aboutsummaryrefslogtreecommitdiff
path: root/hw/ssi
AgeCommit message (Collapse)Author
2020-07-03ssi: Add ssi_realize_and_unref()Peter Maydell
Add an ssi_realize_and_unref(), for the benefit of callers who want to be able to create an SSI device, set QOM properties on it, and then do the realize-and-unref afterwards. The API works on the same principle as the recently added qdev_realize_and_undef(), sysbus_realize_and_undef(), etc. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20200628142429.17111-9-peter.maydell@linaro.org
2020-06-15ssi: ssi_create_slave_no_init() is now unused, dropMarkus Armbruster
Cc: Alistair Francis <alistair@alistair23.me> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-26-armbru@redhat.com>
2020-06-15ssi: Convert last use of ssi_create_slave_no_init() manuallyMarkus Armbruster
Same transformation as in the previous commit. Manual, because convincing Coccinelle to transform this case is not worthwhile. Cc: Alistair Francis <alistair@alistair23.me> Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-25-armbru@redhat.com>
2020-06-15ssi: ssi_auto_connect_slaves() never does anything, dropMarkus Armbruster
ssi_auto_connect_slaves(parent, cs_line, bus) iterates over @parent's QOM children @dev of type TYPE_SSI_SLAVE. It puts these on @bus, and sets cs_line[] to qdev_get_gpio_in_named(dev, SSI_GPIO_CS, 0). Suspicious: there is no protection against overrunning cs_line[]. Turns out it's safe because ssi_auto_connect_slaves() never finds any such children. Its called by realize methods of some (but not all) devices providing an SSI bus, and gets passed the device. SSI slave devices are always created with ssi_create_slave_no_init(), optionally via ssi_create_slave(). This adds them to their SSI bus. It doesn't set their QOM parent. ssi_create_slave_no_init() is always immediately followed by qdev_init_nofail(), with no QOM parent assigned, so device_set_realized() puts the device into the /machine/unattached/ orphanage. None become QOM children of a device providing an SSI bus. ssi_auto_connect_slaves() was added in commit b4ae3cfa57 "ssi: Add slave autoconnect helper". I can't see which slaves it was supposed to connect back then. Cc: Alistair Francis <alistair@alistair23.me> Signed-off-by: Markus Armbruster <armbru@redhat.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200610053247.1583243-23-armbru@redhat.com>
2020-06-05hw/ssi/imx_spi: Removed unnecessary cast of rx data received from slaveEden Mikitas
When inserting the value retrieved (rx) from the spi slave, rx is pushed to rx_fifo after being cast to uint8_t. rx_fifo is a fifo32, and the rx register the driver uses is also 32 bit. This zeroes the 24 most significant bits of rx. This proved problematic with devices that expect to use the whole 32 bits of the rx register. Signed-off-by: Eden Mikitas <e.mikitas@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-06-05hw/ssi/imx_spi: changed while statement to prevent underflowEden Mikitas
The while statement in question only checked if tx_burst is not 0. tx_burst is a signed int, which is assigned the value put by the guest driver in ECSPI_CONREG. The burst length can be anywhere between 1 and 4096, and since tx_burst is always decremented by 8 it could possibly underflow, causing an infinite loop. Signed-off-by: Eden Mikitas <e.mikitas@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-05-15qom: Drop parameter @errp of object_property_add() & friendsMarkus Armbruster
The only way object_property_add() can fail is when a property with the same name already exists. Since our property names are all hardcoded, failure is a programming error, and the appropriate way to handle it is passing &error_abort. Same for its variants, except for object_property_add_child(), which additionally fails when the child already has a parent. Parentage is also under program control, so this is a programming error, too. We have a bit over 500 callers. Almost half of them pass &error_abort, slightly fewer ignore errors, one test case handles errors, and the remaining few callers pass them to their own callers. The previous few commits demonstrated once again that ignoring programming errors is a bad idea. Of the few ones that pass on errors, several violate the Error API. The Error ** argument must be NULL, &error_abort, &error_fatal, or a pointer to a variable containing NULL. Passing an argument of the latter kind twice without clearing it in between is wrong: if the first call sets an error, it no longer points to NULL for the second call. ich9_pm_add_properties(), sparc32_ledma_realize(), sparc32_dma_realize(), xilinx_axidma_realize(), xilinx_enet_realize() are wrong that way. When the one appropriate choice of argument is &error_abort, letting users pick the argument is a bad idea. Drop parameter @errp and assert the preconditions instead. There's one exception to "duplicate property name is a programming error": the way object_property_add() implements the magic (and undocumented) "automatic arrayification". Don't drop @errp there. Instead, rename object_property_add() to object_property_try_add(), and add the obvious wrapper object_property_add(). Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-Id: <20200505152926.18877-15-armbru@redhat.com> [Two semantic rebase conflicts resolved]
