XX +XXX,XX @@
 
 #include "trace.h"
 
-/* debug PC keyboard */
-//#define DEBUG_KBD
-
-/* debug PC keyboard : only mouse */
-//#define DEBUG_MOUSE
-
 /* Keyboard Commands */
 #define KBD_CMD_SET_LEDS	0xED	/* Set keyboard leds */
 #define KBD_CMD_ECHO     	0xEE
@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
     PS2MouseState *s = (PS2MouseState *)opaque;
 
     trace_ps2_write_mouse(opaque, val);
-#ifdef DEBUG_MOUSE
-    printf("kbd: write mouse 0x%02x\n", val);
-#endif
     switch(s->common.write_cmd) {
     default:
     case -1:
-- 
2.20.1

In the mtspr helper we attempt to check for "is the timer disabled"
with "if (env->ttmr & TIMER_NONE)".  This is wrong because TIMER_NONE
is zero and the condition is always false (Coverity complains about
the dead code.)

The correct check would be to test whether the TTMR_M field in the
register is equal to TIMER_NONE instead.  However, the
cpu_openrisc_timer_update() function checks whether the timer is
enabled (it looks at cpu->env.is_counting, which is set to 0 via
cpu_openrisc_count_stop() when the TTMR_M field is set to
TIMER_NONE), so there's no need to check for "timer disabled" in the
target/openrisc code.  Instead, simply remove the dead code.

Fixes: Coverity CID 1005812
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Stafford Horne <shorne@gmail.com>
Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
---
 target/openrisc/sys_helper.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
 
     case TO_SPR(10, 1): /* TTCR */
         cpu_openrisc_count_set(cpu, rb);
-        if (env->ttmr & TIMER_NONE) {
-            return;
-        }
         cpu_openrisc_timer_update(cpu);
         break;
 #endif
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fix Coverity CID 1435957:  Memory - illegal accesses (OVERRUN):

>>> Overrunning array "suffixes" of 7 8-byte elements at element
    index 7 (byte offset 63) using index "idx" (which evaluates to 7).

Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
which is ~18.446 EHz, less than 1000 EHz.

Reported-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20201101215755.2021421-1-f4bug@amsat.org
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 util/cutils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/util/cutils.c b/util/cutils.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cutils.c
+++ b/util/cutils.c
@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
     double freq = freq_hz;
     size_t idx = 0;
 
-    while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
+    while (freq >= 1000.0) {
         freq /= 1000.0;
         idx++;
     }
+    assert(idx < ARRAY_SIZE(suffixes));
 
     return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
 }
-- 
2.20.1

In commit 76346b6264a9b01979 we tried to add a configure check that
the libgio pkg-config data was correct, which builds an executable
linked against it.  Unfortunately this doesn't catch the problem
(missing static library dependency info), because a "do nothing" test
source file doesn't have any symbol references that cause the linker
to pull in .o files from libgio.a, and so we don't see the "missing
symbols from libmount" error that a full QEMU link triggers.

(The ineffective test went unnoticed because of a typo that
effectively disabled libgio unconditionally, but after commit
3569a5dfc11f2 fixed that, a static link of the system emulator on
Ubuntu stopped working again.)

Improve the gio test by having the test source fragment reference a
g_dbus function (which is what is indirectly causing us to end up
wanting functions from libmount).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
---
 configure | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
     # Check that the libraries actually work -- Ubuntu 18.04 ships
     # with pkg-config --static --libs data for gio-2.0 that is missing
     # -lblkid and will give a link error.
-    write_c_skeleton
-    if compile_prog "" "$gio_libs" ; then
+    cat > $TMPC <<EOF
+#include <gio/gio.h>
+int main(void)
+{
+    g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
+    return 0;
+}
+EOF
+    if compile_prog "$gio_cflags" "$gio_libs" ; then
         gio=yes
     else
         gio=no
-- 
2.20.1

The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
power-up reset values for the T_low and T_high registers are 80 degrees C
and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5.  These
values are then shifted right by four bits to give the register reset
values, since both registers store the 12 bits of temperature data in bits
[15..4] of a 16 bit register.

