From 755026728abb19fba70e6b4396a27fa2e7550d74 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:15 +0000 Subject: [PATCH 01/36] target-arm: correct CNTFRQ access rights Correct some corner cases we were getting wrong for CNTFRQ access rights: * should UNDEF from 32-bit Secure EL1 * only writable from the highest implemented exception level, which might not be EL1 now To clarify the code, provide a new utility function arm_highest_el() which returns the highest implemented exception level. Signed-off-by: Peter Maydell Reviewed-by: Sergey Fedorov Reviewed-by: Edgar E. Iglesias --- target-arm/cpu.h | 12 ++++++++++++ target-arm/helper.c | 29 ++++++++++++++++++++++++++--- 2 files changed, 38 insertions(+), 3 deletions(-) diff --git a/target-arm/cpu.h b/target-arm/cpu.h index 5137632ccc..afbf3661eb 100644 --- a/target-arm/cpu.h +++ b/target-arm/cpu.h @@ -1255,6 +1255,18 @@ static inline bool cptype_valid(int cptype) #define PL1_RW (PL1_R | PL1_W) #define PL0_RW (PL0_R | PL0_W) +/* Return the highest implemented Exception Level */ +static inline int arm_highest_el(CPUARMState *env) +{ + if (arm_feature(env, ARM_FEATURE_EL3)) { + return 3; + } + if (arm_feature(env, ARM_FEATURE_EL2)) { + return 2; + } + return 1; +} + /* Return the current Exception Level (as per ARMv8; note that this differs * from the ARMv7 Privilege Level). */ diff --git a/target-arm/helper.c b/target-arm/helper.c index 2f9db72806..4d27c004d8 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -1218,10 +1218,33 @@ static const ARMCPRegInfo v6k_cp_reginfo[] = { static CPAccessResult gt_cntfrq_access(CPUARMState *env, const ARMCPRegInfo *ri, bool isread) { - /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero */ - if (arm_current_el(env) == 0 && !extract32(env->cp15.c14_cntkctl, 0, 2)) { - return CP_ACCESS_TRAP; + /* CNTFRQ: not visible from PL0 if both PL0PCTEN and PL0VCTEN are zero. + * Writable only at the highest implemented exception level. + */ + int el = arm_current_el(env); + + switch (el) { + case 0: + if (!extract32(env->cp15.c14_cntkctl, 0, 2)) { + return CP_ACCESS_TRAP; + } + break; + case 1: + if (!isread && ri->state == ARM_CP_STATE_AA32 && + arm_is_secure_below_el3(env)) { + /* Accesses from 32-bit Secure EL1 UNDEF (*not* trap to EL3!) */ + return CP_ACCESS_TRAP_UNCATEGORIZED; + } + break; + case 2: + case 3: + break; } + + if (!isread && el < arm_highest_el(env)) { + return CP_ACCESS_TRAP_UNCATEGORIZED; + } + return CP_ACCESS_OK; } From f096e92b6385fd87e8ea948ad3af70faf752c13a Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:15 +0000 Subject: [PATCH 02/36] target-arm: Fix handling of SCR.SMD We weren't quite implementing the handling of SCR.SMD correctly. The condition governing whether the SMD bit should apply only for NS state is "is EL3 is AArch32", not "is the current EL AArch32". Fix the condition, and clarify the comment both to reflect this and to expand slightly on what's going on for the v7-no-Virtualization case. Signed-off-by: Peter Maydell Reviewed-by: Sergey Fedorov Reviewed-by: Edgar E. Iglesias --- target-arm/op_helper.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c index bd48549826..4c0980e5a5 100644 --- a/target-arm/op_helper.c +++ b/target-arm/op_helper.c @@ -614,12 +614,14 @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome) int cur_el = arm_current_el(env); bool secure = arm_is_secure(env); bool smd = env->cp15.scr_el3 & SCR_SMD; - /* On ARMv8 AArch32, SMD only applies to NS state. - * On ARMv7 SMD only applies to NS state and only if EL2 is available. - * For ARMv7 non EL2, we force SMD to zero so we don't need to re-check - * the EL2 condition here. + /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state. + * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization + * extensions, SMD only applies to NS state. + * On ARMv7 without the Virtualization extensions, the SMD bit + * doesn't exist, but we forbid the guest to set it to 1 in scr_write(), + * so we need not special case this here. */ - bool undef = is_a64(env) ? smd : (!secure && smd); + bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure; if (arm_is_psci_call(cpu, EXCP_SMC)) { /* If PSCI is enabled and this looks like a valid PSCI call then From 187f678d5c28251dba2b44127e59966b14518ef7 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:15 +0000 Subject: [PATCH 03/36] target-arm: Implement MDCR_EL3.TDOSA and MDCR_EL2.TDOSA traps Implement the traps to EL2 and EL3 controlled by the bits MDCR_EL2.TDOSA MDCR_EL3.TDOSA. These can configurably trap accesses to the "powerdown debug" registers. Signed-off-by: Peter Maydell Reviewed-by: Sergey Fedorov --- target-arm/cpu.h | 12 ++++++++++++ target-arm/helper.c | 23 ++++++++++++++++++++++- 2 files changed, 34 insertions(+), 1 deletion(-) diff --git a/target-arm/cpu.h b/target-arm/cpu.h index afbf3661eb..77f9b51b76 100644 --- a/target-arm/cpu.h +++ b/target-arm/cpu.h @@ -595,6 +595,18 @@ void pmccntr_sync(CPUARMState *env); #define CPTR_TTA (1U << 20) #define CPTR_TFP (1U << 10) +#define MDCR_EPMAD (1U << 21) +#define MDCR_EDAD (1U << 20) +#define MDCR_SPME (1U << 17) +#define MDCR_SDD (1U << 16) +#define MDCR_TDRA (1U << 11) +#define MDCR_TDOSA (1U << 10) +#define MDCR_TDA (1U << 9) +#define MDCR_TDE (1U << 8) +#define MDCR_HPME (1U << 7) +#define MDCR_TPM (1U << 6) +#define MDCR_TPMCR (1U << 5) + #define CPSR_M (0x1fU) #define CPSR_T (1U << 5) #define CPSR_F (1U << 6) diff --git a/target-arm/helper.c b/target-arm/helper.c index 4d27c004d8..b45d596982 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -385,6 +385,24 @@ static CPAccessResult access_trap_aa32s_el1(CPUARMState *env, return CP_ACCESS_TRAP_UNCATEGORIZED; } +/* Check for traps to "powerdown debug" registers, which are controlled + * by MDCR.TDOSA + */ +static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri, + bool isread) +{ + int el = arm_current_el(env); + + if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TDOSA) + && !arm_is_secure_below_el3(env)) { + return CP_ACCESS_TRAP_EL2; + } + if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) { + return CP_ACCESS_TRAP_EL3; + } + return CP_ACCESS_OK; +} + static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) { ARMCPU *cpu = arm_env_get_cpu(env); @@ -3778,15 +3796,18 @@ static const ARMCPRegInfo debug_cp_reginfo[] = { { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4, .access = PL1_W, .type = ARM_CP_NO_RAW, + .accessfn = access_tdosa, .writefn = oslar_write }, { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4, .access = PL1_R, .resetvalue = 10, + .accessfn = access_tdosa, .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) }, /* Dummy OSDLR_EL1: 32-bit Linux will read this */ { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4, - .access = PL1_RW, .type = ARM_CP_NOP }, + .access = PL1_RW, .accessfn = access_tdosa, + .type = ARM_CP_NOP }, /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't * implement vector catch debug events yet. */ From 91b0a23865558e2ce9c2e7042d404e8bf2e4b817 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:15 +0000 Subject: [PATCH 04/36] target-arm: Implement MDCR_EL2.TDRA traps Implement trapping of the "debug ROM" registers, which are controlled by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3. Signed-off-by: Peter Maydell Reviewed-by: Sergey Fedorov --- target-arm/helper.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/target-arm/helper.c b/target-arm/helper.c index b45d596982..11eb77ab10 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -403,6 +403,24 @@ static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri, return CP_ACCESS_OK; } +/* Check for traps to "debug ROM" registers, which are controlled + * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3. + */ +static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri, + bool isread) +{ + int el = arm_current_el(env); + + if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TDRA) + && !arm_is_secure_below_el3(env)) { + return CP_ACCESS_TRAP_EL2; + } + if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { + return CP_ACCESS_TRAP_EL3; + } + return CP_ACCESS_OK; +} + static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) { ARMCPU *cpu = arm_env_get_cpu(env); @@ -3773,12 +3791,15 @@ static const ARMCPRegInfo debug_cp_reginfo[] = { * accessor. */ { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0, - .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, + .access = PL0_R, .accessfn = access_tdra, + .type = ARM_CP_CONST, .resetvalue = 0 }, { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0, - .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 0 }, + .access = PL1_R, .accessfn = access_tdra, + .type = ARM_CP_CONST, .resetvalue = 0 }, { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0, - .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = 0 }, + .access = PL0_R, .accessfn = access_tdra, + .type = ARM_CP_CONST, .resetvalue = 0 }, /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */ { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, From d6c8cf815171e35e0b1ef4e0cff602ab3d575747 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:15 +0000 Subject: [PATCH 05/36] target-arm: Implement MDCR_EL3.TDA and MDCR_EL2.TDA traps Implement the debug register traps controlled by MDCR_EL2.TDA and MDCR_EL3.TDA. Signed-off-by: Peter Maydell Reviewed-by: Sergey Fedorov --- target-arm/helper.c | 39 ++++++++++++++++++++++++++++++--------- 1 file changed, 30 insertions(+), 9 deletions(-) diff --git a/target-arm/helper.c b/target-arm/helper.c index 11eb77ab10..e2b72389be 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -421,6 +421,24 @@ static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri, return CP_ACCESS_OK; } +/* Check for traps to general debug registers, which are controlled + * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3. + */ +static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri, + bool isread) +{ + int el = arm_current_el(env); + + if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TDA) + && !arm_is_secure_below_el3(env)) { + return CP_ACCESS_TRAP_EL2; + } + if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) { + return CP_ACCESS_TRAP_EL3; + } + return CP_ACCESS_OK; +} + static void dacr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) { ARMCPU *cpu = arm_env_get_cpu(env); @@ -3384,7 +3402,8 @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = { .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH, .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1, - .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, + .access = PL2_RW, .accessfn = access_tda, + .type = ARM_CP_CONST, .resetvalue = 0 }, { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH, .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4, .access = PL2_RW, .accessfn = access_el3_aa32ns_aa64any, @@ -3803,7 +3822,7 @@ static const ARMCPRegInfo debug_cp_reginfo[] = { /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */ { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2, - .access = PL1_RW, + .access = PL1_RW, .accessfn = access_tda, .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), .resetvalue = 0 }, /* MDCCSR_EL0, aka DBGDSCRint. This is a read-only mirror of MDSCR_EL1. @@ -3812,7 +3831,7 @@ static const ARMCPRegInfo debug_cp_reginfo[] = { { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_BOTH, .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0, .type = ARM_CP_ALIAS, - .access = PL1_R, + .access = PL1_R, .accessfn = access_tda, .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), }, { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH, .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4, @@ -3834,7 +3853,8 @@ static const ARMCPRegInfo debug_cp_reginfo[] = { */ { .name = "DBGVCR", .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0, - .access = PL1_RW, .type = ARM_CP_NOP }, + .access = PL1_RW, .accessfn = access_tda, + .type = ARM_CP_NOP }, REGINFO_SENTINEL }; @@ -4099,7 +4119,8 @@ static void define_debug_regs(ARMCPU *cpu) int wrps, brps, ctx_cmps; ARMCPRegInfo dbgdidr = { .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0, - .access = PL0_R, .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr, + .access = PL0_R, .accessfn = access_tda, + .type = ARM_CP_CONST, .resetvalue = cpu->dbgdidr, }; /* Note that all these register fields hold "number of Xs minus 1". */ @@ -4130,13 +4151,13 @@ static void define_debug_regs(ARMCPU *cpu) ARMCPRegInfo dbgregs[] = { { .name = "DBGBVR", .state = ARM_CP_STATE_BOTH, .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4, - .access = PL1_RW, + .access = PL1_RW, .accessfn = access_tda, .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]), .writefn = dbgbvr_write, .raw_writefn = raw_write }, { .name = "DBGBCR", .state = ARM_CP_STATE_BOTH, .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5, - .access = PL1_RW, + .access = PL1_RW, .accessfn = access_tda, .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]), .writefn = dbgbcr_write, .raw_writefn = raw_write }, @@ -4149,13 +4170,13 @@ static void define_debug_regs(ARMCPU *cpu) ARMCPRegInfo dbgregs[] = { { .name = "DBGWVR", .state = ARM_CP_STATE_BOTH, .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6, - .access = PL1_RW, + .access = PL1_RW, .accessfn = access_tda, .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]), .writefn = dbgwvr_write, .raw_writefn = raw_write }, { .name = "DBGWCR", .state = ARM_CP_STATE_BOTH, .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7, - .access = PL1_RW, + .access = PL1_RW, .accessfn = access_tda, .