Last handful of arm patches before softfreeze...

The following changes since commit a98135f727595382e200d04c2996e868b7925a01:

Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200316-pull-request' into staging (2020-03-16 14:55:59 +0000)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200317

for you to fetch changes up to e88d3671e3bbd59d385838a4101ea19cdcf47309:

hw/arm/pxa2xx: Do not wire up OHCI for PXA255 (2020-03-17 11:36:48 +0000)

target-arm:

* hw/arm/pxa2xx: Do not wire up OHCI for PXA255

* aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command

* m25p80: Improve command handling for Jedec and unsupported commands

* hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()

* hw/arm/fsl-imx6, imx6ul: Wire up USB controllers

* hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices

Chen Qun (1):

hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()

Guenter Roeck (10):

hw/usb: Add basic i.MX USB Phy support

hw/arm/fsl-imx6ul: Fix USB interrupt numbers

hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices

hw/arm/fsl-imx6ul: Wire up USB controllers

hw/arm/fsl-imx6: Wire up USB controllers

m25p80: Convert to support tracing

m25p80: Improve command handling for Jedec commands

m25p80: Improve command handling for unsupported commands

aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command

hw/arm/pxa2xx: Do not wire up OHCI for PXA255

hw/usb/Makefile.objs | 2 +

include/hw/arm/fsl-imx6.h | 6 ++

include/hw/arm/fsl-imx6ul.h | 16 ++-

include/hw/usb/imx-usb-phy.h | 53 ++++++++++

hw/arm/fsl-imx6.c | 36 +++++++

hw/arm/fsl-imx6ul.c | 49 ++++++++++

hw/arm/pxa2xx.c | 3 -

hw/block/m25p80.c | 58 +++++------

hw/net/imx_fec.c | 6 +-

hw/ssi/aspeed_smc.c | 2 +-

hw/usb/imx-usb-phy.c | 225 +++++++++++++++++++++++++++++++++++++++++++

MAINTAINERS | 2 +

hw/arm/Kconfig | 1 +

hw/block/trace-events | 16 +++

hw/usb/Kconfig | 5 +

15 files changed, 444 insertions(+), 36 deletions(-)

create mode 100644 include/hw/usb/imx-usb-phy.h

create mode 100644 hw/usb/imx-usb-phy.c

From: Guenter Roeck <linux@roeck-us.net>

Whenever an unsupported command is encountered, the current code

interprets each transferred byte as new command. Most of the time, those

'commands' are interpreted as new unknown commands. However, in rare

cases, it may be that for example address or length information

passed with the original command is by itself a valid command.

If that happens, the state machine may get completely confused and,

worst case, start writing data into the flash or even erase it.

To avoid the problem, transition into STATE_READING_DATA and keep

sending a value of 0 until the chip is deselected after encountering

an unsupported command.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/block/m25p80.c | 5 +++++

1 file changed, 5 insertions(+)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c

--- a/hw/block/m25p80.c

+++ b/hw/block/m25p80.c

@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)

s->quad_enable = false;

break;

default:

+ s->pos = 0;

+ s->len = 1;

+ s->state = STATE_READING_DATA;

+ s->data_read_loop = true;

+ s->data[0] = 0;

qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Unknown cmd %x\n", value);

break;

}

2.20.1

From: Guenter Roeck <linux@roeck-us.net>

hw/ssi/aspeed_smc.c | 2 +-

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c

--- a/hw/ssi/aspeed_smc.c

+++ b/hw/ssi/aspeed_smc.c

@@ -XXX,XX +XXX,XX @@ static int aspeed_smc_num_dummies(uint8_t command)

case FAST_READ:

case DOR:

case QOR:

+ case FAST_READ_4:

case DOR_4:

case QOR_4:

return 1;

case DIOR:

- case FAST_READ_4:

case DIOR_4:

return 2;

case QIOR:

2.20.1

From: Guenter Roeck <linux@roeck-us.net>

With this patch, the USB controllers on 'sabrelite' are detected

and can be used to boot the system.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Message-id: 20200313014551.12554-6-linux@roeck-us.net

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/fsl-imx6.h | 6 ++++++

hw/arm/fsl-imx6.c | 36 ++++++++++++++++++++++++++++++++++++

2 files changed, 42 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h

--- a/include/hw/arm/fsl-imx6.h

+++ b/include/hw/arm/fsl-imx6.h

@@ -XXX,XX +XXX,XX @@

#include "hw/sd/sdhci.h"