2020-05-14hw/core: stream: Add an end-of-packet flagEdgar E. Iglesias
Some stream clients stream an endless stream of data while other clients stream data in packets. Stream interfaces usually have a way to signal the end of a packet or the last beat of a transfer. This adds an end-of-packet flag to the push interface. Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-Id: <20200506082513.18751-6-edgar.iglesias@gmail.com>
2020-03-23aspeed/smc: Fix DMA support for AST2600Cédric Le Goater
Recent firmwares uses SPI DMA transfers in U-Boot to load the different images (kernel, initrd, dtb) in the SoC DRAM. The AST2600 FMC model is missing the masks to be applied on the DMA registers which resulted in incorrect values. Fix that and wire the SPI controllers which have DMA support on the AST2600. Fixes: bcaa8ddd081c ("aspeed/smc: Add AST2600 support") Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 20200320053923.20565-1-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-17aspeed/smc: Fix number of dummy cycles for FAST_READ_4 commandGuenter Roeck
The Linux kernel recently started using FAST_READ_4 commands. This results in flash read failures. At the same time, the m25p80 emulation is seen to read 8 more bytes than expected. Adjusting the expected number of dummy cycles to match FAST_READ fixes the problem. Fixes: f95c4bffdc4c ("aspeed/smc: snoop SPI transfers to fake dummy cycles") Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-12aspeed/smc: Fix User mode select/unselect schemeCédric Le Goater
The Aspeed SMC Controller can operate in different modes : Read, Fast Read, Write and User modes. When the User mode is configured, it selects automatically the SPI slave device until the CE_STOP_ACTIVE bit is set to 1. When any other modes are configured the device is unselected. The HW logic handles the chip select automatically when the flash is accessed through its AHB window. When configuring the CEx Control Register, the User mode logic to select and unselect the slave is incorrect and data corruption can be seen on machines using two chips, witherspoon and romulus. Rework the handler setting the CEx Control Register to fix this issue. Fixes: 7c1c69bca43c ("ast2400: add SMC controllers (FMC and SPI)") Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 20200206112645.21275-3-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-03-12aspeed/smc: Add some tracingCédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200206112645.21275-2-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-02-21xilinx_spips: Correct the number of dummy cycles for the FAST_READ_4 cmdFrancisco Iglesias
Correct the number of dummy cycles required by the FAST_READ_4 command (to be eight, one dummy byte). Fixes: ef06ca3946 ("xilinx_spips: Add support for RX discard and RX drain") Suggested-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20200218113350.6090-1-frasse.iglesias@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2020-02-04hw/*/Makefile.objs: Move many .o files to common-objsThomas Huth
We have many files that apparently do not depend on the target CPU configuration, i.e. which can be put into common-obj-y instead of obj-y. This way, the code can be shared for example between qemu-system-arm and qemu-system-aarch64, or the various big and little endian variants like qemu-system-sh4 and qemu-system-sh4eb, so that we do not have to compile the code multiple times anymore. Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20200130133841.10779-1-thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-01-24qdev: set properties with device_class_set_props()Marc-André Lureau
The following patch will need to handle properties registration during class_init time. Let's use a device_class_set_props() setter. spatch --macro-file scripts/cocci-macro-file.h --sp-file ./scripts/coccinelle/qdev-set-props.cocci --keep-comments --in-place --dir . @@ typedef DeviceClass; DeviceClass *d; expression val; @@ - d->props = val + device_class_set_props(d, val) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20200110153039.1379601-20-marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-12-16aspeed/smc: Add AST2600 timings registersCédric Le Goater