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]), .writefn = dbgwcr_write, .raw_writefn = raw_write }, From f2cae6092767aaf418778eada15be444c23883be Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:16 +0000 Subject: [PATCH 06/36] target-arm: Report correct syndrome for FPEXC32_EL2 traps If access to FPEXC32_EL2 is trapped by CPTR_EL2.TFP or CPTR_EL3.TFP, this should be reported with a syndrome register indicating an FP access trap, not one indicating a system register access trap. Signed-off-by: Peter Maydell Reviewed-by: Sergey Fedorov --- target-arm/cpu.h | 5 +++++ target-arm/helper.c | 4 ++-- target-arm/op_helper.c | 13 +++++++++++++ 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/target-arm/cpu.h b/target-arm/cpu.h index 77f9b51b76..16238216f4 100644 --- a/target-arm/cpu.h +++ b/target-arm/cpu.h @@ -1334,6 +1334,11 @@ typedef enum CPAccessResult { /* As CP_ACCESS_UNCATEGORIZED, but for traps directly to EL2 or EL3 */ CP_ACCESS_TRAP_UNCATEGORIZED_EL2 = 5, CP_ACCESS_TRAP_UNCATEGORIZED_EL3 = 6, + /* Access fails and results in an exception syndrome for an FP access, + * trapped directly to EL2 or EL3 + */ + CP_ACCESS_TRAP_FP_EL2 = 7, + CP_ACCESS_TRAP_FP_EL3 = 8, } CPAccessResult; /* Access functions for coprocessor registers. These cannot fail and diff --git a/target-arm/helper.c b/target-arm/helper.c index e2b72389be..bb913c6e17 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -3011,10 +3011,10 @@ static CPAccessResult fpexc32_access(CPUARMState *env, const ARMCPRegInfo *ri, bool isread) { if ((env->cp15.cptr_el[2] & CPTR_TFP) && arm_current_el(env) == 2) { - return CP_ACCESS_TRAP_EL2; + return CP_ACCESS_TRAP_FP_EL2; } if (env->cp15.cptr_el[3] & CPTR_TFP) { - return CP_ACCESS_TRAP_EL3; + return CP_ACCESS_TRAP_FP_EL3; } return CP_ACCESS_OK; } diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c index 4c0980e5a5..049b52158b 100644 --- a/target-arm/op_helper.c +++ b/target-arm/op_helper.c @@ -500,6 +500,19 @@ void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome, target_el = 3; syndrome = syn_uncategorized(); break; + case CP_ACCESS_TRAP_FP_EL2: + target_el = 2; + /* Since we are an implementation that takes exceptions on a trapped + * conditional insn only if the insn has passed its condition code + * check, we take the IMPDEF choice to always report CV=1 COND=0xe + * (which is also the required value for AArch64 traps). + */ + syndrome = syn_fp_access_trap(1, 0xe, false); + break; + case CP_ACCESS_TRAP_FP_EL3: + target_el = 3; + syndrome = syn_fp_access_trap(1, 0xe, false); + break; default: g_assert_not_reached(); } From cbc0326b6fb905f80b7cef85b24571f7ebb62077 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:16 +0000 Subject: [PATCH 07/36] target-arm: Clean up trap/undef handling of SRS The SRS instruction is: * UNDEFINED in Hyp mode * UNPREDICTABLE in User or System mode * UNPREDICTABLE if the specified mode isn't accessible * trapped to EL3 if EL3 is AArch64 and we are at Secure EL1 Clean up the code to handle all these cases cleanly, including picking UNDEF as our choice of UNPREDICTABLE behaviour rather blindly trusting the mode field passed in the instruction. As part of this, move the check for IS_USER into gen_srs() itself rather than having it done by the caller. The exception is that we don't UNDEF for calls from System mode, which need a runtime check. This will be dealt with in the following commits. Signed-off-by: Peter Maydell Reviewed-by: Sergey Fedorov Reviewed-by: Edgar E. Iglesias --- target-arm/translate.c | 66 ++++++++++++++++++++++++++++++++++++++---- 1 file changed, 61 insertions(+), 5 deletions(-) diff --git a/target-arm/translate.c b/target-arm/translate.c index cf3dc33774..7bceb05f48 100644 --- a/target-arm/translate.c +++ b/target-arm/translate.c @@ -7578,8 +7578,67 @@ static void gen_srs(DisasContext *s, uint32_t mode, uint32_t amode, bool writeback) { int32_t offset; - TCGv_i32 addr = tcg_temp_new_i32(); - TCGv_i32 tmp = tcg_const_i32(mode); + TCGv_i32 addr, tmp; + bool undef = false; + + /* SRS is: + * - trapped to EL3 if EL3 is AArch64 and we are at Secure EL1 + * - UNDEFINED in Hyp mode + * - UNPREDICTABLE in User or System mode + * - UNPREDICTABLE if the specified mode is: + * -- not implemented + * -- not a valid mode number + * -- a mode that's at a higher exception level + * -- Monitor, if we are Non-secure + * For the UNPREDICTABLE cases we choose to UNDEF, except that for + * "current mode is System" we will write a garbage SPSR. + * (This is because we don't have access to our current mode here + * and would have to do a runtime check to UNDEF for System.) + */ + if (s->current_el == 1 && !s->ns) { + gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), 3); + return; + } + + if (s->current_el == 0 || s->current_el == 2) { + undef = true; + } + + switch (mode) { + case ARM_CPU_MODE_USR: + case ARM_CPU_MODE_FIQ: + case ARM_CPU_MODE_IRQ: + case ARM_CPU_MODE_SVC: + case ARM_CPU_MODE_ABT: + case ARM_CPU_MODE_UND: + case ARM_CPU_MODE_SYS: + break; + case ARM_CPU_MODE_HYP: + if (s->current_el == 1 || !arm_dc_feature(s, ARM_FEATURE_EL2)) { + undef = true; + } + break; + case ARM_CPU_MODE_MON: + /* No need to check specifically for "are we non-secure" because + * we've already made EL0 UNDEF and handled the trap for S-EL1; + * so if this isn't EL3 then we must be non-secure. + */ + if (s->current_el != 3) { + undef = true; + } + break; + default: + undef = true; + } + + if (undef) { + gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), + default_exception_el(s)); + return; + } + + addr = tcg_temp_new_i32(); + tmp = tcg_const_i32(mode); gen_helper_get_r13_banked(addr, cpu_env, tmp); tcg_temp_free_i32(tmp); switch (amode) { @@ -7739,9 +7798,6 @@ static void disas_arm_insn(DisasContext *s, unsigned int insn) } } else if ((insn & 0x0e5fffe0) == 0x084d0500) { /* srs */ - if (IS_USER(s)) { - goto illegal_op; - } ARCH(6); gen_srs(s, (insn & 0x1f), (insn >> 23) & 3, insn & (1 << 21)); return; From 72309cee482868d6c4711931c3f7e02ab9dec229 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:16 +0000 Subject: [PATCH 08/36] target-arm: Move get/set_r13_banked() to op_helper.c Move get/set_r13_banked() from helper.c to op_helper.c. This will let us add exception-raising code to them, and also puts them in the same file as get/set_user_reg(), which makes some conceptual sense. (The original reason for the helper.c/op_helper.c split was that only op_helper.c had access to the CPU env pointer; this distinction has not been true for a long time, though, and so the split is now rather arbitrary.) Signed-off-by: Peter Maydell Reviewed-by: Sergey Fedorov Reviewed-by: Edgar E. Iglesias --- target-arm/helper.c | 33 --------------------------------- target-arm/op_helper.c | 37 +++++++++++++++++++++++++++++++++++++ 2 files changed, 37 insertions(+), 33 deletions(-) diff --git a/target-arm/helper.c b/target-arm/helper.c index bb913c6e17..c46e3d0d09 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -5365,21 +5365,6 @@ void switch_mode(CPUARMState *env, int mode) } } -void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val) -{ - ARMCPU *cpu = arm_env_get_cpu(env); - - cpu_abort(CPU(cpu), "banked r13 write\n"); -} - -uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode) -{ - ARMCPU *cpu = arm_env_get_cpu(env); - - cpu_abort(CPU(cpu), "banked r13 read\n"); - return 0; -} - uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx, uint32_t cur_el, bool secure) { @@ -7762,24 +7747,6 @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr, return phys_addr; } -void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val) -{ - if ((env->uncached_cpsr & CPSR_M) == mode) { - env->regs[13] = val; - } else { - env->banked_r13[bank_number(mode)] = val; - } -} - -uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode) -{ - if ((env->uncached_cpsr & CPSR_M) == mode) { - return env->regs[13]; - } else { - return env->banked_r13[bank_number(mode)]; - } -} - uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg) { ARMCPU *cpu = arm_env_get_cpu(env); diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c index 049b52158b..053e9b62bc 100644 --- a/target-arm/op_helper.c +++ b/target-arm/op_helper.c @@ -457,6 +457,43 @@ void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val) } } +#if defined(CONFIG_USER_ONLY) +void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val) +{ + ARMCPU *cpu = arm_env_get_cpu(env); + + cpu_abort(CPU(cpu), "banked r13 write\n"); +} + +uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode) +{ + ARMCPU *cpu = arm_env_get_cpu(env); + + cpu_abort(CPU(cpu), "banked r13 read\n"); + return 0; +} + +#else + +void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val) +{ + if ((env->uncached_cpsr & CPSR_M) == mode) { + env->regs[13] = val; + } else { + env->banked_r13[bank_number(mode)] = val; + } +} + +uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode) +{ + if ((env->uncached_cpsr & CPSR_M) == mode) { + return env->regs[13]; + } else { + return env->banked_r13[bank_number(mode)]; + } +} +#endif + void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome, uint32_t isread) { From c766568d3604082c6fd45cbabe42c48e4861a13f Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:16 +0000 Subject: [PATCH 09/36] target-arm: Move bank_number() into internals.h Move bank_number()'s implementation into internals.h, so it's available in the user-mode-only compile as well. Signed-off-by: Peter Maydell Reviewed-by: Sergey Fedorov --- target-arm/helper.c | 25 ------------------------- target-arm/internals.h | 26 +++++++++++++++++++++++++- 2 files changed, 25 insertions(+), 26 deletions(-) diff --git a/target-arm/helper.c b/target-arm/helper.c index c46e3d0d09..a420a2a331 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -5378,31 +5378,6 @@ void aarch64_sync_64_to_32(CPUARMState *env) #else -/* Map CPU modes onto saved register banks. */ -int bank_number(int mode) -{ - switch (mode) { - case ARM_CPU_MODE_USR: - case ARM_CPU_MODE_SYS: - return BANK_USRSYS; - case ARM_CPU_MODE_SVC: - return BANK_SVC; - case ARM_CPU_MODE_ABT: - return BANK_ABT; - case ARM_CPU_MODE_UND: - return BANK_UND; - case ARM_CPU_MODE_IRQ: - return BANK_IRQ; - case ARM_CPU_MODE_FIQ: - return BANK_FIQ; - case ARM_CPU_MODE_HYP: - return BANK_HYP; - case ARM_CPU_MODE_MON: - return BANK_MON; - } - g_assert_not_reached(); -} - void switch_mode(CPUARMState *env, int mode) { int old_mode; diff --git a/target-arm/internals.h b/target-arm/internals.h index 70bec4a4d2..2e70272be2 100644 --- a/target-arm/internals.h +++ b/target-arm/internals.h @@ -109,7 +109,31 @@ static inline unsigned int aarch64_banked_spsr_index(unsigned int el) return map[el]; } -int bank_number(int mode); +/* Map CPU modes onto saved register banks. */ +static inline int bank_number(int mode) +{ + switch (mode) { + case ARM_CPU_MODE_USR: + case ARM_CPU_MODE_SYS: + return BANK_USRSYS; + case ARM_CPU_MODE_SVC: + return BANK_SVC; + case ARM_CPU_MODE_ABT: + return BANK_ABT; + case ARM_CPU_MODE_UND: + return BANK_UND; + case ARM_CPU_MODE_IRQ: + return BANK_IRQ; + case ARM_CPU_MODE_FIQ: + return BANK_FIQ; + case ARM_CPU_MODE_HYP: + return BANK_HYP; + case ARM_CPU_MODE_MON: + return BANK_MON; + } + g_assert_not_reached(); +} + void switch_mode(CPUARMState *, int); void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu); void arm_translate_init(void); From d86d57d4fe683c99823f625f941eff26c07c72c3 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:16 +0000 Subject: [PATCH 10/36] target-arm: Combine user-only and softmmu get/set_r13_banked() The user-mode versions of get/set_r13_banked() exist just to assert if they're ever called -- the translate time code should never emit calls to them because SRS from user mode always UNDEF. There's no code in the softmmu versions that can't compile in CONFIG_USER_ONLY, and the assertion is not particularly useful, so combine the two functions rather than having completely split versions under ifdefs. Signed-off-by: Peter Maydell Reviewed-by: Edgar E. Iglesias Reviewed-by: Sergey Fedorov --- target-arm/op_helper.c | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c index 053e9b62bc..cfdbc8da94 100644 --- a/target-arm/op_helper.c +++ b/target-arm/op_helper.c @@ -457,24 +457,6 @@ void HELPER(set_user_reg)(CPUARMState *env, uint32_t regno, uint32_t val) } } -#if defined(CONFIG_USER_ONLY) -void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val) -{ - ARMCPU *cpu = arm_env_get_cpu(env); - - cpu_abort(CPU(cpu), "banked r13 write\n"); -} - -uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode) -{ - ARMCPU *cpu = arm_env_get_cpu(env); - - cpu_abort(CPU(cpu), "banked r13 read\n"); - return 0; -} - -#else - void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val) { if ((env->uncached_cpsr & CPSR_M) == mode) { @@ -492,7 +474,6 @@ uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode) return env->banked_r13[bank_number(mode)]; } } -#endif void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome, uint32_t isread) From f01377f591fe15c652f947646c4a69a7d4a71ad9 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:17 +0000 Subject: [PATCH 11/36] target-arm: UNDEF in the UNPREDICTABLE SRS-from-System case Make get_r13_banked() raise an exception at runtime for the corner case of SRS from System mode, so that we can UNDEF it; this brings us in to line with the ARM ARM's set of permitted CONSTRAINED UNPREDICTABLE choices. Signed-off-by: Peter Maydell Reviewed-by: Sergey Fedorov Reviewed-by: Edgar E. Iglesias --- target-arm/op_helper.c | 8 ++++++++ target-arm/translate.c | 9 +++++---- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/target-arm/op_helper.c b/target-arm/op_helper.c index cfdbc8da94..538887ce0c 100644 --- a/target-arm/op_helper.c +++ b/target-arm/op_helper.c @@ -468,6 +468,14 @@ void HELPER(set_r13_banked)(CPUARMState *env, uint32_t mode, uint32_t val) uint32_t HELPER(get_r13_banked)(CPUARMState *env, uint32_t mode) { + if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_SYS) { + /* SRS instruction is UNPREDICTABLE from System mode; we UNDEF. + * Other UNPREDICTABLE and UNDEF cases were caught at translate time. + */ + raise_exception(env, EXCP_UDEF, syn_uncategorized(), + exception_target_el(env)); + } + if ((env->uncached_cpsr & CPSR_M) == mode) { return env->regs[13]; } else { diff --git a/target-arm/translate.c b/target-arm/translate.c index 7bceb05f48..e69145d401 100644 --- a/target-arm/translate.c +++ b/target-arm/translate.c @@ -7590,10 +7590,7 @@ static void gen_srs(DisasContext *s, * -- not a valid mode number * -- a mode that's at a higher exception level * -- Monitor, if we are Non-secure - * For the UNPREDICTABLE cases we choose to UNDEF, except that for - * "current mode is System" we will write a garbage SPSR. - * (This is because we don't have access to our current mode here - * and would have to do a runtime check to UNDEF for System.) + * For the UNPREDICTABLE cases we choose to UNDEF. */ if (s->current_el == 1 && !s->ns) { gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), 3); @@ -7639,6 +7636,9 @@ static void gen_srs(DisasContext *s, addr = tcg_temp_new_i32(); tmp = tcg_const_i32(mode); + /* get_r13_banked() will raise an exception if called from System mode */ + gen_set_condexec(s); + gen_set_pc_im(s, s->pc - 4); gen_helper_get_r13_banked(addr, cpu_env, tmp); tcg_temp_free_i32(tmp); switch (amode) { @@ -7688,6 +7688,7 @@ static void gen_srs(DisasContext *s, tcg_temp_free_i32(tmp); } tcg_temp_free_i32(addr); + s->is_jmp = DISAS_UPDATE; } static void disas_arm_insn(DisasContext *s, unsigned int insn) From 4054bfa9e7986c9b7d2bf70f9e10af9647e376fc Mon Sep 17 00:00:00 2001 From: Alistair Francis Date: Thu, 18 Feb 2016 14:16:17 +0000 Subject: [PATCH 12/36] target-arm: Add the pmceid0 and pmceid1 registers Signed-off-by: Aaron Lindsay Signed-off-by: Alistair Francis Tested-by: Nathan Rossi Message-id: da0563119a9f56fd5fbdc26e7ed19a8a8457c5b9.1455060548.git.alistair.francis@xilinx.com [PMM: Use 0 for PMCEID0 values for A15 and A57 since our PMU does not currently implement any events.] Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- target-arm/cpu-qom.h | 2 ++ target-arm/cpu.c | 2 ++ target-arm/cpu64.c | 2 ++ target-arm/helper.c | 16 ++++++++++++++++ 4 files changed, 22 insertions(+) diff --git a/target-arm/cpu-qom.h b/target-arm/cpu-qom.h index 07c0a71942..1cc4502fc4 100644 --- a/target-arm/cpu-qom.h +++ b/target-arm/cpu-qom.h @@ -148,6 +148,8 @@ typedef struct ARMCPU { uint32_t id_pfr0; uint32_t id_pfr1; uint32_t id_dfr0; + uint32_t pmceid0; + uint32_t pmceid1; uint32_t id_afr0; uint32_t id_mmfr0; uint32_t id_mmfr1; diff --git a/target-arm/cpu.c b/target-arm/cpu.c index f2393cd9f2..e95b0307a6 100644 --- a/target-arm/cpu.c +++ b/target-arm/cpu.c @@ -1156,6 +1156,8 @@ static void cortex_a15_initfn(Object *obj) cpu->id_pfr0 = 0x00001131; cpu->id_pfr1 = 0x00011011; cpu->id_dfr0 = 0x02010555; + cpu->pmceid0 = 0x0000000; + cpu->pmceid1 = 0x00000000; cpu->id_afr0 = 0x00000000; cpu->id_mmfr0 = 0x10201105; cpu->id_mmfr1 = 0x20000000; diff --git a/target-arm/cpu64.c b/target-arm/cpu64.c index c5bc19a405..fa5eda2cd1 100644 --- a/target-arm/cpu64.c +++ b/target-arm/cpu64.c @@ -135,6 +135,8 @@ static void aarch64_a57_initfn(Object *obj) cpu->id_isar5 = 0x00011121; cpu->id_aa64pfr0 = 0x00002222; cpu->id_aa64dfr0 = 0x10305106; + cpu->pmceid0 = 0x00000000; + cpu->pmceid1 = 0x00000000; cpu->id_aa64isar0 = 0x00011120; cpu->id_aa64mmfr0 = 0x00001124; cpu->dbgdidr = 0x3516d000; diff --git a/target-arm/helper.c b/target-arm/helper.c index a420a2a331..6a4ec018fb 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -4380,6 +4380,22 @@ void register_cp_regs_for_features(ARMCPU *cpu) .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2, .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = cpu->mvfr2 }, + { .name = "PMCEID0", .state = ARM_CP_STATE_AA32, + .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6, + .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, + .resetvalue = cpu->pmceid0 }, + { .name = "PMCEID0_EL0", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 6, + .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, + .resetvalue = cpu->pmceid0 }, + { .name = "PMCEID1", .state = ARM_CP_STATE_AA32, + .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 7, + .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, + .resetvalue = cpu->pmceid1 }, + { .name = "PMCEID1_EL0", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 7, + .access = PL0_R, .accessfn = pmreg_access, .type = ARM_CP_CONST, + .resetvalue = cpu->pmceid1 }, REGINFO_SENTINEL }; /* RVBAR_EL1 is only implemented if EL1 is the highest EL */ From 978364f12adebb4b8d90fdeb71242cb3c1405740 Mon Sep 17 00:00:00 2001 From: Alistair Francis Date: Thu, 18 Feb 2016 14:16:17 +0000 Subject: [PATCH 13/36] target-arm: Add the pmovsclr_el0 and pmintenclr_el1 registers Signed-off-by: Aaron Lindsay Signed-off-by: Alistair Francis Tested-by: Nathan Rossi Reviewed-by: Peter Maydell Message-id: 50deeafb24958a5b6d7f594b5dda399a022c0e5b.1455060548.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell --- target-arm/helper.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/target-arm/helper.c b/target-arm/helper.c index 6a4ec018fb..9e47f3d8cb 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -1057,6 +1057,13 @@ static const ARMCPRegInfo v7_cp_reginfo[] = { .accessfn = pmreg_access, .writefn = pmovsr_write, .raw_writefn = raw_write }, + { .name = "PMOVSCLR_EL0", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 3, + .access = PL0_RW, .accessfn = pmreg_access, + .type = ARM_CP_ALIAS, + .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr), + .writefn = pmovsr_write, + .raw_writefn = raw_write }, /* Unimplemented so WI. */ { .name = "PMSWINC", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 4, .access = PL0_W, .accessfn = pmreg_access, .type = ARM_CP_NOP }, @@ -1107,6 +1114,11 @@ static const ARMCPRegInfo v7_cp_reginfo[] = { .access = PL1_RW, .type = ARM_CP_ALIAS, .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), .writefn = pmintenclr_write, }, + { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2, + .access = PL1_RW, .type = ARM_CP_ALIAS, + .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), + .writefn = pmintenclr_write }, { .name = "VBAR", .state = ARM_CP_STATE_BOTH, .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0, .access = PL1_RW, .writefn = vbar_write, From 8a83ffc2dafad3499b87a736b17ab1b203fdb00b Mon Sep 17 00:00:00 2001 From: Alistair Francis Date: Thu, 18 Feb 2016 14:16:17 +0000 Subject: [PATCH 14/36] target-arm: Add PMUSERENR_EL0 register The Linux kernel accesses this register early in its setup. Signed-off-by: Christopher Covington Signed-off-by: Alistair Francis Reviewed-by: Peter Maydell Message-id: b30d536cb16ec57b4412172bb6dbc3f00d293e7d.1455060548.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell --- target-arm/helper.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/target-arm/helper.c b/target-arm/helper.c index 9e47f3d8cb..5a0447b93a 100644 --- a/target-arm/helper.c +++ b/target-arm/helper.c @@ -1105,6 +1105,12 @@ static const ARMCPRegInfo v7_cp_reginfo[] = { .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), .resetvalue = 0, .writefn = pmuserenr_write, .raw_writefn = raw_write }, + { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64, + .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 14, .opc2 = 0, + .access = PL0_R | PL1_RW, .type = ARM_CP_ALIAS, + .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr), + .resetvalue = 0, + .writefn = pmuserenr_write, .raw_writefn = raw_write }, { .name = "PMINTENSET", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 1, .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten), From b527db44ad32c9520698ff5121a614e968326900 Mon Sep 17 00:00:00 2001 From: Wei Huang Date: Thu, 18 Feb 2016 14:16:17 +0000 Subject: [PATCH 15/36] ARM: PL061: Clear PL061 device state after reset Current QEMU doesn't clear PL061 state after reset. This causes a weird issue with guest reboot via GPIO. Here is the device state with two reboot requests: (PL061State fields) data old_in_data istate VM boot 0 0 0 After 1st ACPI reboot request 8 8 8 After VM PL061 driver ACK 8 8 0 After VM reboot 8 8 0 ------------------------------------------------------------ 2nd ACPI reboot request 8 In the second reboot request above, because the old_in_data field is 8, QEMU decides that there is a pending edge IRQ already (see pl061_update()) in input; so it doesn't raise up IRQ again. As a result the second reboot request is lost. The correct way is to clear PL061 device state after reset. The default reset state is found from the documents listed below. Per Peter's suggestion that QEMU automatically calls reset function after device initialization, this patch removes calling pl061_reset() from pl061_initfn(). Reference: [1] PL061 Technical Reference Manual [2] Stellaris LM3S8962 Microcontroller Data Sheet [3] Stellaris LM3S5P31 Microcontroller Data Sheet Signed-off-by: Wei Huang Message-id: 1455729552-28026-2-git-send-email-wei@redhat.com Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell --- hw/gpio/pl061.c | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c index e5a696ef43..f9773b8a43 100644 --- a/hw/gpio/pl061.c +++ b/hw/gpio/pl061.c @@ -282,10 +282,32 @@ static void pl061_write(void *opaque, hwaddr offset, pl061_update(s); } -static void pl061_reset(PL061State *s) +static void pl061_reset(DeviceState *dev) { - s->locked = 1; - s->cr = 0xff; + PL061State *s = PL061(dev); + + /* reset values from PL061 TRM, Stellaris LM3S5P31 & LM3S8962 Data Sheet */ + s->data = 0; + s->old_out_data = 0; + s->old_in_data = 0; + s->dir = 0; + s->isense = 0; + s->ibe = 0; + s->iev = 0; + s->im = 0; + s->istate = 0; + s->afsel = 0; + s->dr2r = 0xff; + s->dr4r = 0; + s->dr8r = 0; + s->odr = 0; + s->pur = 0; + s->pdr = 0; + s->slr = 0; + s->den = 0; + s->locked = 1; + s->cr = 0xff; + s->amsel = 0; } static void pl061_set_irq(void * opaque, int irq, int level) @@ -318,7 +340,7 @@ static int pl061_initfn(SysBusDevice *sbd) sysbus_init_irq(sbd, &s->irq); qdev_init_gpio_in(dev, pl061_set_irq, 8); qdev_init_gpio_out(dev, s->out, 8); - pl061_reset(s); + return 0; } @@ -343,6 +365,7 @@ static void pl061_class_init(ObjectClass *klass, void *data) k->init = pl061_initfn; dc->vmsd = &vmstate_pl061; + dc->reset = &pl061_reset; } static const TypeInfo pl061_info = { From c3a86b35f2bae29278b2ebb3018c51ba69697db7 Mon Sep 17 00:00:00 2001 From: Wei Huang Date: Thu, 18 Feb 2016 14:16:17 +0000 Subject: [PATCH 16/36] ARM: PL061: Cleaning field of PL061 device state This patch removes the float_high field of PL061State, which doesn't seem to be used anywhere. Because this changes the device state, the version ID is also bumped up for the reason of compatiblity. Signed-off-by: Wei Huang Reviewed-by: Peter Maydell Message-id: 1455729552-28026-3-git-send-email-wei@redhat.com Signed-off-by: Peter Maydell --- hw/gpio/pl061.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c index f9773b8a43..5ece8b068e 100644 --- a/hw/gpio/pl061.c +++ b/hw/gpio/pl061.c @@ -56,7 +56,6 @@ typedef struct PL061State { uint32_t slr; uint32_t den; uint32_t cr; - uint32_t float_high; uint32_t amsel; qemu_irq irq; qemu_irq out[8]; @@ -65,8 +64,8 @@ typedef struct PL061State { static const VMStateDescription vmstate_pl061 = { .name = "pl061", - .version_id = 3, - .minimum_version_id = 3, + .version_id = 4, + .minimum_version_id = 4, .fields = (VMStateField[]) { VMSTATE_UINT32(locked, PL061State), VMSTATE_UINT32(data, PL061State), @@ -88,7 +87,6 @@ static const VMStateDescription vmstate_pl061 = { VMSTATE_UINT32(slr, PL061State), VMSTATE_UINT32(den, PL061State), VMSTATE_UINT32(cr, PL061State), - VMSTATE_UINT32(float_high, PL061State), VMSTATE_UINT32_V(amsel, PL061State, 2), VMSTATE_END_OF_LIST() } From ac6de31acded883e04438d25b6ac7189d83a3444 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:18 +0000 Subject: [PATCH 17/36] hw/sd/sdhci.c: Remove x-drive property The following commits will remove support for the old sdhci-pci command line syntax using the x-drive property: -device sdhci-pci,x-drive=mydrive -drive id=mydrive,[...] and replace it with an explicit sd device: -device sdhci-pci -drive id=mydrive,[...] -device sd,drive=mydrive (This is OK because x-drive is experimental.) This commit removes the x-drive property so that old style command lines will fail with a reasonable error message: -device sdhci-pci,x-drive=mydrive: Property '.x-drive' not found Signed-off-by: Peter Maydell Reviewed-by: Alistair Francis Reviewed-by: Peter Crosthwaite Message-id: 1455646193-13238-2-git-send-email-peter.maydell@linaro.org --- hw/sd/sdhci.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 30e3bf4f3c..3d1eb85458 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -1220,12 +1220,6 @@ const VMStateDescription sdhci_vmstate = { /* Capabilities registers provide information on supported features of this * specific host controller implementation */ static Property sdhci_pci_properties[] = { - /* - * We currently fuse controller and card into a single device - * model, but we intend to separate them. For that purpose, the - * properties that belong to the card are marked as experimental. - */ - DEFINE_PROP_DRIVE("x-drive", SDHCIState, blk), DEFINE_PROP_UINT32("capareg", SDHCIState, capareg, SDHC_CAPAB_REG_DEFAULT), DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0), From 260bc9d8aa887bdd72d1b2499a9080f75b289cb4 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:18 +0000 Subject: [PATCH 18/36] hw/sd/sd.c: QOMify Turn the SD card into a QOM device. This conversion only changes the device itself; the various functions which are effectively methods on the device are not touched at this point. Signed-off-by: Peter Maydell Reviewed-by: Peter Crosthwaite Reviewed-by: Alistair Francis Message-id: 1455646193-13238-3-git-send-email-peter.maydell@linaro.org --- hw/sd/sd.c | 99 +++++++++++++++++++++++++++++++++++----------- include/hw/sd/sd.h | 3 ++ 2 files changed, 80 insertions(+), 22 deletions(-) diff --git a/hw/sd/sd.c b/hw/sd/sd.c index dd614b0890..16817280e5 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -34,6 +34,8 @@ #include "sysemu/block-backend.h" #include "hw/sd/sd.h" #include "qemu/bitmap.h" +#include "hw/qdev-properties.h" +#include "qemu/error-report.h" //#define DEBUG_SD 1 @@ -78,6 +80,8 @@ enum SDCardStates { }; struct SDState { + DeviceState parent_obj; + uint32_t mode; /* current card mode, one of SDCardModes */ int32_t state; /* current card state, one of SDCardStates */ uint32_t ocr; @@ -473,34 +477,26 @@ static const VMStateDescription sd_vmstate = { } }; -/* We do not model the chip select pin, so allow the board to select - whether card should be in SSI or MMC/SD mode. It is also up to the - board to ensure that ssi transfers only occur when the chip select - is asserted. */ +/* Legacy initialization function for use by non-qdevified callers */ SDState *sd_init(BlockBackend *blk, bool is_spi) { - SDState *sd; + DeviceState *dev; + Error *err = NULL; - if (blk && blk_is_read_only(blk)) { - fprintf(stderr, "sd_init: Cannot use read-only drive\n"); + dev = qdev_create(NULL, TYPE_SD_CARD); + qdev_prop_set_drive(dev, "drive", blk, &err); + if (err) { + error_report("sd_init failed: %s", error_get_pretty(err)); + return NULL; + } + qdev_prop_set_bit(dev, "spi", is_spi); + object_property_set_bool(OBJECT(dev), true, "realized", &err); + if (err) { + error_report("sd_init failed: %s", error_get_pretty(err)); return NULL; } - sd = (SDState *) g_malloc0(sizeof(SDState)); - sd->buf = blk_blockalign(blk, 512); - sd->spi = is_spi; - sd->enable = true; - sd->blk = blk; - sd_reset(sd); - if (sd->blk) { - /* Attach dev if not already attached. (This call ignores an - * error return code if sd->blk is already attached.) */ - /* FIXME ignoring blk_attach_dev() failure is dangerously brittle */ - blk_attach_dev(sd->blk, sd); - blk_set_dev_ops(sd->blk, &sd_block_ops, sd); - } - vmstate_register(NULL, -1, &sd_vmstate, sd); - return sd; + return SD_CARD(dev); } void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert) @@ -1769,3 +1765,62 @@ void sd_enable(SDState *sd, bool enable) { sd->enable = enable; } + +static void sd_instance_init(Object *obj) +{ + SDState *sd = SD_CARD(obj); + + sd->enable = true; +} + +static void sd_realize(DeviceState *dev, Error **errp) +{ + SDState *sd = SD_CARD(dev); + + if (sd->blk && blk_is_read_only(sd->blk)) { + error_setg(errp, "Cannot use read-only drive as SD card"); + return; + } + + sd->buf = blk_blockalign(sd->blk, 512); + + if (sd->blk) { + blk_set_dev_ops(sd->blk, &sd_block_ops, sd); + } + + sd_reset(sd); +} + +static Property sd_properties[] = { + DEFINE_PROP_DRIVE("drive", SDState, blk), + /* We do not model the chip select pin, so allow the board to select + * whether card should be in SSI or MMC/SD mode. It is also up to the + * board to ensure that ssi transfers only occur when the chip select + * is asserted. */ + DEFINE_PROP_BOOL("spi", SDState, spi, false), + DEFINE_PROP_END_OF_LIST() +}; + +static void sd_class_init(ObjectClass *klass, void *data) +{ + DeviceClass *dc = DEVICE_CLASS(klass); + + dc->realize = sd_realize; + dc->props = sd_properties; + dc->vmsd = &sd_vmstate; +} + +static const TypeInfo sd_info = { + .name = TYPE_SD_CARD, + .parent = TYPE_DEVICE, + .instance_size = sizeof(SDState), + .class_init = sd_class_init, + .instance_init = sd_instance_init, +}; + +static void sd_register_types(void) +{ + type_register_static(&sd_info); +} + +type_init(sd_register_types) diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h index 79adb5bb48..404d5896db 100644 --- a/include/hw/sd/sd.h +++ b/include/hw/sd/sd.h @@ -68,6 +68,9 @@ typedef struct { typedef struct SDState SDState; +#define TYPE_SD_CARD "sd-card" +#define SD_CARD(obj) OBJECT_CHECK(SDState, (obj), TYPE_SD_CARD) + SDState *sd_init(BlockBackend *bs, bool is_spi); int sd_do_command(SDState *sd, SDRequest *req, uint8_t *response); From ba3ed0fa94ee9473ef8f454512b6ca3e10fcb885 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:18 +0000 Subject: [PATCH 19/36] hw/sd/sd.c: Convert sd_reset() function into Device reset method Convert the sd_reset() function into a proper Device reset method. Signed-off-by: Peter Maydell Reviewed-by: Alistair Francis Reviewed-by: Peter Crosthwaite Message-id: 1455646193-13238-4-git-send-email-peter.maydell@linaro.org --- hw/sd/sd.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/hw/sd/sd.c b/hw/sd/sd.c index 16817280e5..edd4c82f6f 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -394,8 +394,9 @@ static inline uint64_t sd_addr_to_wpnum(uint64_t addr) return addr >> (HWBLOCK_SHIFT + SECTOR_SHIFT + WPGROUP_SHIFT); } -static void sd_reset(SDState *sd) +static void sd_reset(DeviceState *dev) { + SDState *sd = SD_CARD(dev); uint64_t size; uint64_t sect; @@ -436,7 +437,7 @@ static void sd_cardchange(void *opaque, bool load) qemu_set_irq(sd->inserted_cb, blk_is_inserted(sd->blk)); if (blk_is_inserted(sd->blk)) { - sd_reset(sd); + sd_reset(DEVICE(sd)); qemu_set_irq(sd->readonly_cb, sd->wp_switch); } } @@ -680,7 +681,7 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, default: sd->state = sd_idle_state; - sd_reset(sd); + sd_reset(DEVICE(sd)); return sd->spi ? sd_r1 : sd_r0; } break; @@ -1787,8 +1788,6 @@ static void sd_realize(DeviceState *dev, Error **errp) if (sd->blk) { blk_set_dev_ops(sd->blk, &sd_block_ops, sd); } - - sd_reset(sd); } static Property sd_properties[] = { @@ -1808,6 +1807,7 @@ static void sd_class_init(ObjectClass *klass, void *data) dc->realize = sd_realize; dc->props = sd_properties; dc->vmsd = &sd_vmstate; + dc->reset = sd_reset; } static const TypeInfo sd_info = { From c759a790b672b0c5bfc50520dcc93565b55732b3 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:18 +0000 Subject: [PATCH 20/36] hw/sd: Add QOM bus which SD cards plug in to Add a QOM bus for SD cards to plug in to. Note that since sd_enable() is used only by one board and there only as part of a broken implementation, we do not provide it in the SDBus API (but instead add a warning comment about the old function). Whoever converts OMAP and the nseries boards to QOM will need to either implement the card switch properly or move the enable hack into the OMAP MMC controller model. In the SDBus API, the old-style use of sd_set_cb to register some qemu_irqs for notification of card insertion and write-protect toggling is replaced with methods in the SDBusClass which the card calls on status changes and methods in the SDClass which the controller can call to find out the current status. The query methods will allow us to remove the abuse of the 'register irqs' API by controllers in their reset methods to trigger the card to tell them about the current status again. Signed-off-by: Peter Maydell Reviewed-by: Alistair Francis Message-id: 1455646193-13238-5-git-send-email-peter.maydell@linaro.org --- hw/sd/Makefile.objs | 2 +- hw/sd/core.c | 146 ++++++++++++++++++++++++++++++++++++++++++++ hw/sd/sd.c | 47 ++++++++++++-- include/hw/sd/sd.h | 62 +++++++++++++++++++ 4 files changed, 252 insertions(+), 5 deletions(-) create mode 100644 hw/sd/core.c diff --git a/hw/sd/Makefile.objs b/hw/sd/Makefile.objs index f1aed83d9d..31c83308f2 100644 --- a/hw/sd/Makefile.objs +++ b/hw/sd/Makefile.objs @@ -1,6 +1,6 @@ common-obj-$(CONFIG_PL181) += pl181.o common-obj-$(CONFIG_SSI_SD) += ssi-sd.o -common-obj-$(CONFIG_SD) += sd.o +common-obj-$(CONFIG_SD) += sd.o core.o common-obj-$(CONFIG_SDHCI) += sdhci.o obj-$(CONFIG_MILKYMIST) += milkymist-memcard.o diff --git a/hw/sd/core.c b/hw/sd/core.c new file mode 100644 index 0000000000..14c2bdf27b --- /dev/null +++ b/hw/sd/core.c @@ -0,0 +1,146 @@ +/* + * SD card bus interface code. + * + * Copyright (c) 2015 Linaro Limited + * + * Author: + * Peter Maydell + * + * This program is free software; you can redistribute it and/or modify it + * under the terms and conditions of the GNU General Public License, + * version 2 or later, as published by the Free Software Foundation. + * + * This program is distributed in the hope it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * + * You should have received a copy of the GNU General Public License along with + * this program. If not, see . + */ + +#include "qemu/osdep.h" +#include "hw/qdev-core.h" +#include "sysemu/block-backend.h" +#include "hw/sd/sd.h" + +static SDState *get_card(SDBus *sdbus) +{ + /* We only ever have one child on the bus so just return it */ + BusChild *kid = QTAILQ_FIRST(&sdbus->qbus.children); + + if (!kid) { + return NULL; + } + return SD_CARD(kid->child); +} + +int sdbus_do_command(SDBus *sdbus, SDRequest *req, uint8_t *response) +{ + SDState *card = get_card(sdbus); + + if (card) { + SDCardClass *sc = SD_CARD_GET_CLASS(card); + + return sc->do_command(card, req, response); + } + + return 0; +} + +void sdbus_write_data(SDBus *sdbus, uint8_t value) +{ + SDState *card = get_card(sdbus); + + if (card) { + SDCardClass *sc = SD_CARD_GET_CLASS(card); + + sc->write_data(card, value); + } +} + +uint8_t sdbus_read_data(SDBus *sdbus) +{ + SDState *card = get_card(sdbus); + + if (card) { + SDCardClass *sc = SD_CARD_GET_CLASS(card); + + return sc->read_data(card); + } + + return 0; +} + +bool sdbus_data_ready(SDBus *sdbus) +{ + SDState *card = get_card(sdbus); + + if (card) { + SDCardClass *sc = SD_CARD_GET_CLASS(card); + + return sc->data_ready(card); + } + + return false; +} + +bool sdbus_get_inserted(SDBus *sdbus) +{ + SDState *card = get_card(sdbus); + + if (card) { + SDCardClass *sc = SD_CARD_GET_CLASS(card); + + return sc->get_inserted(card); + } + + return false; +} + +bool sdbus_get_readonly(SDBus *sdbus) +{ + SDState *card = get_card(sdbus); + + if (card) { + SDCardClass *sc = SD_CARD_GET_CLASS(card); + + return sc->get_readonly(card); + } + + return false; +} + +void sdbus_set_inserted(SDBus *sdbus, bool inserted) +{ + SDBusClass *sbc = SD_BUS_GET_CLASS(sdbus); + BusState *qbus = BUS(sdbus); + + if (sbc->set_inserted) { + sbc->set_inserted(qbus->parent, inserted); + } +} + +void sdbus_set_readonly(SDBus *sdbus, bool readonly) +{ + SDBusClass *sbc = SD_BUS_GET_CLASS(sdbus); + BusState *qbus = BUS(sdbus); + + if (sbc->set_readonly) { + sbc->set_readonly(qbus->parent, readonly); + } +} + +static const TypeInfo sd_bus_info = { + .name = TYPE_SD_BUS, + .parent = TYPE_BUS, + .instance_size = sizeof(SDBus), + .class_size = sizeof(SDBusClass), +}; + +static void sd_bus_register_types(void) +{ + type_register_static(&sd_bus_info); +} + +type_init(sd_bus_register_types) diff --git a/hw/sd/sd.c b/hw/sd/sd.c index edd4c82f6f..8902cd818d 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -30,6 +30,7 @@ */ #include "qemu/osdep.h" +#include "hw/qdev.h" #include "hw/hw.h" #include "sysemu/block-backend.h" #include "hw/sd/sd.h" @@ -431,14 +432,41 @@ static void sd_reset(DeviceState *dev) sd->expecting_acmd = false; } +static bool sd_get_inserted(SDState *sd) +{ + return blk_is_inserted(sd->blk); +} + +static bool sd_get_readonly(SDState *sd) +{ + return sd->wp_switch; +} + static void sd_cardchange(void *opaque, bool load) { SDState *sd = opaque; + DeviceState *dev = DEVICE(sd); + SDBus *sdbus = SD_BUS(qdev_get_parent_bus(dev)); + bool inserted = sd_get_inserted(sd); + bool readonly = sd_get_readonly(sd); - qemu_set_irq(sd->inserted_cb, blk_is_inserted(sd->blk)); - if (blk_is_inserted(sd->blk)) { - sd_reset(DEVICE(sd)); - qemu_set_irq(sd->readonly_cb, sd->wp_switch); + if (inserted) { + sd_reset(dev); + } + + /* The IRQ notification is for legacy non-QOM SD controller devices; + * QOMified controllers use the SDBus APIs. + */ + if (sdbus) { + sdbus_set_inserted(sdbus, inserted); + if (inserted) { + sdbus_set_readonly(sdbus, readonly); + } + } else { + qemu_set_irq(sd->inserted_cb, inserted); + if (inserted) { + qemu_set_irq(sd->readonly_cb, readonly); + } } } @@ -1803,17 +1831,28 @@ static Property sd_properties[] = { static void sd_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); + SDCardClass *sc = SD_CARD_CLASS(klass); dc->realize = sd_realize; dc->props = sd_properties; dc->vmsd = &sd_vmstate; dc->reset = sd_reset; + dc->bus_type = TYPE_SD_BUS; + + sc->do_command = sd_do_command; + sc->write_data = sd_write_data; + sc->read_data = sd_read_data; + sc->data_ready = sd_data_ready; + sc->enable = sd_enable; + sc->get_inserted = sd_get_inserted; + sc->get_readonly = sd_get_readonly; } static const TypeInfo sd_info = { .name = TYPE_SD_CARD, .parent = TYPE_DEVICE, .instance_size = sizeof(SDState), + .class_size = sizeof(SDCardClass), .class_init = sd_class_init, .instance_init = sd_instance_init, }; diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h index 404d5896db..d5d273a449 100644 --- a/include/hw/sd/sd.h +++ b/include/hw/sd/sd.h @@ -67,10 +67,51 @@ typedef struct { } SDRequest; typedef struct SDState SDState; +typedef struct SDBus SDBus; #define TYPE_SD_CARD "sd-card" #define SD_CARD(obj) OBJECT_CHECK(SDState, (obj), TYPE_SD_CARD) +#define SD_CARD_CLASS(klass) \ + OBJECT_CLASS_CHECK(SDCardClass, (klass), TYPE_SD_CARD) +#define SD_CARD_GET_CLASS(obj) \ + OBJECT_GET_CLASS(SDCardClass, (obj), TYPE_SD_CARD) +typedef struct { + /*< private >*/ + DeviceClass parent_class; + /*< public >*/ + + int (*do_command)(SDState *sd, SDRequest *req, uint8_t *response); + void (*write_data)(SDState *sd, uint8_t value); + uint8_t (*read_data)(SDState *sd); + bool (*data_ready)(SDState *sd); + void (*enable)(SDState *sd, bool enable); + bool (*get_inserted)(SDState *sd); + bool (*get_readonly)(SDState *sd); +} SDCardClass; + +#define TYPE_SD_BUS "sd-bus" +#define SD_BUS(obj) OBJECT_CHECK(SDBus, (obj), TYPE_SD_BUS) +#define SD_BUS_CLASS(klass) OBJECT_CLASS_CHECK(SDBusClass, (klass), TYPE_SD_BUS) +#define SD_BUS_GET_CLASS(obj) OBJECT_GET_CLASS(SDBusClass, (obj), TYPE_SD_BUS) + +struct SDBus { + BusState qbus; +}; + +typedef struct { + /*< private >*/ + BusClass parent_class; + /*< public >*/ + + /* These methods are called by the SD device to notify the controller + * when the card insertion or readonly status changes + */ + void (*set_inserted)(DeviceState *dev, bool inserted); + void (*set_readonly)(DeviceState *dev, bool readonly); +} SDBusClass; + +/* Legacy functions to be used only by non-qdevified callers */ SDState *sd_init(BlockBackend *bs, bool is_spi); int sd_do_command(SDState *sd, SDRequest *req, uint8_t *response); @@ -78,6 +119,27 @@ void sd_write_data(SDState *sd, uint8_t value); uint8_t sd_read_data(SDState *sd); void sd_set_cb(SDState *sd, qemu_irq readonly, qemu_irq insert); bool sd_data_ready(SDState *sd); +/* sd_enable should not be used -- it is only used on the nseries boards, + * where it is part of a broken implementation of the MMC card slot switch + * (there should be two card slots which are multiplexed to a single MMC + * controller, but instead we model it with one card and controller and + * disable the card when the second slot is selected, so it looks like the + * second slot is always empty). + */ void sd_enable(SDState *sd, bool enable); +/* Functions to be used by qdevified callers (working via + * an SDBus rather than directly with SDState) + */ +int sdbus_do_command(SDBus *sd, SDRequest *req, uint8_t *response); +void sdbus_write_data(SDBus *sd, uint8_t value); +uint8_t sdbus_read_data(SDBus *sd); +bool sdbus_data_ready(SDBus *sd); +bool sdbus_get_inserted(SDBus *sd); +bool sdbus_get_readonly(SDBus *sd); + +/* Functions to be used by SD devices to report back to qdevified controllers */ +void sdbus_set_inserted(SDBus *sd, bool inserted); +void sdbus_set_readonly(SDBus *sd, bool inserted); + #endif /* __hw_sd_h */ From 40bbc194376758e8deabcb6f5bfd38bf73355a40 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:18 +0000 Subject: [PATCH 21/36] hw/sd/sdhci.c: Update to use SDBus APIs Update the SDHCI code to use the new SDBus APIs. This commit introduces the new command line options required to connect a disk to sdhci-pci: -device sdhci-pci -drive id=mydrive,[...] -device sd,drive=mydrive Signed-off-by: Peter Maydell Reviewed-by: Alistair Francis Message-id: 1455646193-13238-6-git-send-email-peter.maydell@linaro.org --- hw/sd/sdhci.c | 97 ++++++++++++++++++++++++++++++------------- include/hw/sd/sdhci.h | 3 +- 2 files changed, 69 insertions(+), 31 deletions(-) diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 3d1eb85458..396dd10932 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -55,6 +55,9 @@ } \ } while (0) +#define TYPE_SDHCI_BUS "sdhci-bus" +#define SDHCI_BUS(obj) OBJECT_CHECK(SDBus, (obj), TYPE_SDHCI_BUS) + /* Default SD/MMC host controller features information, which will be * presented in CAPABILITIES register of generic SD host controller at reset. * If not stated otherwise: @@ -145,9 +148,9 @@ static void sdhci_raise_insertion_irq(void *opaque) } } -static void sdhci_insert_eject_cb(void *opaque, int irq, int level) +static void sdhci_set_inserted(DeviceState *dev, bool level) { - SDHCIState *s = (SDHCIState *)opaque; + SDHCIState *s = (SDHCIState *)dev; DPRINT_L1("Card state changed: %s!