We were resetting these registers to zero, which is problematic for Linux
guests which enable the alert interrupt and then immediately take an
unexpected overtemperature alert because the current temperature is above
freezing...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
---
 hw/misc/tmp105.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.c
+++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
     s->faults = tmp105_faultq[(s->config >> 3) & 3];
     s->alarm = 0;
 
+    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
+    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
+
     tmp105_interrupt_update(s);
 }
 
-- 
2.20.1

The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
signals an alert when the temperature equals or exceeds the T_high value and
then remains high until a device register is read or the device responds to
the SMBUS Alert Response address, or the device is put into Shutdown Mode.
Thereafter the Alert pin will only be re-signalled when temperature falls
below T_low; alert can then be cleared in the same set of ways, and the
device returns to its initial "alert when temperature goes above T_high"
mode. (If this textual description is confusing, see figure 3 in the
TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)

We were misimplementing this as a simple "always alert if temperature is
above T_high or below T_low" condition, which gives a spurious alert on
startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
limit values.

Implement the correct (hysteresis) behaviour by tracking whether we
are currently looking for the temperature to rise over T_high or
for it to fall below T_low. Our implementation of the comparator
mode (TM==0) wasn't wrong, but rephrase it to match the way that
interrupt mode is now handled for clarity.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
---
 hw/misc/tmp105.h |  7 +++++
 hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
 2 files changed, 68 insertions(+), 9 deletions(-)

diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.h
+++ b/hw/misc/tmp105.h
@@ -XXX,XX +XXX,XX @@ struct TMP105State {
     int16_t limit[2];
     int faults;
     uint8_t alarm;
+    /*
+     * The TMP105 initially looks for a temperature rising above T_high;
+     * once this is detected, the condition it looks for next is the
+     * temperature falling below T_low. This flag is false when initially
+     * looking for T_high, true when looking for T_low.
+     */
+    bool detect_falling;
 };
 
 #endif
diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.c
+++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
             return;
     }
 
-    if ((s->config >> 1) & 1) {					/* TM */
-        if (s->temperature >= s->limit[1])
-            s->alarm = 1;
-        else if (s->temperature < s->limit[0])
-            s->alarm = 1;
+    if (s->config >> 1 & 1) {
+        /*
+         * TM == 1 : Interrupt mode. We signal Alert when the
+         * temperature rises above T_high, and expect the guest to clear
+         * it (eg by reading a device register).
+         */
+        if (s->detect_falling) {
+            if (s->temperature < s->limit[0]) {
+                s->alarm = 1;
+                s->detect_falling = false;
+            }
+        } else {
+            if (s->temperature >= s->limit[1]) {
+                s->alarm = 1;
+                s->detect_falling = true;
+            }
+        }
     } else {
-        if (s->temperature >= s->limit[1])
-            s->alarm = 1;
-        else if (s->temperature < s->limit[0])
-            s->alarm = 0;
+        /*
+         * TM == 0 : Comparator mode. We signal Alert when the temperature
+         * rises above T_high, and stop signalling it when the temperature
+         * falls below T_low.
+         */
+        if (s->detect_falling) {
+            if (s->temperature < s->limit[0]) {
+                s->alarm = 0;
+                s->detect_falling = false;
+            }
+        } else {
+            if (s->temperature >= s->limit[1]) {
+                s->alarm = 1;
+                s->detect_falling = true;
+            }
+        }
     }
 
     tmp105_interrupt_update(s);
@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
     return 0;
 }
 
+static bool detect_falling_needed(void *opaque)
+{
+    TMP105State *s = opaque;
+
+    /*
+     * We only need to migrate the detect_falling bool if it's set;
+     * for migration from older machines we assume that it is false
+     * (ie temperature is not out of range).
+     */
+    return s->detect_falling;
+}
+
+static const VMStateDescription vmstate_tmp105_detect_falling = {
+    .name = "TMP105/detect-falling",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = detect_falling_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(detect_falling, TMP105State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_tmp105 = {
     .name = "TMP105",
     .version_id = 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
         VMSTATE_UINT8(alarm, TMP105State),
         VMSTATE_I2C_SLAVE(i2c, TMP105State),
         VMSTATE_END_OF_LIST()
+    },
+    .subsections = (const VMStateDescription*[]) {
+        &vmstate_tmp105_detect_falling,
+        NULL
     }
 };
 
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
     s->config = 0;
     s->faults = tmp105_faultq[(s->config >> 3) & 3];
     s->alarm = 0;
+    s->detect_falling = false;
 
     s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
     s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
-- 
2.20.1