Each CS has its own Read Timing Compensation Register on newer SoCs. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 20191119141211.25716-13-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-12-16aspeed/smc: Do not map disabled segment on the AST2600Cédric Le Goater
The segments can be disabled on the AST2600 (zero register value). CS0 is open by default but not the other CS. This is closing the access to the flash device in user mode and forbids scanning. In the model, check the segment size and disable the associated region when the value is zero. Fixes: bcaa8ddd081c ("aspeed/smc: Add AST2600 support") Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 20191119141211.25716-12-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-12-16aspeed/smc: Restore default AHB window mapping at resetCédric Le Goater
The current model only restores the Segment Register values but leaves the previous CS mapping behind. Introduce a helper setting the register value and mapping the region at the requested address. Use this helper when a Segment register is set and at reset. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 20191119141211.25716-11-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-11-19ssi: xilinx_spips: Skip spi bus update for a few register writesSai Pavan Boddu
A few configuration register writes need not update the spi bus state, so just return after the register write. Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 1573830705-14579-1-git-send-email-sai.pavan.boddu@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-10-15aspeed/smc: Add AST2600 supportCédric Le Goater
The AST2600 SoC SMC controller is a SPI only controller now and has a few extensions which we will need to take into account when SW requires it. This is enough to support u-boot and Linux. Signed-off-by: Cédric Le Goater <clg@kaod.org> Acked-by: Joel Stanley <joel@jms.id.au> Message-id: 20190925143248.10000-14-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-10-15aspeed/smc: Introduce segment operationsCédric Le Goater
AST2600 will use a different encoding for the addresses defined in the Segment Register. Signed-off-by: Cédric Le Goater <clg@kaod.org> Acked-by: Joel Stanley <joel@jms.id.au> Message-id: 20190925143248.10000-13-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-09-13aspeed/smc: Calculate checksum on normal DMAChristian Svensson
This patch adds the missing checksum calculation on normal DMA transfer. According to the datasheet this is how the SMC should behave. Verified on AST1250 that the hardware matches the behaviour. Signed-off-by: Christian Svensson <bluecmd@google.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 20190904070506.1052-9-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-09-13aspeed/smc: Inject errors in DMA checksumCédric Le Goater
Emulate read errors in the DMA Checksum Register for high frequencies and optimistic settings of the Read Timing Compensation Register. This will help in tuning the SPI timing calibration algorithm. Errors are only injected when the property "inject_failure" is set to true as suggested by Philippe. The values below are those to expect from the first flash device of the FMC controller of a palmetto-bmc machine. Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 20190904070506.1052-8-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-09-13aspeed/smc: Add DMA calibration settingsCédric Le Goater
When doing calibration, the SPI clock rate in the CE0 Control Register and the read delay cycles in the Read Timing Compensation Register are set using bit[11:4] of the DMA Control Register. Signed-off-by: Cédric Le Goater <clg@kaod.org> Acked-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20190904070506.1052-7-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-09-13aspeed/smc: Add support for DMAsCédric Le Goater
The FMC controller on the Aspeed SoCs support DMA to access the flash modules. It can operate in a normal mode, to copy to or from the flash module mapping window, or in a checksum calculation mode, to evaluate the best clock settings for reads. The model introduces two custom address spaces for DMAs: one for the AHB window of the FMC flash devices and one for the DRAM. The latter is populated using a "dram" link set from the machine with the RAM container region. Signed-off-by: Cédric Le Goater <clg@kaod.org> Acked-by: Joel Stanley <joel@jms.id.au> Message-id: 20190904070506.1052-6-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-09-13aspeed: Use consistent typenamesCédric Le Goater