\n", level ? "insert" : "eject"); if ((s->norintsts & SDHC_NIS_REMOVE) && level) { @@ -172,9 +175,9 @@ static void sdhci_insert_eject_cb(void *opaque, int irq, int level) } } -static void sdhci_card_readonly_cb(void *opaque, int irq, int level) +static void sdhci_set_readonly(DeviceState *dev, bool level) { - SDHCIState *s = (SDHCIState *)opaque; + SDHCIState *s = (SDHCIState *)dev; if (level) { s->prnsts &= ~SDHC_WRITE_PROTECT; @@ -186,6 +189,8 @@ static void sdhci_card_readonly_cb(void *opaque, int irq, int level) static void sdhci_reset(SDHCIState *s) { + DeviceState *dev = DEVICE(s); + timer_del(s->insert_timer); timer_del(s->transfer_timer); /* Set all registers to 0. Capabilities registers are not cleared @@ -194,8 +199,11 @@ static void sdhci_reset(SDHCIState *s) memset(&s->sdmasysad, 0, (uintptr_t)&s->capareg - (uintptr_t)&s->sdmasysad); if (!s->noeject_quirk) { - sd_set_cb(s->card, s->ro_cb, s->eject_cb); + /* Reset other state based on current card insertion/readonly status */ + sdhci_set_inserted(dev, sdbus_get_inserted(&s->sdbus)); + sdhci_set_readonly(dev, sdbus_get_readonly(&s->sdbus)); } + s->data_count = 0; s->stopped_state = sdhc_not_stopped; } @@ -213,7 +221,7 @@ static void sdhci_send_command(SDHCIState *s) request.cmd = s->cmdreg >> 8; request.arg = s->argument; DPRINT_L1("sending CMD%u ARG[0x%08x]\n", request.cmd, request.arg); - rlen = sd_do_command(s->card, &request, response); + rlen = sdbus_do_command(&s->sdbus, &request, response); if (s->cmdreg & SDHC_CMD_RESPONSE) { if (rlen == 4) { @@ -269,7 +277,7 @@ static void sdhci_end_transfer(SDHCIState *s) request.cmd = 0x0C; request.arg = 0; DPRINT_L1("Automatically issue CMD%d %08x\n", request.cmd, request.arg); - sd_do_command(s->card, &request, response); + sdbus_do_command(&s->sdbus, &request, response); /* Auto CMD12 response goes to the upper Response register */ s->rspreg[3] = (response[0] << 24) | (response[1] << 16) | (response[2] << 8) | response[3]; @@ -301,7 +309,7 @@ static void sdhci_read_block_from_card(SDHCIState *s) } for (index = 0; index < (s->blksize & 0x0fff); index++) { - s->fifo_buffer[index] = sd_read_data(s->card); + s->fifo_buffer[index] = sdbus_read_data(&s->sdbus); } /* New data now available for READ through Buffer Port Register */ @@ -394,7 +402,7 @@ static void sdhci_write_block_to_card(SDHCIState *s) } for (index = 0; index < (s->blksize & 0x0fff); index++) { - sd_write_data(s->card, s->fifo_buffer[index]); + sdbus_write_data(&s->sdbus, s->fifo_buffer[index]); } /* Next data can be written through BUFFER DATORT register */ @@ -476,7 +484,7 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) while (s->blkcnt) { if (s->data_count == 0) { for (n = 0; n < block_size; n++) { - s->fifo_buffer[n] = sd_read_data(s->card); + s->fifo_buffer[n] = sdbus_read_data(&s->sdbus); } } begin = s->data_count; @@ -517,7 +525,7 @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s) s->sdmasysad += s->data_count - begin; if (s->data_count == block_size) { for (n = 0; n < block_size; n++) { - sd_write_data(s->card, s->fifo_buffer[n]); + sdbus_write_data(&s->sdbus, s->fifo_buffer[n]); } s->data_count = 0; if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) { @@ -549,7 +557,7 @@ static void sdhci_sdma_transfer_single_block(SDHCIState *s) if (s->trnmod & SDHC_TRNS_READ) { for (n = 0; n < datacnt; n++) { - s->fifo_buffer[n] = sd_read_data(s->card); + s->fifo_buffer[n] = sdbus_read_data(&s->sdbus); } dma_memory_write(&address_space_memory, s->sdmasysad, s->fifo_buffer, datacnt); @@ -557,7 +565,7 @@ static void sdhci_sdma_transfer_single_block(SDHCIState *s) dma_memory_read(&address_space_memory, s->sdmasysad, s->fifo_buffer, datacnt); for (n = 0; n < datacnt; n++) { - sd_write_data(s->card, s->fifo_buffer[n]); + sdbus_write_data(&s->sdbus, s->fifo_buffer[n]); } } @@ -661,7 +669,7 @@ static void sdhci_do_adma(SDHCIState *s) while (length) { if (s->data_count == 0) { for (n = 0; n < block_size; n++) { - s->fifo_buffer[n] = sd_read_data(s->card); + s->fifo_buffer[n] = sdbus_read_data(&s->sdbus); } } begin = s->data_count; @@ -702,7 +710,7 @@ static void sdhci_do_adma(SDHCIState *s) dscr.addr += s->data_count - begin; if (s->data_count == block_size) { for (n = 0; n < block_size; n++) { - sd_write_data(s->card, s->fifo_buffer[n]); + sdbus_write_data(&s->sdbus, s->fifo_buffer[n]); } s->data_count = 0; if (s->trnmod & SDHC_TRNS_BLK_CNT_EN) { @@ -816,7 +824,7 @@ static void sdhci_data_transfer(void *opaque) break; } } else { - if ((s->trnmod & SDHC_TRNS_READ) && sd_data_ready(s->card)) { + if ((s->trnmod & SDHC_TRNS_READ) && sdbus_data_ready(&s->sdbus)) { s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE; sdhci_read_block_from_card(s); @@ -1153,15 +1161,10 @@ static inline unsigned int sdhci_get_fifolen(SDHCIState *s) } } -static void sdhci_initfn(SDHCIState *s, BlockBackend *blk) +static void sdhci_initfn(SDHCIState *s) { - s->card = sd_init(blk, false); - if (s->card == NULL) { - exit(1); - } - s->eject_cb = qemu_allocate_irq(sdhci_insert_eject_cb, s, 0); - s->ro_cb = qemu_allocate_irq(sdhci_card_readonly_cb, s, 0); - sd_set_cb(s->card, s->ro_cb, s->eject_cb); + qbus_create_inplace(&s->sdbus, sizeof(s->sdbus), + TYPE_SDHCI_BUS, DEVICE(s), "sd-bus"); s->insert_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sdhci_raise_insertion_irq, s); s->transfer_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sdhci_data_transfer, s); @@ -1231,7 +1234,7 @@ static void sdhci_pci_realize(PCIDevice *dev, Error **errp) SDHCIState *s = PCI_SDHCI(dev); dev->config[PCI_CLASS_PROG] = 0x01; /* Standard Host supported DMA */ dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */ - sdhci_initfn(s, s->blk); + sdhci_initfn(s); s->buf_maxsz = sdhci_get_fifolen(s); s->fifo_buffer = g_malloc0(s->buf_maxsz); s->irq = pci_allocate_irq(dev); @@ -1279,11 +1282,8 @@ static Property sdhci_sysbus_properties[] = { static void sdhci_sysbus_init(Object *obj) { SDHCIState *s = SYSBUS_SDHCI(obj); - DriveInfo *di; - /* FIXME use a qdev drive property instead of drive_get_next() */ - di = drive_get_next(IF_SD); - sdhci_initfn(s, di ? blk_by_legacy_dinfo(di) : NULL); + sdhci_initfn(s); } static void sdhci_sysbus_finalize(Object *obj) @@ -1296,6 +1296,29 @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp) { SDHCIState *s = SYSBUS_SDHCI(dev); SysBusDevice *sbd = SYS_BUS_DEVICE(dev); + DriveInfo *di; + BlockBackend *blk; + DeviceState *carddev; + Error *err = NULL; + + /* Create and plug in the sd card. + * FIXME: this should be done by the users of this device so we + * do not use drive_get_next() here. + */ + di = drive_get_next(IF_SD); + blk = di ? blk_by_legacy_dinfo(di) : NULL; + + carddev = qdev_create(qdev_get_child_bus(dev, "sd-bus"), TYPE_SD_CARD); + qdev_prop_set_drive(carddev, "drive", blk, &err); + if (err) { + error_propagate(errp, err); + return; + } + object_property_set_bool(OBJECT(carddev), true, "realized", &err); + if (err) { + error_propagate(errp, err); + return; + } s->buf_maxsz = sdhci_get_fifolen(s); s->fifo_buffer = g_malloc0(s->buf_maxsz); @@ -1325,10 +1348,26 @@ static const TypeInfo sdhci_sysbus_info = { .class_init = sdhci_sysbus_class_init, }; +static void sdhci_bus_class_init(ObjectClass *klass, void *data) +{ + SDBusClass *sbc = SD_BUS_CLASS(klass); + + sbc->set_inserted = sdhci_set_inserted; + sbc->set_readonly = sdhci_set_readonly; +} + +static const TypeInfo sdhci_bus_info = { + .name = TYPE_SDHCI_BUS, + .parent = TYPE_SD_BUS, + .instance_size = sizeof(SDBus), + .class_init = sdhci_bus_class_init, +}; + static void sdhci_register_types(void) { type_register_static(&sdhci_pci_info); type_register_static(&sdhci_sysbus_info); + type_register_static(&sdhci_bus_info); } type_init(sdhci_register_types) diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h index ffd1f80891..607a83e855 100644 --- a/include/hw/sd/sdhci.h +++ b/include/hw/sd/sdhci.h @@ -37,9 +37,8 @@ typedef struct SDHCIState { PCIDevice pcidev; SysBusDevice busdev; }; - SDState *card; + SDBus sdbus; MemoryRegion iomem; - BlockBackend *blk; QEMUTimer *insert_timer; /* timer for 'changing' sd card. */ QEMUTimer *transfer_timer; From eb4f566bbbe195b2475e8fa5d9ed29ca56a18b02 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:18 +0000 Subject: [PATCH 22/36] sdhci_sysbus: Create SD card device in users, not the device itself Move the creation of the SD card device from the sdhci_sysbus device itself into the boards that create these devices. This allows us to remove the cannot_instantiate_with_device_add notation because we no longer call drive_get_next in the device model. Signed-off-by: Peter Maydell Reviewed-by: Alistair Francis Message-id: 1455646193-13238-7-git-send-email-peter.maydell@linaro.org --- hw/arm/xilinx_zynq.c | 17 ++++++++++++++++- hw/arm/xlnx-ep108.c | 21 +++++++++++++++++++++ hw/arm/xlnx-zynqmp.c | 8 ++++++++ hw/sd/sdhci.c | 25 ------------------------- 4 files changed, 45 insertions(+), 26 deletions(-) diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c index 66e7f27ace..a35983a9ec 100644 --- a/hw/arm/xilinx_zynq.c +++ b/hw/arm/xilinx_zynq.c @@ -28,6 +28,7 @@ #include "hw/misc/zynq-xadc.h" #include "hw/ssi/ssi.h" #include "qemu/error-report.h" +#include "hw/sd/sd.h" #define NUM_SPI_FLASHES 4 #define NUM_QSPI_FLASHES 2 @@ -154,8 +155,10 @@ static void zynq_init(MachineState *machine) MemoryRegion *address_space_mem = get_system_memory(); MemoryRegion *ext_ram = g_new(MemoryRegion, 1); MemoryRegion *ocm_ram = g_new(MemoryRegion, 1); - DeviceState *dev; + DeviceState *dev, *carddev; SysBusDevice *busdev; + DriveInfo *di; + BlockBackend *blk; qemu_irq pic[64]; int n; @@ -245,11 +248,23 @@ static void zynq_init(MachineState *machine) sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0xE0100000); sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[56-IRQ_OFFSET]); + di = drive_get_next(IF_SD); + blk = di ? blk_by_legacy_dinfo(di) : NULL; + carddev = qdev_create(qdev_get_child_bus(dev, "sd-bus"), TYPE_SD_CARD); + qdev_prop_set_drive(carddev, "drive", blk, &error_fatal); + object_property_set_bool(OBJECT(carddev), true, "realized", &error_fatal); + dev = qdev_create(NULL, "generic-sdhci"); qdev_init_nofail(dev); sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0xE0101000); sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[79-IRQ_OFFSET]); + di = drive_get_next(IF_SD); + blk = di ? blk_by_legacy_dinfo(di) : NULL; + carddev = qdev_create(qdev_get_child_bus(dev, "sd-bus"), TYPE_SD_CARD); + qdev_prop_set_drive(carddev, "drive", blk, &error_fatal); + object_property_set_bool(OBJECT(carddev), true, "realized", &error_fatal); + dev = qdev_create(NULL, TYPE_ZYNQ_XADC); qdev_init_nofail(dev); sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0xF8007100); diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-ep108.c index 0de132abd2..a1bd283a52 100644 --- a/hw/arm/xlnx-ep108.c +++ b/hw/arm/xlnx-ep108.c @@ -59,6 +59,27 @@ static void xlnx_ep108_init(MachineState *machine) object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal); + /* Create and plug in the SD cards */ + for (i = 0; i < XLNX_ZYNQMP_NUM_SDHCI; i++) { + BusState *bus; + DriveInfo *di = drive_get_next(IF_SD); + BlockBackend *blk = di ? blk_by_legacy_dinfo(di) : NULL; + DeviceState *carddev; + char *bus_name; + + bus_name = g_strdup_printf("sd-bus%d", i); + bus = qdev_get_child_bus(DEVICE(&s->soc), bus_name); + g_free(bus_name); + if (!bus) { + error_report("No SD bus found for SD card %d", i); + exit(1); + } + carddev = qdev_create(bus, TYPE_SD_CARD); + qdev_prop_set_drive(carddev, "drive", blk, &error_fatal); + object_property_set_bool(OBJECT(carddev), true, "realized", + &error_fatal); + } + for (i = 0; i < XLNX_ZYNQMP_NUM_SPIS; i++) { SSIBus *spi_bus; DeviceState *flash_dev; diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c index 1508d0867d..4fbb63550b 100644 --- a/hw/arm/xlnx-zynqmp.c +++ b/hw/arm/xlnx-zynqmp.c @@ -327,6 +327,8 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, gic_spi[SATA_INTR]); for (i = 0; i < XLNX_ZYNQMP_NUM_SDHCI; i++) { + char *bus_name; + object_property_set_bool(OBJECT(&s->sdhci[i]), true, "realized", &err); if (err) { @@ -337,6 +339,12 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) sdhci_addr[i]); sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci[i]), 0, gic_spi[sdhci_intr[i]]); + /* Alias controller SD bus to the SoC itself */ + bus_name = g_strdup_printf("sd-bus%d", i); + object_property_add_alias(OBJECT(s), bus_name, + OBJECT(&s->sdhci[i]), "sd-bus", + &error_abort); + g_free(bus_name); } for (i = 0; i < XLNX_ZYNQMP_NUM_SPIS; i++) { diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 396dd10932..73e7c87fbf 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -1296,29 +1296,6 @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp) { SDHCIState *s = SYSBUS_SDHCI(dev); SysBusDevice *sbd = SYS_BUS_DEVICE(dev); - DriveInfo *di; - BlockBackend *blk; - DeviceState *carddev; - Error *err = NULL; - - /* Create and plug in the sd card. - * FIXME: this should be done by the users of this device so we - * do not use drive_get_next() here. - */ - di = drive_get_next(IF_SD); - blk = di ? blk_by_legacy_dinfo(di) : NULL; - - carddev = qdev_create(qdev_get_child_bus(dev, "sd-bus"), TYPE_SD_CARD); - qdev_prop_set_drive(carddev, "drive", blk, &err); - if (err) { - error_propagate(errp, err); - return; - } - object_property_set_bool(OBJECT(carddev), true, "realized", &err); - if (err) { - error_propagate(errp, err); - return; - } s->buf_maxsz = sdhci_get_fifolen(s); s->fifo_buffer = g_malloc0(s->buf_maxsz); @@ -1335,8 +1312,6 @@ static void sdhci_sysbus_class_init(ObjectClass *klass, void *data) dc->vmsd = &sdhci_vmstate; dc->props = sdhci_sysbus_properties; dc->realize = sdhci_sysbus_realize; - /* Reason: instance_init() method uses drive_get_next() */ - dc->cannot_instantiate_with_device_add_yet = true; } static const TypeInfo sdhci_sysbus_info = { From 7a9468c92517e19037bfe2272f64f5dadaf9db15 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:19 +0000 Subject: [PATCH 23/36] hw/sd/pxa2xx_mmci: convert to SysBusDevice object Convert the pxa2xx_mmci device to be a sysbus device. In this commit we only change the device itself, and leave the interface to the SD card using the old non-SDBus APIs. Signed-off-by: Peter Maydell Reviewed-by: Peter Crosthwaite Message-id: 1455646193-13238-8-git-send-email-peter.maydell@linaro.org --- hw/sd/pxa2xx_mmci.c | 70 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 54 insertions(+), 16 deletions(-) diff --git a/hw/sd/pxa2xx_mmci.c b/hw/sd/pxa2xx_mmci.c index 81da7b7bbd..e3753e5945 100644 --- a/hw/sd/pxa2xx_mmci.c +++ b/hw/sd/pxa2xx_mmci.c @@ -12,16 +12,24 @@ #include "qemu/osdep.h" #include "hw/hw.h" +#include "hw/sysbus.h" #include "hw/arm/pxa.h" #include "hw/sd/sd.h" #include "hw/qdev.h" +#include "hw/qdev-properties.h" + +#define TYPE_PXA2XX_MMCI "pxa2xx-mmci" +#define PXA2XX_MMCI(obj) OBJECT_CHECK(PXA2xxMMCIState, (obj), TYPE_PXA2XX_MMCI) struct PXA2xxMMCIState { + SysBusDevice parent_obj; + MemoryRegion iomem; qemu_irq irq; qemu_irq rx_dma; qemu_irq tx_dma; + BlockBackend *blk; SDState *card; uint32_t status; @@ -475,31 +483,61 @@ PXA2xxMMCIState *pxa2xx_mmci_init(MemoryRegion *sysmem, BlockBackend *blk, qemu_irq irq, qemu_irq rx_dma, qemu_irq tx_dma) { + DeviceState *dev; + SysBusDevice *sbd; PXA2xxMMCIState *s; - s = (PXA2xxMMCIState *) g_malloc0(sizeof(PXA2xxMMCIState)); - s->irq = irq; - s->rx_dma = rx_dma; - s->tx_dma = tx_dma; - - memory_region_init_io(&s->iomem, NULL, &pxa2xx_mmci_ops, s, - "pxa2xx-mmci", 0x00100000); - memory_region_add_subregion(sysmem, base, &s->iomem); - - /* Instantiate the actual storage */ - s->card = sd_init(blk, false); + dev = qdev_create(NULL, TYPE_PXA2XX_MMCI); + s = PXA2XX_MMCI(dev); + /* Reach into the device and initialize the SD card. This is + * unclean but will vanish when we update to SDBus APIs. + */ + s->card = sd_init(s->blk, false); if (s->card == NULL) { exit(1); } - - register_savevm(NULL, "pxa2xx_mmci", 0, 0, - pxa2xx_mmci_save, pxa2xx_mmci_load, s); - + qdev_init_nofail(dev); + sbd = SYS_BUS_DEVICE(dev); + sysbus_mmio_map(sbd, 0, base); + sysbus_connect_irq(sbd, 0, irq); + qdev_connect_gpio_out_named(dev, "rx-dma", 0, rx_dma); + qdev_connect_gpio_out_named(dev, "tx-dma", 0, tx_dma); return s; } void pxa2xx_mmci_handlers(PXA2xxMMCIState *s, qemu_irq readonly, - qemu_irq coverswitch) + qemu_irq coverswitch) { sd_set_cb(s->card, readonly, coverswitch); } + +static void pxa2xx_mmci_instance_init(Object *obj) +{ + PXA2xxMMCIState *s = PXA2XX_MMCI(obj); + SysBusDevice *sbd = SYS_BUS_DEVICE(obj); + DeviceState *dev = DEVICE(obj); + + memory_region_init_io(&s->iomem, obj, &pxa2xx_mmci_ops, s, + "pxa2xx-mmci", 0x00100000); + sysbus_init_mmio(sbd, &s->iomem); + sysbus_init_irq(sbd, &s->irq); + qdev_init_gpio_out_named(dev, &s->rx_dma, "rx-dma", 1); + qdev_init_gpio_out_named(dev, &s->tx_dma, "tx-dma", 1); + + register_savevm(NULL, "pxa2xx_mmci", 0, 0, + pxa2xx_mmci_save, pxa2xx_mmci_load, s); +} + +static const TypeInfo pxa2xx_mmci_info = { + .name = TYPE_PXA2XX_MMCI, + .parent = TYPE_SYS_BUS_DEVICE, + .instance_size = sizeof(PXA2xxMMCIState), + .instance_init = pxa2xx_mmci_instance_init, +}; + +static void pxa2xx_mmci_register_types(void) +{ + type_register_static(&pxa2xx_mmci_info); +} + +type_init(pxa2xx_mmci_register_types) From a9563e75e4f47365dc782b8a4d8460db2bc19831 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:19 +0000 Subject: [PATCH 24/36] hw/sd/pxa2xx_mmci: Update to use new SDBus APIs Now the PXA2xx MMCI device is QOMified itself, we can update it to use the SDBus APIs to talk to the SD card. Signed-off-by: Peter Maydell Message-id: 1455646193-13238-9-git-send-email-peter.maydell@linaro.org --- hw/sd/pxa2xx_mmci.c | 80 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 66 insertions(+), 14 deletions(-) diff --git a/hw/sd/pxa2xx_mmci.c b/hw/sd/pxa2xx_mmci.c index e3753e5945..9f4bbd4ea2 100644 --- a/hw/sd/pxa2xx_mmci.c +++ b/hw/sd/pxa2xx_mmci.c @@ -17,10 +17,14 @@ #include "hw/sd/sd.h" #include "hw/qdev.h" #include "hw/qdev-properties.h" +#include "qemu/error-report.h" #define TYPE_PXA2XX_MMCI "pxa2xx-mmci" #define PXA2XX_MMCI(obj) OBJECT_CHECK(PXA2xxMMCIState, (obj), TYPE_PXA2XX_MMCI) +#define TYPE_PXA2XX_MMCI_BUS "pxa2xx-mmci-bus" +#define PXA2XX_MMCI_BUS(obj) OBJECT_CHECK(SDBus, (obj), TYPE_PXA2XX_MMCI_BUS) + struct PXA2xxMMCIState { SysBusDevice parent_obj; @@ -28,9 +32,11 @@ struct PXA2xxMMCIState { qemu_irq irq; qemu_irq rx_dma; qemu_irq tx_dma; + qemu_irq inserted; + qemu_irq readonly; BlockBackend *blk; - SDState *card; + SDBus sdbus; uint32_t status; uint32_t clkrt; @@ -130,7 +136,7 @@ static void pxa2xx_mmci_fifo_update(PXA2xxMMCIState *s) if (s->cmdat & CMDAT_WR_RD) { while (s->bytesleft && s->tx_len) { - sd_write_data(s->card, s->tx_fifo[s->tx_start ++]); + sdbus_write_data(&s->sdbus, s->tx_fifo[s->tx_start++]); s->tx_start &= 0x1f; s->tx_len --; s->bytesleft --; @@ -140,7 +146,7 @@ static void pxa2xx_mmci_fifo_update(PXA2xxMMCIState *s) } else while (s->bytesleft && s->rx_len < 32) { s->rx_fifo[(s->rx_start + (s->rx_len ++)) & 0x1f] = - sd_read_data(s->card); + sdbus_read_data(&s->sdbus); s->bytesleft --; s->intreq |= INT_RXFIFO_REQ; } @@ -174,7 +180,7 @@ static void pxa2xx_mmci_wakequeues(PXA2xxMMCIState *s) request.arg = s->arg; request.crc = 0; /* FIXME */ - rsplen = sd_do_command(s->card, &request, response); + rsplen = sdbus_do_command(&s->sdbus, &request, response); s->intreq |= INT_END_CMD; memset(s->resp_fifo, 0, sizeof(s->resp_fifo)); @@ -483,32 +489,59 @@ PXA2xxMMCIState *pxa2xx_mmci_init(MemoryRegion *sysmem, BlockBackend *blk, qemu_irq irq, qemu_irq rx_dma, qemu_irq tx_dma) { - DeviceState *dev; + DeviceState *dev, *carddev; SysBusDevice *sbd; PXA2xxMMCIState *s; + Error *err = NULL; dev = qdev_create(NULL, TYPE_PXA2XX_MMCI); s = PXA2XX_MMCI(dev); - /* Reach into the device and initialize the SD card. This is - * unclean but will vanish when we update to SDBus APIs. - */ - s->card = sd_init(s->blk, false); - if (s->card == NULL) { - exit(1); - } - qdev_init_nofail(dev); sbd = SYS_BUS_DEVICE(dev); sysbus_mmio_map(sbd, 0, base); sysbus_connect_irq(sbd, 0, irq); qdev_connect_gpio_out_named(dev, "rx-dma", 0, rx_dma); qdev_connect_gpio_out_named(dev, "tx-dma", 0, tx_dma); + + /* Create and plug in the sd card */ + carddev = qdev_create(qdev_get_child_bus(dev, "sd-bus"), TYPE_SD_CARD); + qdev_prop_set_drive(carddev, "drive", blk, &err); + if (err) { + error_report("failed to init SD card: %s", error_get_pretty(err)); + return NULL; + } + object_property_set_bool(OBJECT(carddev), true, "realized", &err); + if (err) { + error_report("failed to init SD card: %s", error_get_pretty(err)); + return NULL; + } + return s; } +static void pxa2xx_mmci_set_inserted(DeviceState *dev, bool inserted) +{ + PXA2xxMMCIState *s = PXA2XX_MMCI(dev); + + qemu_set_irq(s->inserted, inserted); +} + +static void pxa2xx_mmci_set_readonly(DeviceState *dev, bool readonly) +{ + PXA2xxMMCIState *s = PXA2XX_MMCI(dev); + + qemu_set_irq(s->readonly, readonly); +} + void pxa2xx_mmci_handlers(PXA2xxMMCIState *s, qemu_irq readonly, qemu_irq coverswitch) { - sd_set_cb(s->card, readonly, coverswitch); + DeviceState *dev = DEVICE(s); + + s->readonly = readonly; + s->inserted = coverswitch; + + pxa2xx_mmci_set_inserted(dev, sdbus_get_inserted(&s->sdbus)); + pxa2xx_mmci_set_readonly(dev, sdbus_get_readonly(&s->sdbus)); } static void pxa2xx_mmci_instance_init(Object *obj) @@ -526,6 +559,17 @@ static void pxa2xx_mmci_instance_init(Object *obj) register_savevm(NULL, "pxa2xx_mmci", 0, 0, pxa2xx_mmci_save, pxa2xx_mmci_load, s); + + qbus_create_inplace(&s->sdbus, sizeof(s->sdbus), + TYPE_PXA2XX_MMCI_BUS, DEVICE(obj), "sd-bus"); +} + +static void pxa2xx_mmci_bus_class_init(ObjectClass *klass, void *data) +{ + SDBusClass *sbc = SD_BUS_CLASS(klass); + + sbc->set_inserted = pxa2xx_mmci_set_inserted; + sbc->set_readonly = pxa2xx_mmci_set_readonly; } static const TypeInfo pxa2xx_mmci_info = { @@ -535,9 +579,17 @@ static const TypeInfo pxa2xx_mmci_info = { .instance_init = pxa2xx_mmci_instance_init, }; +static const TypeInfo pxa2xx_mmci_bus_info = { + .name = TYPE_PXA2XX_MMCI_BUS, + .parent = TYPE_SD_BUS, + .instance_size = sizeof(SDBus), + .class_init = pxa2xx_mmci_bus_class_init, +}; + static void pxa2xx_mmci_register_types(void) { type_register_static(&pxa2xx_mmci_info); + type_register_static(&pxa2xx_mmci_bus_info); } type_init(pxa2xx_mmci_register_types) From 19d25e0a6d2251e334528115855062738726fff5 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:19 +0000 Subject: [PATCH 25/36] hw/sd/pxa2xx_mmci: Convert to VMStateDescription Convert the pxa2xx_mmci device from manual save/load functions to a VMStateDescription structure. This is a migration compatibility break. Signed-off-by: Peter Maydell Reviewed-by: Peter Crosthwaite Message-id: 1455646193-13238-10-git-send-email-peter.maydell@linaro.org --- hw/sd/pxa2xx_mmci.c | 156 ++++++++++++++++++-------------------------- 1 file changed, 64 insertions(+), 92 deletions(-) diff --git a/hw/sd/pxa2xx_mmci.c b/hw/sd/pxa2xx_mmci.c index 9f4bbd4ea2..bd7303c508 100644 --- a/hw/sd/pxa2xx_mmci.c +++ b/hw/sd/pxa2xx_mmci.c @@ -44,25 +44,70 @@ struct PXA2xxMMCIState { uint32_t cmdat; uint32_t resp_tout; uint32_t read_tout; - int blklen; - int numblk; + int32_t blklen; + int32_t numblk; uint32_t intmask; uint32_t intreq; - int cmd; + int32_t cmd; uint32_t arg; - int active; - int bytesleft; + int32_t active; + int32_t bytesleft; uint8_t tx_fifo[64]; - int tx_start; - int tx_len; + uint32_t tx_start; + uint32_t tx_len; uint8_t rx_fifo[32]; - int rx_start; - int rx_len; + uint32_t rx_start; + uint32_t rx_len; uint16_t resp_fifo[9]; - int resp_len; + uint32_t resp_len; - int cmdreq; + int32_t cmdreq; +}; + +static bool pxa2xx_mmci_vmstate_validate(void *opaque, int version_id) +{ + PXA2xxMMCIState *s = opaque; + + return s->tx_start < ARRAY_SIZE(s->tx_fifo) + && s->rx_start < ARRAY_SIZE(s->rx_fifo) + && s->tx_len <= ARRAY_SIZE(s->tx_fifo) + && s->rx_len <= ARRAY_SIZE(s->rx_fifo) + && s->resp_len <= ARRAY_SIZE(s->resp_fifo); +} + + +static const VMStateDescription vmstate_pxa2xx_mmci = { + .name = "pxa2xx-mmci", + .version_id = 2, + .minimum_version_id = 2, + .fields = (VMStateField[]) { + VMSTATE_UINT32(status, PXA2xxMMCIState), + VMSTATE_UINT32(clkrt, PXA2xxMMCIState), + VMSTATE_UINT32(spi, PXA2xxMMCIState), + VMSTATE_UINT32(cmdat, PXA2xxMMCIState), + VMSTATE_UINT32(resp_tout, PXA2xxMMCIState), + VMSTATE_UINT32(read_tout, PXA2xxMMCIState), + VMSTATE_INT32(blklen, PXA2xxMMCIState), + VMSTATE_INT32(numblk, PXA2xxMMCIState), + VMSTATE_UINT32(intmask, PXA2xxMMCIState), + VMSTATE_UINT32(intreq, PXA2xxMMCIState), + VMSTATE_INT32(cmd, PXA2xxMMCIState), + VMSTATE_UINT32(arg, PXA2xxMMCIState), + VMSTATE_INT32(cmdreq, PXA2xxMMCIState), + VMSTATE_INT32(active, PXA2xxMMCIState), + VMSTATE_INT32(bytesleft, PXA2xxMMCIState), + VMSTATE_UINT32(tx_start, PXA2xxMMCIState), + VMSTATE_UINT32(tx_len, PXA2xxMMCIState), + VMSTATE_UINT32(rx_start, PXA2xxMMCIState), + VMSTATE_UINT32(rx_len, PXA2xxMMCIState), + VMSTATE_UINT32(resp_len, PXA2xxMMCIState), + VMSTATE_VALIDATE("fifo size incorrect", pxa2xx_mmci_vmstate_validate), + VMSTATE_UINT8_ARRAY(tx_fifo, PXA2xxMMCIState, 64), + VMSTATE_UINT8_ARRAY(rx_fifo, PXA2xxMMCIState, 32), + VMSTATE_UINT16_ARRAY(resp_fifo, PXA2xxMMCIState, 9), + VMSTATE_END_OF_LIST() + } }; #define MMC_STRPCL 0x00 /* MMC Clock Start/Stop register */ @@ -406,84 +451,6 @@ static const MemoryRegionOps pxa2xx_mmci_ops = { .endianness = DEVICE_NATIVE_ENDIAN, }; -static void pxa2xx_mmci_save(QEMUFile *f, void *opaque) -{ - PXA2xxMMCIState *s = (PXA2xxMMCIState *) opaque; - int i; - - qemu_put_be32s(f, &s->status); - qemu_put_be32s(f, &s->clkrt); - qemu_put_be32s(f, &s->spi); - qemu_put_be32s(f, &s->cmdat); - qemu_put_be32s(f, &s->resp_tout); - qemu_put_be32s(f, &s->read_tout); - qemu_put_be32(f, s->blklen); - qemu_put_be32(f, s->numblk); - qemu_put_be32s(f, &s->intmask); - qemu_put_be32s(f, &s->intreq); - qemu_put_be32(f, s->cmd); - qemu_put_be32s(f, &s->arg); - qemu_put_be32(f, s->cmdreq); - qemu_put_be32(f, s->active); - qemu_put_be32(f, s->bytesleft); - - qemu_put_byte(f, s->tx_len); - for (i = 0; i < s->tx_len; i ++) - qemu_put_byte(f, s->tx_fifo[(s->tx_start + i) & 63]); - - qemu_put_byte(f, s->rx_len); - for (i = 0; i < s->rx_len; i ++) - qemu_put_byte(f, s->rx_fifo[(s->rx_start + i) & 31]); - - qemu_put_byte(f, s->resp_len); - for (i = s->resp_len; i < 9; i ++) - qemu_put_be16s(f, &s->resp_fifo[i]); -} - -static int pxa2xx_mmci_load(QEMUFile *f, void *opaque, int version_id) -{ - PXA2xxMMCIState *s = (PXA2xxMMCIState *) opaque; - int i; - - qemu_get_be32s(f, &s->status); - qemu_get_be32s(f, &s->clkrt); - qemu_get_be32s(f, &s->spi); - qemu_get_be32s(f, &s->cmdat); - qemu_get_be32s(f, &s->resp_tout); - qemu_get_be32s(f, &s->read_tout); - s->blklen = qemu_get_be32(f); - s->numblk = qemu_get_be32(f); - qemu_get_be32s(f, &s->intmask); - qemu_get_be32s(f, &s->intreq); - s->cmd = qemu_get_be32(f); - qemu_get_be32s(f, &s->arg); - s->cmdreq = qemu_get_be32(f); - s->active = qemu_get_be32(f); - s->bytesleft = qemu_get_be32(f); - - s->tx_len = qemu_get_byte(f); - s->tx_start = 0; - if (s->tx_len >= sizeof(s->tx_fifo) || s->tx_len < 0) - return -EINVAL; - for (i = 0; i < s->tx_len; i ++) - s->tx_fifo[i] = qemu_get_byte(f); - - s->rx_len = qemu_get_byte(f); - s->rx_start = 0; - if (s->rx_len >= sizeof(s->rx_fifo) || s->rx_len < 0) - return -EINVAL; - for (i = 0; i < s->rx_len; i ++) - s->rx_fifo[i] = qemu_get_byte(f); - - s->resp_len = qemu_get_byte(f); - if (s->resp_len > 9 || s->resp_len < 0) - return -EINVAL; - for (i = s->resp_len; i < 9; i ++) - qemu_get_be16s(f, &s->resp_fifo[i]); - - return 0; -} - PXA2xxMMCIState *pxa2xx_mmci_init(MemoryRegion *sysmem, hwaddr base, BlockBackend *blk, qemu_irq irq, @@ -557,13 +524,17 @@ static void pxa2xx_mmci_instance_init(Object *obj) qdev_init_gpio_out_named(dev, &s->rx_dma, "rx-dma", 1); qdev_init_gpio_out_named(dev, &s->tx_dma, "tx-dma", 1); - register_savevm(NULL, "pxa2xx_mmci", 0, 0, - pxa2xx_mmci_save, pxa2xx_mmci_load, s); - qbus_create_inplace(&s->sdbus, sizeof(s->sdbus), TYPE_PXA2XX_MMCI_BUS, DEVICE(obj), "sd-bus"); } +static void pxa2xx_mmci_class_init(ObjectClass *klass, void *data) +{ + DeviceClass *dc = DEVICE_CLASS(klass); + + dc->vmsd = &vmstate_pxa2xx_mmci; +} + static void pxa2xx_mmci_bus_class_init(ObjectClass *klass, void *data) { SDBusClass *sbc = SD_BUS_CLASS(klass); @@ -577,6 +548,7 @@ static const TypeInfo pxa2xx_mmci_info = { .