#include "hw/ssi/imx_spi.h"

#include "hw/net/imx_fec.h"

+#include "hw/usb/chipidea.h"

+#include "hw/usb/imx-usb-phy.h"

#include "exec/memory.h"

#include "cpu.h"

@@ -XXX,XX +XXX,XX @@

#define FSL_IMX6_NUM_ESDHCS 4

#define FSL_IMX6_NUM_ECSPIS 5

#define FSL_IMX6_NUM_WDTS 2

+#define FSL_IMX6_NUM_USB_PHYS 2

+#define FSL_IMX6_NUM_USBS 4

typedef struct FslIMX6State {

/*< private >*/

@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {

SDHCIState esdhc[FSL_IMX6_NUM_ESDHCS];

IMXSPIState spi[FSL_IMX6_NUM_ECSPIS];

IMX2WdtState wdt[FSL_IMX6_NUM_WDTS];

+ IMXUSBPHYState usbphy[FSL_IMX6_NUM_USB_PHYS];

+ ChipideaState usb[FSL_IMX6_NUM_USBS];

IMXFECState eth;

MemoryRegion rom;

MemoryRegion caam;

diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c

--- a/hw/arm/fsl-imx6.c

+++ b/hw/arm/fsl-imx6.c

@@ -XXX,XX +XXX,XX @@

#include "qemu/osdep.h"

#include "qapi/error.h"

#include "hw/arm/fsl-imx6.h"

+#include "hw/usb/imx-usb-phy.h"

#include "hw/boards.h"

#include "hw/qdev-properties.h"

#include "sysemu/sysemu.h"

@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)

TYPE_IMX_USDHC);

+ for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {

+ snprintf(name, NAME_SIZE, "usbphy%d", i);

+ sysbus_init_child_obj(obj, name, &s->usbphy[i], sizeof(s->usbphy[i]),

+ TYPE_IMX_USBPHY);

+ }

+ for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {

+ snprintf(name, NAME_SIZE, "usb%d", i);

+ sysbus_init_child_obj(obj, name, &s->usb[i], sizeof(s->usb[i]),

+ TYPE_CHIPIDEA);

+ }

+

for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {

snprintf(name, NAME_SIZE, "spi%d", i + 1);

sysbus_init_child_obj(obj, name, &s->spi[i], sizeof(s->spi[i]),

@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)

esdhc_table[i].irq));

+ /* USB */

+ for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {

+ object_property_set_bool(OBJECT(&s->usbphy[i]), true, "realized",

+ &error_abort);

+ sysbus_mmio_map(SYS_BUS_DEVICE(&s->usbphy[i]), 0,

+ FSL_IMX6_USBPHY1_ADDR + i * 0x1000);

+ }

+ for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {

+ static const int FSL_IMX6_USBn_IRQ[] = {

+ FSL_IMX6_USB_OTG_IRQ,

+ FSL_IMX6_USB_HOST1_IRQ,

+ FSL_IMX6_USB_HOST2_IRQ,

+ FSL_IMX6_USB_HOST3_IRQ,

+ };

+

+ object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",

+ &error_abort);

+ sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,

+ FSL_IMX6_USBOH3_USB_ADDR + i * 0x200);

+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,

+ qdev_get_gpio_in(DEVICE(&s->a9mpcore),

+ FSL_IMX6_USBn_IRQ[i]));

+ }

+

/* Initialize all ECSPI */

for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {

static const struct {

2.20.1

From: Guenter Roeck <linux@roeck-us.net>

While at it, add some trace messages to help debug problems

seen when running the latest Linux kernel.

hw/block/m25p80.c | 48 ++++++++++++++++++++-----------------------

hw/block/trace-events | 16 +++++++++++++++

2 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c

--- a/hw/block/m25p80.c

+++ b/hw/block/m25p80.c

@@ -XXX,XX +XXX,XX @@

#include "qemu/module.h"

#include "qemu/error-report.h"

#include "qapi/error.h"