Improve the naming of the different controller models to ease their generation when initializing the SoC. The rename of the SMC types is breaking migration compatibility. Signed-off-by: Cédric Le Goater <clg@kaod.org> Message-id: 20190904070506.1052-5-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-08-16Clean up inclusion of sysemu/sysemu.hMarkus Armbruster
In my "build everything" tree, changing sysemu/sysemu.h triggers a recompile of some 5400 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). Almost a third of its inclusions are actually superfluous. Delete them. Downgrade two more to qapi/qapi-types-run-state.h, and move one from char/serial.h to char/serial.c. hw/semihosting/config.c, monitor/monitor.c, qdev-monitor.c, and stubs/semihost.c define variables declared in sysemu/sysemu.h without including it. The compiler is cool with that, but include it anyway. This doesn't reduce actual use much, as it's still included into widely included headers. The next commit will tackle that. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20190812052359.30071-27-armbru@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2019-08-16Include hw/qdev-properties.h lessMarkus Armbruster
In my "build everything" tree, changing hw/qdev-properties.h triggers a recompile of some 2700 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). Many places including hw/qdev-properties.h (directly or via hw/qdev.h) actually need only hw/qdev-core.h. Include hw/qdev-core.h there instead. hw/qdev.h is actually pointless: all it does is include hw/qdev-core.h and hw/qdev-properties.h, which in turn includes hw/qdev-core.h. Replace the remaining uses of hw/qdev.h by hw/qdev-properties.h. While there, delete a few superfluous inclusions of hw/qdev-core.h. Touching hw/qdev-properties.h now recompiles some 1200 objects. Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: "Daniel P. Berrangé" <berrange@redhat.com> Cc: Eduardo Habkost <ehabkost@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20190812052359.30071-22-armbru@redhat.com>
2019-08-16Include migration/vmstate.h lessMarkus Armbruster
In my "build everything" tree, changing migration/vmstate.h triggers a recompile of some 2700 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). hw/hw.h supposedly includes it for convenience. Several other headers include it just to get VMStateDescription. The previous commit made that unnecessary. Include migration/vmstate.h only where it's still needed. Touching it now recompiles only some 1600 objects. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-Id: <20190812052359.30071-16-armbru@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
2019-08-16Include hw/irq.h a lot lessMarkus Armbruster
In my "build everything" tree, changing hw/irq.h triggers a recompile of some 5400 out of 6600 objects (not counting tests and objects that don't depend on qemu/osdep.h). hw/hw.h supposedly includes it for convenience. Several other headers include it just to get qemu_irq and.or qemu_irq_handler. Move the qemu_irq and qemu_irq_handler typedefs from hw/irq.h to qemu/typedefs.h, and then include hw/irq.h only where it's still needed. Touching it now recompiles only some 500 objects. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20190812052359.30071-13-armbru@redhat.com>
2019-07-15hw/ssi/mss-spi: Avoid crash when reading empty RX FIFOPhilippe Mathieu-Daudé
Reading the RX_DATA register when the RX_FIFO is empty triggers an abort. This can be easily reproduced: $ qemu-system-arm -M emcraft-sf2 -monitor stdio -S QEMU 4.0.50 monitor - type 'help' for more information (qemu) x 0x40001010 Aborted (core dumped) (gdb) bt #1 0x00007f035874f895 in abort () at /lib64/libc.so.6 #2 0x00005628686591ff in fifo8_pop (fifo=0x56286a9a4c68) at util/fifo8.c:66 #3 0x00005628683e0b8e in fifo32_pop (fifo=0x56286a9a4c68) at include/qemu/fifo32.h:137 #4 0x00005628683e0efb in spi_read (opaque=0x56286a9a4850, addr=4, size=4) at hw/ssi/mss-spi.c:168 #5 0x0000562867f96801 in memory_region_read_accessor (mr=0x56286a9a4b60, addr=16, value=0x7ffeecb0c5c8, size=4, shift=0, mask=4294967295, attrs=...) at memory.c:439 #6 0x0000562867f96cdb in access_with_adjusted_size (addr=16, value=0x7ffeecb0c5c8, size=4, access_size_min=1, access_size_max=4, access_fn=0x562867f967c3 <memory_region_read_accessor>, mr=0x56286a9a4b60, attrs=...) at memory.c:569 #7 0x0000562867f99940 in memory_region_dispatch_read1 (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1420 #8 0x0000562867f99a08 in memory_region_dispatch_read (mr=0x56286a9a4b60, addr=16, pval=0x7ffeecb0c5c8, size=4, attrs=...) at memory.c:1447 #9 0x0000562867f38721 