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(PXA2xxMMCIState), .instance_init = pxa2xx_mmci_instance_init, + .class_init = pxa2xx_mmci_class_init, }; static const TypeInfo pxa2xx_mmci_bus_info = { From 6002915e0c3a6e30dfab18606f23f3149800be18 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 18 Feb 2016 14:16:19 +0000 Subject: [PATCH 26/36] hw/sd/pxa2xx_mmci: Add reset function Add a reset function to the pxa2xx_mmci device; previously it had no handling for system reset at all. Signed-off-by: Peter Maydell Reviewed-by: Peter Crosthwaite Message-id: 1455646193-13238-11-git-send-email-peter.maydell@linaro.org --- hw/sd/pxa2xx_mmci.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/hw/sd/pxa2xx_mmci.c b/hw/sd/pxa2xx_mmci.c index bd7303c508..9c3679b5db 100644 --- a/hw/sd/pxa2xx_mmci.c +++ b/hw/sd/pxa2xx_mmci.c @@ -511,6 +511,35 @@ void pxa2xx_mmci_handlers(PXA2xxMMCIState *s, qemu_irq readonly, pxa2xx_mmci_set_readonly(dev, sdbus_get_readonly(&s->sdbus)); } +static void pxa2xx_mmci_reset(DeviceState *d) +{ + PXA2xxMMCIState *s = PXA2XX_MMCI(d); + + s->status = 0; + s->clkrt = 0; + s->spi = 0; + s->cmdat = 0; + s->resp_tout = 0; + s->read_tout = 0; + s->blklen = 0; + s->numblk = 0; + s->intmask = 0; + s->intreq = 0; + s->cmd = 0; + s->arg = 0; + s->active = 0; + s->bytesleft = 0; + s->tx_start = 0; + s->tx_len = 0; + s->rx_start = 0; + s->rx_len = 0; + s->resp_len = 0; + s->cmdreq = 0; + memset(s->tx_fifo, 0, sizeof(s->tx_fifo)); + memset(s->rx_fifo, 0, sizeof(s->rx_fifo)); + memset(s->resp_fifo, 0, sizeof(s->resp_fifo)); +} + static void pxa2xx_mmci_instance_init(Object *obj) { PXA2xxMMCIState *s = PXA2XX_MMCI(obj); @@ -533,6 +562,7 @@ static void pxa2xx_mmci_class_init(ObjectClass *klass, void *data) DeviceClass *dc = DEVICE_CLASS(klass); dc->vmsd = &vmstate_pxa2xx_mmci; + dc->reset = pxa2xx_mmci_reset; } static void pxa2xx_mmci_bus_class_init(ObjectClass *klass, void *data) From 4481bbc79d2ae6041094797243972efd08b2f6b0 Mon Sep 17 00:00:00 2001 From: Andrew Baumann Date: Thu, 18 Feb 2016 14:16:19 +0000 Subject: [PATCH 27/36] hw/sd: implement CMD23 (SET_BLOCK_COUNT) for MMC compatibility CMD23 is optional for SD but required for MMC, and the UEFI bootloader used for Windows on Raspberry Pi 2 issues it. Reviewed-by: Peter Crosthwaite Signed-off-by: Andrew Baumann Message-id: 1454902521-21164-2-git-send-email-Andrew.Baumann@microsoft.com Signed-off-by: Peter Maydell --- hw/sd/sd.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/hw/sd/sd.c b/hw/sd/sd.c index 8902cd818d..8dd6f39ecb 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -98,6 +98,7 @@ struct SDState { int32_t wpgrps_size; uint64_t size; uint32_t blk_len; + uint32_t multi_blk_cnt; uint32_t erase_start; uint32_t erase_end; uint8_t pwd[16]; @@ -430,6 +431,7 @@ static void sd_reset(DeviceState *dev) sd->blk_len = 0x200; sd->pwd_len = 0; sd->expecting_acmd = false; + sd->multi_blk_cnt = 0; } static bool sd_get_inserted(SDState *sd) @@ -489,6 +491,7 @@ static const VMStateDescription sd_vmstate = { VMSTATE_UINT32(vhs, SDState), VMSTATE_BITMAP(wp_groups, SDState, 0, wpgrps_size), VMSTATE_UINT32(blk_len, SDState), + VMSTATE_UINT32(multi_blk_cnt, SDState), VMSTATE_UINT32(erase_start, SDState), VMSTATE_UINT32(erase_end, SDState), VMSTATE_UINT8_ARRAY(pwd, SDState, 16), @@ -699,6 +702,12 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, rca = req.arg >> 16; } + /* CMD23 (set block count) must be immediately followed by CMD18 or CMD25 + * if not, its effects are cancelled */ + if (sd->multi_blk_cnt != 0 && !(req.cmd == 18 || req.cmd == 25)) { + sd->multi_blk_cnt = 0; + } + DPRINTF("CMD%d 0x%08x state %d\n", req.cmd, req.arg, sd->state); switch (req.cmd) { /* Basic commands (Class 0 and Class 1) */ @@ -994,6 +1003,17 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, } break; + case 23: /* CMD23: SET_BLOCK_COUNT */ + switch (sd->state) { + case sd_transfer_state: + sd->multi_blk_cnt = req.arg; + return sd_r1; + + default: + break; + } + break; + /* Block write commands (Class 4) */ case 24: /* CMD24: WRITE_SINGLE_BLOCK */ if (sd->spi) @@ -1594,6 +1614,14 @@ void sd_write_data(SDState *sd, uint8_t value) sd->csd[14] |= 0x40; /* Bzzzzzzztt .... Operation complete. */ + if (sd->multi_blk_cnt != 0) { + if (--sd->multi_blk_cnt == 0) { + /* Stop! */ + sd->state = sd_transfer_state; + break; + } + } + sd->state = sd_receivingdata_state; } break; @@ -1740,6 +1768,15 @@ uint8_t sd_read_data(SDState *sd) if (sd->data_offset >= io_len) { sd->data_start += io_len; sd->data_offset = 0; + + if (sd->multi_blk_cnt != 0) { + if (--sd->multi_blk_cnt == 0) { + /* Stop! */ + sd->state = sd_transfer_state; + break; + } + } + if (sd->data_start + io_len > sd->size) { sd->card_status |= ADDRESS_ERROR; break; From dd26eb43337adf53d22b3fda3591e3837bc08b8c Mon Sep 17 00:00:00 2001 From: Andrew Baumann Date: Thu, 18 Feb 2016 14:16:20 +0000 Subject: [PATCH 28/36] hw/sd: model a power-up delay, as a workaround for an EDK2 bug The SD spec for ACMD41 says that a zero argument is an "inquiry" ACMD41, which does not start initialisation and is used only for retrieving the OCR. However, Tianocore EDK2 (UEFI) has a bug [1]: it first sends an inquiry (zero) ACMD41. If that first request returns an OCR value with the power up bit (0x80000000) set, it assumes the card is ready and continues, leaving the card in the wrong state. (My assumption is that this works on hardware, because no real card is immediately powered up upon reset.) This change models a delay of 0.5ms from the first ACMD41 to the power being up. However, it also immediately sets the power on upon seeing a non-zero (non-enquiry) ACMD41. This speeds up UEFI boot, it should also account for guests that simply delay after card reset and then issue an ACMD41 that they expect will succeed. [1] https://github.com/tianocore/edk2/blob/master/EmbeddedPkg/Universal/MmcDxe/MmcIdentification.c#L279 (This is the loop starting with "We need to wait for the MMC or SD card is ready") Reviewed-by: Peter Maydell Signed-off-by: Andrew Baumann Message-id: 1454902521-21164-3-git-send-email-Andrew.Baumann@microsoft.com Signed-off-by: Peter Maydell --- hw/sd/sd.c | 81 ++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 76 insertions(+), 5 deletions(-) diff --git a/hw/sd/sd.c b/hw/sd/sd.c index 8dd6f39ecb..bef6c0f2cd 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -37,6 +37,7 @@ #include "qemu/bitmap.h" #include "hw/qdev-properties.h" #include "qemu/error-report.h" +#include "qemu/timer.h" //#define DEBUG_SD 1 @@ -47,7 +48,9 @@ do { fprintf(stderr, "SD: " fmt , ## __VA_ARGS__); } while (0) #define DPRINTF(fmt, ...) do {} while(0) #endif -#define ACMD41_ENQUIRY_MASK 0x00ffffff +#define ACMD41_ENQUIRY_MASK 0x00ffffff +#define OCR_POWER_UP 0x80000000 +#define OCR_POWER_DELAY_NS 500000 /* 0.5ms */ typedef enum { sd_r0 = 0, /* no response */ @@ -86,6 +89,7 @@ struct SDState { uint32_t mode; /* current card mode, one of SDCardModes */ int32_t state; /* current card state, one of SDCardStates */ uint32_t ocr; + QEMUTimer *ocr_power_timer; uint8_t scr[8]; uint8_t cid[16]; uint8_t csd[16]; @@ -200,8 +204,17 @@ static uint16_t sd_crc16(void *message, size_t width) static void sd_set_ocr(SDState *sd) { - /* All voltages OK, card power-up OK, Standard Capacity SD Memory Card */ - sd->ocr = 0x80ffff00; + /* All voltages OK, Standard Capacity SD Memory Card, not yet powered up */ + sd->ocr = 0x00ffff00; +} + +static void sd_ocr_powerup(void *opaque) +{ + SDState *sd = opaque; + + /* Set powered up bit in OCR */ + assert(!(sd->ocr & OCR_POWER_UP)); + sd->ocr |= OCR_POWER_UP; } static void sd_set_scr(SDState *sd) @@ -476,10 +489,44 @@ static const BlockDevOps sd_block_ops = { .change_media_cb = sd_cardchange, }; +static bool sd_ocr_vmstate_needed(void *opaque) +{ + SDState *sd = opaque; + + /* Include the OCR state (and timer) if it is not yet powered up */ + return !(sd->ocr & OCR_POWER_UP); +} + +static const VMStateDescription sd_ocr_vmstate = { + .name = "sd-card/ocr-state", + .version_id = 1, + .minimum_version_id = 1, + .needed = sd_ocr_vmstate_needed, + .fields = (VMStateField[]) { + VMSTATE_UINT32(ocr, SDState), + VMSTATE_TIMER_PTR(ocr_power_timer, SDState), + VMSTATE_END_OF_LIST() + }, +}; + +static int sd_vmstate_pre_load(void *opaque) +{ + SDState *sd = opaque; + + /* If the OCR state is not included (prior versions, or not + * needed), then the OCR must be set as powered up. If the OCR state + * is included, this will be replaced by the state restore. + */ + sd_ocr_powerup(sd); + + return 0; +} + static const VMStateDescription sd_vmstate = { .name = "sd-card", .version_id = 1, .minimum_version_id = 1, + .pre_load = sd_vmstate_pre_load, .fields = (VMStateField[]) { VMSTATE_UINT32(mode, SDState), VMSTATE_INT32(state, SDState), @@ -506,7 +553,11 @@ static const VMStateDescription sd_vmstate = { VMSTATE_BUFFER_POINTER_UNSAFE(buf, SDState, 1, 512), VMSTATE_BOOL(enable, SDState), VMSTATE_END_OF_LIST() - } + }, + .subsections = (const VMStateDescription*[]) { + &sd_ocr_vmstate, + NULL + }, }; /* Legacy initialization function for use by non-qdevified callers */ @@ -1323,9 +1374,28 @@ static sd_rsp_type_t sd_app_command(SDState *sd, } switch (sd->state) { case sd_idle_state: + /* If it's the first ACMD41 since reset, we need to decide + * whether to power up. If this is not an enquiry ACMD41, + * we immediately report power on and proceed below to the + * ready state, but if it is, we set a timer to model a + * delay for power up. This works around a bug in EDK2 + * UEFI, which sends an initial enquiry ACMD41, but + * assumes that the card is in ready state as soon as it + * sees the power up bit set. */ + if (!(sd->ocr & OCR_POWER_UP)) { + if ((req.arg & ACMD41_ENQUIRY_MASK) != 0) { + timer_del(sd->ocr_power_timer); + sd_ocr_powerup(sd); + } else if (!timer_pending(sd->ocr_power_timer)) { + timer_mod_ns(sd->ocr_power_timer, + (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + + OCR_POWER_DELAY_NS)); + } + } + /* We accept any voltage. 10000 V is nothing. * - * We don't model init delay so just advance straight to ready state + * Once we're powered up, we advance straight to ready state * unless it's an enquiry ACMD41 (bits 23:0 == 0). */ if (req.arg & ACMD41_ENQUIRY_MASK) { @@ -1837,6 +1907,7 @@ static void sd_instance_init(Object *obj) SDState *sd = SD_CARD(obj); sd->enable = true; + sd->ocr_power_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, sd_ocr_powerup, sd); } static void sd_realize(DeviceState *dev, Error **errp) From 9800ad88c8e0f150284c240fb2e2d08c3e1e02d5 Mon Sep 17 00:00:00 2001 From: Andrew Baumann Date: Thu, 18 Feb 2016 14:16:20 +0000 Subject: [PATCH 29/36] hw/sd: use guest error logging rather than fprintf to stderr Some of these errors may be harmless (e.g. probing unimplemented commands, or issuing CMD12 in the wrong state), and may also be quite frequent. Spamming the standard error output isn't desirable in such cases. Reviewed-by: Peter Crosthwaite Signed-off-by: Andrew Baumann Message-id: 1454902521-21164-4-git-send-email-Andrew.Baumann@microsoft.com Signed-off-by: Peter Maydell --- hw/sd/sd.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/hw/sd/sd.c b/hw/sd/sd.c index bef6c0f2cd..edb6b32690 100644 --- a/hw/sd/sd.c +++ b/hw/sd/sd.c @@ -1297,16 +1297,17 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, default: bad_cmd: - fprintf(stderr, "SD: Unknown CMD%i\n", req.cmd); + qemu_log_mask(LOG_GUEST_ERROR, "SD: Unknown CMD%i\n", req.cmd); return sd_illegal; unimplemented_cmd: /* Commands that are recognised but not yet implemented in SPI mode. */ - fprintf(stderr, "SD: CMD%i not implemented in SPI mode\n", req.cmd); + qemu_log_mask(LOG_UNIMP, "SD: CMD%i not implemented in SPI mode\n", + req.cmd); return sd_illegal; } - fprintf(stderr, "SD: CMD%i in a wrong state\n", req.cmd); + qemu_log_mask(LOG_GUEST_ERROR, "SD: CMD%i in a wrong state\n", req.cmd); return sd_illegal; } @@ -1438,7 +1439,7 @@ static sd_rsp_type_t sd_app_command(SDState *sd, return sd_normal_command(sd, req); } - fprintf(stderr, "SD: ACMD%i in a wrong state\n", req.cmd); + qemu_log_mask(LOG_GUEST_ERROR, "SD: ACMD%i in a wrong state\n", req.cmd); return sd_illegal; } @@ -1482,7 +1483,7 @@ int sd_do_command(SDState *sd, SDRequest *req, if (!cmd_valid_while_locked(sd, req)) { sd->card_status |= ILLEGAL_COMMAND; sd->expecting_acmd = false; - fprintf(stderr, "SD: Card is locked\n"); + qemu_log_mask(LOG_GUEST_ERROR, "SD: Card is locked\n"); rtype = sd_illegal; goto send_response; } @@ -1640,7 +1641,8 @@ void sd_write_data(SDState *sd, uint8_t value) return; if (sd->state != sd_receivingdata_state) { - fprintf(stderr, "sd_write_data: not in Receiving-Data state\n"); + qemu_log_mask(LOG_GUEST_ERROR, + "sd_write_data: not in Receiving-Data state\n"); return; } @@ -1759,7 +1761,7 @@ void sd_write_data(SDState *sd, uint8_t value) break; default: - fprintf(stderr, "sd_write_data: unknown command\n"); + qemu_log_mask(LOG_GUEST_ERROR, "sd_write_data: unknown command\n"); break; } } @@ -1774,7 +1776,8 @@ uint8_t sd_read_data(SDState *sd) return 0x00; if (sd->state != sd_sendingdata_state) { - fprintf(stderr, "sd_read_data: not in Sending-Data state\n"); + qemu_log_mask(LOG_GUEST_ERROR, + "sd_read_data: not in Sending-Data state\n"); return 0x00; } @@ -1885,7 +1888,7 @@ uint8_t sd_read_data(SDState *sd) break; default: - fprintf(stderr, "sd_read_data: unknown command\n"); + qemu_log_mask(LOG_GUEST_ERROR, "sd_read_data: unknown command\n"); return 0x00; } From 0d175e745f91fe2177f634676c34d450fd66e518 Mon Sep 17 00:00:00 2001 From: "xiaoqiang.zhao" Date: Thu, 18 Feb 2016 14:16:20 +0000 Subject: [PATCH 30/36] hw/timer: QOM'ify arm_timer (pass 1) * assign icp_pit_init to icp_pit_info.instance_init * split the old SysBus init function into an instance_init