-

-#ifndef M25P80_ERR_DEBUG

-#define M25P80_ERR_DEBUG 0

-#endif

-

-#define DB_PRINT_L(level, ...) do { \

- if (M25P80_ERR_DEBUG > (level)) { \

- fprintf(stderr, ": %s: ", __func__); \

- fprintf(stderr, ## __VA_ARGS__); \

- } \

-} while (0)

+#include "trace.h"

/* Fields for FlashPartInfo->flags */

@@ -XXX,XX +XXX,XX @@ static void flash_erase(Flash *s, int offset, FlashCMD cmd)

abort();

}

- DB_PRINT_L(0, "offset = %#x, len = %d\n", offset, len);

+ trace_m25p80_flash_erase(s, offset, len);

if ((s->pi->flags & capa_to_assert) != capa_to_assert) {

qemu_log_mask(LOG_GUEST_ERROR, "M25P80: %d erase size not supported by"

" device\n", len);

@@ -XXX,XX +XXX,XX @@ void flash_write8(Flash *s, uint32_t addr, uint8_t data)

}

if ((prev ^ data) & data) {

- DB_PRINT_L(1, "programming zero to one! addr=%" PRIx32 " %" PRIx8

- " -> %" PRIx8 "\n", addr, prev, data);

+ trace_m25p80_programming_zero_to_one(s, addr, prev, data);

}

if (s->pi->flags & EEPROM) {

@@ -XXX,XX +XXX,XX @@ static void complete_collecting_data(Flash *s)

s->state = STATE_IDLE;

+ trace_m25p80_complete_collecting(s, s->cmd_in_progress, n, s->ear,

+ s->cur_addr);

+

switch (s->cmd_in_progress) {

case DPP:

case QPP:

@@ -XXX,XX +XXX,XX @@ static void reset_memory(Flash *s)

- DB_PRINT_L(0, "Reset done.\n");

+ trace_m25p80_reset_done(s);

static void decode_fast_read_cmd(Flash *s)

@@ -XXX,XX +XXX,XX @@ static void decode_qio_read_cmd(Flash *s)

static void decode_new_cmd(Flash *s, uint32_t value)

- s->cmd_in_progress = value;

int i;

- DB_PRINT_L(0, "decoded new command:%x\n", value);

+

+ s->cmd_in_progress = value;

+ trace_m25p80_command_decoded(s, value);

if (value != RESET_MEMORY) {

s->reset_enable = false;

@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)

break;

case JEDEC_READ:

- DB_PRINT_L(0, "populated jedec code\n");

+ trace_m25p80_populated_jedec(s);

for (i = 0; i < s->pi->id_len; i++) {

s->data[i] = s->pi->id[i];

}

@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)

case BULK_ERASE_60:

case BULK_ERASE:

if (s->write_enable) {

- DB_PRINT_L(0, "chip erase\n");

+ trace_m25p80_chip_erase(s);

flash_erase(s, 0, BULK_ERASE);

} else {

qemu_log_mask(LOG_GUEST_ERROR, "M25P80: chip erase with write "

@@ -XXX,XX +XXX,XX @@ static int m25p80_cs(SSISlave *ss, bool select)

s->data_read_loop = false;

}

- DB_PRINT_L(0, "%sselect\n", select ? "de" : "");

+ trace_m25p80_select(s, select ? "de" : "");

return 0;

}

@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)

Flash *s = M25P80(ss);

uint32_t r = 0;

+ trace_m25p80_transfer(s, s->state, s->len, s->needed_bytes, s->pos,

+ s->cur_addr, (uint8_t)tx);

+

switch (s->state) {

case STATE_PAGE_PROGRAM:

- DB_PRINT_L(1, "page program cur_addr=%#" PRIx32 " data=%" PRIx8 "\n",

- s->cur_addr, (uint8_t)tx);

+ trace_m25p80_page_program(s, s->cur_addr, (uint8_t)tx);

flash_write8(s, s->cur_addr, (uint8_t)tx);

s->cur_addr = (s->cur_addr + 1) & (s->size - 1);

break;

case STATE_READ:

r = s->storage[s->cur_addr];

- DB_PRINT_L(1, "READ 0x%" PRIx32 "=%" PRIx8 "\n", s->cur_addr,

- (uint8_t)r);

+ trace_m25p80_read_byte(s, s->cur_addr, (uint8_t)r);

s->cur_addr = (s->cur_addr + 1) & (s->size - 1);

break;