in flatview_read_continue (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, addr1=16, l=4, mr=0x56286a9a4b60) at exec.c:3385 #10 0x0000562867f38874 in flatview_read (fv=0x56286aec6360, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3423 #11 0x0000562867f388ea in address_space_read_full (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4) at exec.c:3436 #12 0x0000562867f389c5 in address_space_rw (as=0x56286aa3e890, addr=1073745936, attrs=..., buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=false) at exec.c:3466 #13 0x0000562867f3bdd7 in cpu_memory_rw_debug (cpu=0x56286aa19d00, addr=1073745936, buf=0x7ffeecb0c7c0 "\340ǰ\354\376\177", len=4, is_write=0) at exec.c:3976 #14 0x000056286811ed51 in memory_dump (mon=0x56286a8c32d0, count=1, format=120, wsize=4, addr=1073745936, is_physical=0) at monitor/misc.c:730 #15 0x000056286811eff1 in hmp_memory_dump (mon=0x56286a8c32d0, qdict=0x56286b15c400) at monitor/misc.c:785 #16 0x00005628684740ee in handle_hmp_command (mon=0x56286a8c32d0, cmdline=0x56286a8caeb2 "0x40001010") at monitor/hmp.c:1082 From the datasheet "Actel SmartFusion Microcontroller Subsystem User's Guide" Rev.1, Table 13-3 "SPI Register Summary", this register has a reset value of 0. Check the FIFO is not empty before accessing it, else log an error message. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-id: 20190709113715.7761-3-philmd@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-15hw/ssi/xilinx_spips: Avoid out-of-bound access to lqspi_buf[]Philippe Mathieu-Daudé
Both lqspi_read() and lqspi_load_cache() expect a 32-bit aligned address. >From UG1085 datasheet [*] chapter on 'Quad-SPI Controller': Transfer Size Limitations Because of the 32-bit wide TX, RX, and generic FIFO, all APB/AXI transfers must be an integer multiple of 4-bytes. Shorter transfers are not possible. Set MemoryRegionOps.impl values to force 32-bit accesses, this way we are sure we do not access the lqspi_buf[] array out of bound. [*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-15hw/ssi/xilinx_spips: Avoid AXI writes to the LQSPI linear memoryPhilippe Mathieu-Daudé
Lei Sun found while auditing the code that a CPU write would trigger a NULL pointer dereference. >From UG1085 datasheet [*] AXI writes in this region are ignored and generates an AXI Slave Error (SLVERR). Fix by implementing the write_with_attrs() handler. Return MEMTX_ERROR when the region is accessed (this error maps to an AXI slave error). [*] https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf Reported-by: Lei Sun <slei.casper@gmail.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-15hw/ssi/xilinx_spips: Convert lqspi_read() to read_with_attrsPhilippe Mathieu-Daudé
In the next commit we will implement the write_with_attrs() handler. To avoid using different APIs, convert the read() handler first. Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-07-01aspeed/smc: add a 'sdram_base' propertyCédric Le Goater
The DRAM address of a DMA transaction depends on the DRAM base address of the SoC. Inform the SMC controller model with this value. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20190618165311.27066-15-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-06-12Include qemu/module.h where needed, drop it from qemu-common.hMarkus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20190523143508.25387-4-armbru@redhat.com> [Rebased with conflicts resolved automatically, except for hw/usb/dev-hub.c hw/misc/exynos4210_rng.c hw/misc/bcm2835_rng.c hw/misc/aspeed_scu.c hw/display/virtio-vga.c hw/arm/stm32f205_soc.c; ui/cocoa.m fixed up]
2019-04-29hw/ssi/xilinx_spips: Avoid variable length arrayPeter Maydell
In the stripe8() function we use a variable length array; however we know that the maximum length required is MAX_NUM_BUSSES. Use a fixed-length array and an assert instead. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Message-id: 20190328152635.2794-1-peter.maydell@linaro.org
2019-03-07ssi: express dependencies with kconfigPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-03-07kconfig: introduce kconfig filesPaolo Bonzini
The Kconfig files were generated mostly with this script: for i in `grep -ho CONFIG_[A-Z0-9_]* default-configs/* | sort -u`; do set fnord `git grep -lw $i -- 'hw/*/Makefile.objs' ` shift if test $# = 1; then cat >> $(dirname $1)/Kconfig << EOF config ${i#CONFIG_} bool EOF git add $(dirname $1)/Kconfig else echo $i $* fi done sed -i '$d' hw/*/Kconfig for i in hw/*; do if test -d $i && ! test -f $i/Kconfig; then touch $i/Kconfig git add $i/Kconfig fi done Whenever a symbol is referenced from multiple subdirectories, the script prints the list of directories that reference the symbol. These symbols have to be added manually to the Kconfig files. Kconfig.host and hw/Kconfig were created manually. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Yang Zhong <yang.zhong@intel.com> Message-Id: <20190123065618.3520-27-yang.zhong@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2019-01-29aspeed/smc: snoop SPI transfers to fake dummy cyclesCédric Le Goater