and a Device realize function * use DeviceClass::realize instead of SysBusDeviceClass::init Reviewed-by: Peter Maydell Signed-off-by: xiaoqiang zhao Signed-off-by: Peter Maydell --- hw/timer/arm_timer.c | 40 +++++++++++++++++++--------------------- 1 file changed, 19 insertions(+), 21 deletions(-) diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c index ba390ad50b..5bd2d752d6 100644 --- a/hw/timer/arm_timer.c +++ b/hw/timer/arm_timer.c @@ -277,21 +277,26 @@ static const VMStateDescription vmstate_sp804 = { } }; -static int sp804_init(SysBusDevice *sbd) +static void sp804_init(Object *obj) { - DeviceState *dev = DEVICE(sbd); - SP804State *s = SP804(dev); + SP804State *s = SP804(obj); + SysBusDevice *sbd = SYS_BUS_DEVICE(obj); sysbus_init_irq(sbd, &s->irq); + memory_region_init_io(&s->iomem, obj, &sp804_ops, s, + "sp804", 0x1000); + sysbus_init_mmio(sbd, &s->iomem); +} + +static void sp804_realize(DeviceState *dev, Error **errp) +{ + SP804State *s = SP804(dev); + s->timer[0] = arm_timer_init(s->freq0); s->timer[1] = arm_timer_init(s->freq1); s->timer[0]->irq = qemu_allocate_irq(sp804_set_irq, s, 0); s->timer[1]->irq = qemu_allocate_irq(sp804_set_irq, s, 1); - memory_region_init_io(&s->iomem, OBJECT(s), &sp804_ops, s, - "sp804", 0x1000); - sysbus_init_mmio(sbd, &s->iomem); vmstate_register(dev, -1, &vmstate_sp804, s); - return 0; } /* Integrator/CP timer module. */ @@ -344,9 +349,10 @@ static const MemoryRegionOps icp_pit_ops = { .endianness = DEVICE_NATIVE_ENDIAN, }; -static int icp_pit_init(SysBusDevice *dev) +static void icp_pit_init(Object *obj) { - icp_pit_state *s = INTEGRATOR_PIT(dev); + icp_pit_state *s = INTEGRATOR_PIT(obj); + SysBusDevice *dev = SYS_BUS_DEVICE(obj); /* Timer 0 runs at the system clock speed (40MHz). */ s->timer[0] = arm_timer_init(40000000); @@ -358,26 +364,18 @@ static int icp_pit_init(SysBusDevice *dev) sysbus_init_irq(dev, &s->timer[1]->irq); sysbus_init_irq(dev, &s->timer[2]->irq); - memory_region_init_io(&s->iomem, OBJECT(s), &icp_pit_ops, s, + memory_region_init_io(&s->iomem, obj, &icp_pit_ops, s, "icp_pit", 0x1000); sysbus_init_mmio(dev, &s->iomem); /* This device has no state to save/restore. The component timers will save themselves. */ - return 0; -} - -static void icp_pit_class_init(ObjectClass *klass, void *data) -{ - SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass); - - sdc->init = icp_pit_init; } static const TypeInfo icp_pit_info = { .name = TYPE_INTEGRATOR_PIT, .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(icp_pit_state), - .class_init = icp_pit_class_init, + .instance_init = icp_pit_init, }; static Property sp804_properties[] = { @@ -388,10 +386,9 @@ static Property sp804_properties[] = { static void sp804_class_init(ObjectClass *klass, void *data) { - SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass); DeviceClass *k = DEVICE_CLASS(klass); - sdc->init = sp804_init; + k->realize = sp804_realize; k->props = sp804_properties; } @@ -399,6 +396,7 @@ static const TypeInfo sp804_info = { .name = TYPE_SP804, .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(SP804State), + .instance_init = sp804_init, .class_init = sp804_class_init, }; From d712a5a2a473ca545e967d8fb07a9ed4080c98d0 Mon Sep 17 00:00:00 2001 From: "xiaoqiang.zhao" Date: Thu, 18 Feb 2016 14:16:20 +0000 Subject: [PATCH 31/36] hw/timer: QOM'ify arm_timer (pass 2) assign DeviceClass::vmsd instead of using vmstate_register function Reviewed-by: Peter Maydell Signed-off-by: xiaoqiang zhao Signed-off-by: Peter Maydell --- hw/timer/arm_timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c index 5bd2d752d6..f1ede5f53b 100644 --- a/hw/timer/arm_timer.c +++ b/hw/timer/arm_timer.c @@ -296,7 +296,6 @@ static void sp804_realize(DeviceState *dev, Error **errp) s->timer[1] = arm_timer_init(s->freq1); s->timer[0]->irq = qemu_allocate_irq(sp804_set_irq, s, 0); s->timer[1]->irq = qemu_allocate_irq(sp804_set_irq, s, 1); - vmstate_register(dev, -1, &vmstate_sp804, s); } /* Integrator/CP timer module. */ @@ -390,6 +389,7 @@ static void sp804_class_init(ObjectClass *klass, void *data) k->realize = sp804_realize; k->props = sp804_properties; + k->vmsd = &vmstate_sp804; } static const TypeInfo sp804_info = { From 7a53a140f067f7b65c661c33c882b80219f3bfc4 Mon Sep 17 00:00:00 2001 From: "xiaoqiang.zhao" Date: Thu, 18 Feb 2016 14:16:20 +0000 Subject: [PATCH 32/36] hw/timer: QOM'ify exynos4210_mct assign exynos4210_mct_init to exynos4210_mct_info.instance_init and drop the SysBusDeviceClass::init Reviewed-by: Peter Maydell Signed-off-by: xiaoqiang zhao Signed-off-by: Peter Maydell --- hw/timer/exynos4210_mct.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c index 73e547c91f..ae69345f0d 100644 --- a/hw/timer/exynos4210_mct.c +++ b/hw/timer/exynos4210_mct.c @@ -1422,10 +1422,11 @@ static const MemoryRegionOps exynos4210_mct_ops = { }; /* MCT init */ -static int exynos4210_mct_init(SysBusDevice *dev) +static void exynos4210_mct_init(Object *obj) { int i; - Exynos4210MCTState *s = EXYNOS4210_MCT(dev); + Exynos4210MCTState *s = EXYNOS4210_MCT(obj); + SysBusDevice *dev = SYS_BUS_DEVICE(obj); QEMUBH *bh[2]; /* Global timer */ @@ -1450,19 +1451,15 @@ static int exynos4210_mct_init(SysBusDevice *dev) sysbus_init_irq(dev, &s->l_timer[i].irq); } - memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_mct_ops, s, + memory_region_init_io(&s->iomem, obj, &exynos4210_mct_ops, s, "exynos4210-mct", MCT_SFR_SIZE); sysbus_init_mmio(dev, &s->iomem); - - return 0; } static void exynos4210_mct_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); - SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass); - k->init = exynos4210_mct_init; dc->reset = exynos4210_mct_reset; dc->vmsd = &vmstate_exynos4210_mct_state; } @@ -1471,6 +1468,7 @@ static const TypeInfo exynos4210_mct_info = { .name = TYPE_EXYNOS4210_MCT, .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(Exynos4210MCTState), + .instance_init = exynos4210_mct_init, .class_init = exynos4210_mct_class_init, }; From ff6ee49511a51089d09d420bdb0272081e3ff8bf Mon Sep 17 00:00:00 2001 From: "xiaoqiang.zhao" Date: Thu, 18 Feb 2016 14:16:20 +0000 Subject: [PATCH 33/36] hw/timer: QOM'ify exynos4210_pwm assign exynos4210_pwm_init to exynos4210_pwm_info.instance_init and drop the SysBusDeviceClass::init Reviewed-by: Peter Maydell Signed-off-by: xiaoqiang zhao Signed-off-by: Peter Maydell --- hw/timer/exynos4210_pwm.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c index 38f941f441..0e9e2e9bf5 100644 --- a/hw/timer/exynos4210_pwm.c +++ b/hw/timer/exynos4210_pwm.c @@ -380,9 +380,10 @@ static const MemoryRegionOps exynos4210_pwm_ops = { /* * PWM timer initialization */ -static int exynos4210_pwm_init(SysBusDevice *dev) +static void exynos4210_pwm_init(Object *obj) { - Exynos4210PWMState *s = EXYNOS4210_PWM(dev); + Exynos4210PWMState *s = EXYNOS4210_PWM(obj); + SysBusDevice *dev = SYS_BUS_DEVICE(obj); int i; QEMUBH *bh; @@ -394,19 +395,15 @@ static int exynos4210_pwm_init(SysBusDevice *dev) s->timer[i].parent = s; } - memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_pwm_ops, s, + memory_region_init_io(&s->iomem, obj, &exynos4210_pwm_ops, s, "exynos4210-pwm", EXYNOS4210_PWM_REG_MEM_SIZE); sysbus_init_mmio(dev, &s->iomem); - - return 0; } static void exynos4210_pwm_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); - SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass); - k->init = exynos4210_pwm_init; dc->reset = exynos4210_pwm_reset; dc->vmsd = &vmstate_exynos4210_pwm_state; } @@ -415,6 +412,7 @@ static const TypeInfo exynos4210_pwm_info = { .name = TYPE_EXYNOS4210_PWM, .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(Exynos4210PWMState), + .instance_init = exynos4210_pwm_init, .class_init = exynos4210_pwm_class_init, }; From c9d64639dd7a96faa57449aef2cccb228ba39397 Mon Sep 17 00:00:00 2001 From: "xiaoqiang.zhao" Date: Thu, 18 Feb 2016 14:16:21 +0000 Subject: [PATCH 34/36] hw/timer: QOM'ify exynos4210_rtc assign exynos4210_rtc_init to exynos4210_rtc_info.instance_init and drop the SysBusDeviceClass::init Reviewed-by: Peter Maydell Signed-off-by: xiaoqiang zhao Signed-off-by: Peter Maydell --- hw/timer/exynos4210_rtc.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c index 33413039aa..f21fb54f5c 100644 --- a/hw/timer/exynos4210_rtc.c +++ b/hw/timer/exynos4210_rtc.c @@ -547,9 +547,10 @@ static const MemoryRegionOps exynos4210_rtc_ops = { /* * RTC timer initialization */ -static int exynos4210_rtc_init(SysBusDevice *dev) +static void exynos4210_rtc_init(Object *obj) { - Exynos4210RTCState *s = EXYNOS4210_RTC(dev); + Exynos4210RTCState *s = EXYNOS4210_RTC(obj); + SysBusDevice *dev = SYS_BUS_DEVICE(obj); QEMUBH *bh; bh = qemu_bh_new(exynos4210_rtc_tick, s); @@ -564,19 +565,15 @@ static int exynos4210_rtc_init(SysBusDevice *dev) sysbus_init_irq(dev, &s->alm_irq); sysbus_init_irq(dev, &s->tick_irq); - memory_region_init_io(&s->iomem, OBJECT(s), &exynos4210_rtc_ops, s, + memory_region_init_io(&s->iomem, obj, &exynos4210_rtc_ops, s, "exynos4210-rtc", EXYNOS4210_RTC_REG_MEM_SIZE); sysbus_init_mmio(dev, &s->iomem); - - return 0; } static void exynos4210_rtc_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); - SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass); - k->init = exynos4210_rtc_init; dc->reset = exynos4210_rtc_reset; dc->vmsd = &vmstate_exynos4210_rtc_state; } @@ -585,6 +582,7 @@ static const TypeInfo exynos4210_rtc_info = { .name = TYPE_EXYNOS4210_RTC, .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(Exynos4210RTCState), + .instance_init = exynos4210_rtc_init, .class_init = exynos4210_rtc_class_init, }; From 81dcc49463aa673f6cdad0ebc24cd66f6b98764b Mon Sep 17 00:00:00 2001 From: "xiaoqiang.zhao" Date: Thu, 18 Feb 2016 14:16:21 +0000 Subject: [PATCH 35/36] hw/timer: QOM'ify pl031 assign pl031_init to pl031_info.instance_init and drop the SysBusDeviceClass::init Reviewed-by: Peter Maydell Signed-off-by: xiaoqiang zhao Signed-off-by: Peter Maydell --- hw/timer/pl031.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/hw/timer/pl031.c b/hw/timer/pl031.c index d99d18ce51..3ccb2cb460 100644 --- a/hw/timer/pl031.c +++ b/hw/timer/pl031.c @@ -192,12 +192,13 @@ static const MemoryRegionOps pl031_ops = { .endianness = DEVICE_NATIVE_ENDIAN, }; -static int pl031_init(SysBusDevice *dev) +static void pl031_init(Object *obj) { - PL031State *s = PL031(dev); + PL031State *s = PL031(obj); + SysBusDevice *dev = SYS_BUS_DEVICE(obj); struct tm tm; - memory_region_init_io(&s->iomem, OBJECT(s), &pl031_ops, s, "pl031", 0x1000); + memory_region_init_io(&s->iomem, obj, &pl031_ops, s, "pl031", 0x1000); sysbus_init_mmio(dev, &s->iomem); sysbus_init_irq(dev, &s->irq); @@ -206,7 +207,6 @@ static int pl031_init(SysBusDevice *dev) qemu_clock_get_ns(rtc_clock) / get_ticks_per_sec(); s->timer = timer_new_ns(rtc_clock, pl031_interrupt, s); - return 0; } static void pl031_pre_save(void *opaque) @@ -249,9 +249,7 @@ static const VMStateDescription vmstate_pl031 = { static void pl031_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); - SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass); - k->init = pl031_init; dc->vmsd = &vmstate_pl031; } @@ -259,6 +257,7 @@ static const TypeInfo pl031_info = { .name = TYPE_PL031, .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(PL031State), + .instance_init = pl031_init, .class_init = pl031_class_init, }; From 5d83e348e7f6499f27b6431b0d91af8dcfb06763 Mon Sep 17 00:00:00 2001 From: "xiaoqiang.zhao" Date: Thu, 18 Feb 2016 14:16:21 +0000 Subject: [PATCH 36/36] hw/timer: QOM'ify pxa2xx_timer * split the old SysBus init function into an instance_init and a Device realize function * use DeviceClass::realize instead of SysBusDeviceClass::init Reviewed-by: Peter Maydell Signed-off-by: xiaoqiang zhao Signed-off-by: Peter Maydell --- hw/timer/pxa2xx_timer.c | 36 +++++++++++++++++++++--------------- 1 file changed, 21 insertions(+), 15 deletions(-) diff --git a/hw/timer/pxa2xx_timer.c b/hw/timer/pxa2xx_timer.c index 0daa69c6b9..33449e66b5 100644 --- a/hw/timer/pxa2xx_timer.c +++ b/hw/timer/pxa2xx_timer.c @@ -433,10 +433,10 @@ static int pxa25x_timer_post_load(void *opaque, int version_id) return 0; } -static int pxa2xx_timer_init(SysBusDevice *dev) +static void pxa2xx_timer_init(Object *obj) { - PXA2xxTimerInfo *s = PXA2XX_TIMER(dev); - int i; + PXA2xxTimerInfo *s = PXA2XX_TIMER(obj); + SysBusDevice *dev = SYS_BUS_DEVICE(obj); s->irq_enabled = 0; s->oldclock = 0; @@ -444,16 +444,28 @@ static int pxa2xx_timer_init(SysBusDevice *dev) s->lastload = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); s->reset3 = 0; + memory_region_init_io(&s->iomem, obj, &pxa2xx_timer_ops, s, + "pxa2xx-timer", 0x00001000); + sysbus_init_mmio(dev, &s->iomem); +} + +static void pxa2xx_timer_realize(DeviceState *dev, Error **errp) +{ + PXA2xxTimerInfo *s = PXA2XX_TIMER(dev); + SysBusDevice *sbd = SYS_BUS_DEVICE(dev); + int i; + for (i = 0; i < 4; i ++) { s->timer[i].value = 0; - sysbus_init_irq(dev, &s->timer[i].irq); + sysbus_init_irq(sbd, &s->timer[i].irq); s->timer[i].info = s; s->timer[i].num = i; s->timer[i].qtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, - pxa2xx_timer_tick, &s->timer[i]); + pxa2xx_timer_tick, &s->timer[i]); } + if (s->flags & (1 << PXA2XX_TIMER_HAVE_TM4)) { - sysbus_init_irq(dev, &s->irq4); + sysbus_init_irq(sbd, &s->irq4); for (i = 0; i < 8; i ++) { s->tm4[i].tm.value = 0; @@ -462,15 +474,9 @@ static int pxa2xx_timer_init(SysBusDevice *dev) s->tm4[i].freq = 0; s->tm4[i].control = 0x0; s->tm4[i].tm.qtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, - pxa2xx_timer_tick4, &s->tm4[i]); + pxa2xx_timer_tick4, &s->tm4[i]); } } - - memory_region_init_io(&s->iomem, OBJECT(s), &pxa2xx_timer_ops, s, - "pxa2xx-timer", 0x00001000); - sysbus_init_mmio(dev, &s->iomem); - - return 0; } static const VMStateDescription vmstate_pxa2xx_timer0_regs = { @@ -573,9 +579,8 @@ static const TypeInfo pxa27x_timer_dev_info = { static void pxa2xx_timer_class_init(ObjectClass *oc, void *data) { DeviceClass *dc = DEVICE_CLASS(oc); - SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(oc); - sdc->init = pxa2xx_timer_init; + dc->realize = pxa2xx_timer_realize; dc->vmsd = &vmstate_pxa2xx_timer_regs; } @@ -583,6 +588,7 @@ static const TypeInfo pxa2xx_timer_type_info = { .name = TYPE_PXA2XX_TIMER, .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(PXA2xxTimerInfo), + .instance_init = pxa2xx_timer_init, .abstract = true, .class_init = pxa2xx_timer_class_init, };