@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)

}

r = s->data[s->pos];

+ trace_m25p80_read_data(s, s->pos, (uint8_t)r);

s->pos++;

if (s->pos == s->len) {

s->pos = 0;

@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)

return;

}

- DB_PRINT_L(0, "Binding to IF_MTD drive\n");

+ trace_m25p80_binding(s);

s->storage = blk_blockalign(s->blk, s->size);

if (blk_pread(s->blk, 0, s->storage, s->size) != s->size) {

@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)

return;

}

} else {

- DB_PRINT_L(0, "No BDRV - binding to RAM\n");

+ trace_m25p80_binding_no_bdrv(s);

s->storage = blk_blockalign(NULL, s->size);

memset(s->storage, 0xFF, s->size);

}

diff --git a/hw/block/trace-events b/hw/block/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/block/trace-events

+++ b/hw/block/trace-events

@@ -XXX,XX +XXX,XX @@ xen_block_blockdev_add(char *str) "%s"

xen_block_blockdev_del(const char *node_name) "%s"

xen_block_device_create(unsigned int number) "%u"

xen_block_device_destroy(unsigned int number) "%u"

+

+# m25p80.c

+m25p80_flash_erase(void *s, int offset, uint32_t len) "[%p] offset = 0x%"PRIx32", len = %u"

+m25p80_programming_zero_to_one(void *s, uint32_t addr, uint8_t prev, uint8_t data) "[%p] programming zero to one! addr=0x%"PRIx32" 0x%"PRIx8" -> 0x%"PRIx8

+m25p80_reset_done(void *s) "[%p] Reset done."

+m25p80_command_decoded(void *s, uint32_t cmd) "[%p] new command:0x%"PRIx32

+m25p80_complete_collecting(void *s, uint32_t cmd, int n, uint8_t ear, uint32_t cur_addr) "[%p] decode cmd: 0x%"PRIx32" len %d ear 0x%"PRIx8" addr 0x%"PRIx32

+m25p80_populated_jedec(void *s) "[%p] populated jedec code"

+m25p80_chip_erase(void *s) "[%p] chip erase"

+m25p80_select(void *s, const char *what) "[%p] %sselect"

+m25p80_page_program(void *s, uint32_t addr, uint8_t tx) "[%p] page program cur_addr=0x%"PRIx32" data=0x%"PRIx8

+m25p80_transfer(void *s, uint8_t state, uint32_t len, uint8_t needed, uint32_t pos, uint32_t cur_addr, uint8_t t) "[%p] Transfer state 0x%"PRIx8" len 0x%"PRIx32" needed 0x%"PRIx8" pos 0x%"PRIx32" addr 0x%"PRIx32" tx 0x%"PRIx8

+m25p80_read_byte(void *s, uint32_t addr, uint8_t v) "[%p] Read byte 0x%"PRIx32"=0x%"PRIx8

+m25p80_read_data(void *s, uint32_t pos, uint8_t v) "[%p] Read data 0x%"PRIx32"=0x%"PRIx8

+m25p80_binding(void *s) "[%p] Binding to IF_MTD drive"

+m25p80_binding_no_bdrv(void *s) "[%p] No BDRV - binding to RAM"

2.20.1

From: Guenter Roeck <linux@roeck-us.net>

When requesting JEDEC data using the JEDEC_READ command, the Linux kernel

always requests 6 bytes. The current implementation only returns three

bytes, and interprets the remaining three bytes as new commands.

While this does not matter most of the time, it is at the very least

confusing. To avoid the problem, always report up to 6 bytes of JEDEC

data. Fill remaining data with 0.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/block/m25p80.c | 5 ++++-

1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c

--- a/hw/block/m25p80.c

+++ b/hw/block/m25p80.c

@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)

for (i = 0; i < s->pi->id_len; i++) {

s->data[i] = s->pi->id[i];

}

+ for (; i < SPI_NOR_MAX_ID_LEN; i++) {

+ s->data[i] = 0;

+ }

- s->len = s->pi->id_len;

+ s->len = SPI_NOR_MAX_ID_LEN;

s->pos = 0;

s->state = STATE_READING_DATA;

break;

2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Add basic USB PHY support as implemented in i.MX23, i.MX28, i.MX6,

and i.MX7 SoCs.