The m25p80 models dummy cycles using byte transfers. This works well when the transfers are initiated by the QEMU model of a SPI controller but when these are initiated by the OS, it breaks emulation. Snoop the SPI transfer to catch commands requiring dummy cycles and replace them with byte transfers compatible with the m25p80 model. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com> Message-id: 20190124140519.13838-5-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-01-29aspeed/smc: Add dummy data registerCédric Le Goater
The SMC controllers have a register containing the byte that will be used as dummy output. It can be modified by software. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 20190124140519.13838-4-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-01-29aspeed/smc: define registers for all possible CSCédric Le Goater
The model should expose one control register per possible CS. When testing the validity of the register number in the read operation, replace 's->num_cs' by 'ctrl->max_slaves' which represents the maximum number of flash devices a controller can handle. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 20190124140519.13838-3-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2019-01-29aspeed/smc: fix default read valueCédric Le Goater
0xFFFFFFFF should be returned for non implemented registers. Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Joel Stanley <joel@jms.id.au> Message-id: 20190124140519.13838-2-clg@kaod.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-10-24hw/ssi/xilinx_spi: Use DeviceState::realize rather than SysBusDevice::initPhilippe Mathieu-Daudé
Move from the legacy SysBusDevice::init method to using DeviceState::realize. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20181002212522.23303-5-f4bug@amsat.org> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
2018-09-25aspeed/smc: fix some alignment issuesCédric Le Goater
Signed-off-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180921161939.822-6-clg@kaod.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-08-24hw/ssi/pl022: Correct wrong DMACR and ICR handlingPeter Maydell
In the PL022, register offset 0x20 is the ICR, a write-only interrupt-clear register. Register offset 0x24 is DMACR, the DMA control register. We were incorrectly implementing (a stub version of) DMACR at 0x20, and not implementing anything at 0x24. Fix this bug. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180820141116.9118-21-peter.maydell@linaro.org Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2018-08-24hw/ssi/pl022: Correct wrong value for PL022_INT_RTPeter Maydell
The PL022 interrupt registers have bits allocated as: 0: ROR (receive overrun) 1: RT (receive timeout) 2: RX (receive FIFO half full or less) 3: TX (transmit FIFO half full or less) A cut and paste error meant we had the wrong value for the PL022_INT_RT constant. This bug doesn't affect device behaviour, because we don't implement the receive timeout feature and so never set that interrupt bit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180820141116.9118-20-peter.maydell@linaro.org Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2018-08-24hw/ssi/pl022: Use DeviceState::realize rather than SysBusDevice::initPeter Maydell
Move from the legacy SysBusDevice::init method to using DeviceState::realize. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180820141116.9118-19-peter.maydell@linaro.org Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2018-08-24hw/ssi/pl022: Don't directly call vmstate_register()Peter Maydell
Use the DeviceState vmsd pointer rather than calling vmstate_register() directly. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20180820141116.9118-18-peter.maydell@linaro.org Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
2018-08-24hw/ssi/pl022: Set up reset function in class initPeter Maydell
Currently the PL022 calls pl022_reset() from its class init function. Make it register a DeviceState reset method instead, so that we reset the device on system reset. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20180820141116.9118-17-peter.maydell@linaro.org Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
generated by cgit v1.2.3 (git 2.26.2) at 2024-11-27 01:39:53 +0000