The Aspeed SMC controllers have a mode (Command mode) in which
accesses to the flash content are no different than doing MMIOs. The
controller generates all the necessary commands to load (or store)
data in memory.

However, accesses are restricted to the segment window assigned the
the flash module by the controller. This window is defined by the
Segment Address Register.
Signed-off-by: NCédric Le Goater <clg@kaod.org>
Reviewed-by: NAndrew Jeffery <andrew@aj.id.au>
Message-id: 1483979087-32663-8-git-send-email-clg@kaod.org
[PMM: Deleted now-unused aspeed_smc_is_usermode() function]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The SPI controller of the AST2400 SoC has less registers. So we can
adjust the size of the memory region holding the registers depending
on the controller type. We can also remove the guest_error logging
which is useless as the range of the region is strict enough.
Signed-off-by: NCédric Le Goater <clg@kaod.org>
Reviewed-by: NJoel Stanley <joel@jms.id.au>
Message-id: 1483979087-32663-7-git-send-email-clg@kaod.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This is getting difficult to read. Also add a 'has_dma' field for each
controller type.
Signed-off-by: NCédric Le Goater <clg@kaod.org>
Reviewed-by: NJoel Stanley <joel@jms.id.au>
Reviewed-by: NAndrew Jeffery <andrew@aj.id.au>
Message-id: 1483979087-32663-6-git-send-email-clg@kaod.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

On the AST2500 SoC, the FMC controller flash type is fixed to SPI for
CE0 and CE1 and 4BYTE mode is autodetected for CE0.

On the AST2400 SoC, the FMC controller flash type and 4BYTE mode are
strapped with register SCU70. We use the default settings from the
palmetto-bmc machine for now.
Signed-off-by: NCédric Le Goater <clg@kaod.org>
Reviewed-by: NJoel Stanley <joel@jms.id.au>
Reviewed-by: NAndrew Jeffery <andrew@aj.id.au>
Message-id: 1483979087-32663-5-git-send-email-clg@kaod.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Change the routines prototype to use a 'AspeedSMCFlash *' instead of
'AspeedSMCState *'. The result will help in making future changes
clearer.

Also change aspeed_smc_update_cs() which uselessly loops on all slave
devices to update their status.
Signed-off-by: NCédric Le Goater <clg@kaod.org>
Reviewed-by: NJoel Stanley <joel@jms.id.au>
Reviewed-by: NAndrew Jeffery <andrew@aj.id.au>
Message-id: 1483979087-32663-4-git-send-email-clg@kaod.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Instead, we can simply set the irq level when unselecting the slave
devices. This change prepares ground for a subsequent cleanup of the
aspeed_smc_update_cs() routine which uselessly loops on all slaves to
update their status.
Signed-off-by: NCédric Le Goater <clg@kaod.org>
Message-id: 1483979087-32663-3-git-send-email-clg@kaod.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This is useless as reset will be called later on.
Signed-off-by: NCédric Le Goater <clg@kaod.org>
Acked-by: NMarcin Krzemiński <mar.krzeminski@gmail.com>
Message-id: 1483979087-32663-2-git-send-email-clg@kaod.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The DBGVCR_EL2 system register is needed to run a 32-bit
EL1 guest under a Linux EL2 64-bit hypervisor. Its only
purpose is to provide AArch64 with access to the state of
the DBGVCR AArch32 register. Since we only have a dummy
DBGVCR, implement a corresponding dummy DBGVCR32_EL2.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>

To run a VM in 32-bit EL1 our AArch32 interrupt handling code
needs to be able to cope with VIRQ and VFIQ exceptions.
These behave like IRQ and FIQ except that we don't need to try
to route them to Monitor mode.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>

n25q00 and mt25q01 devices share the same JEDEC ID. The difference
between those two devices is number of dies and one bit in extended
JEDEC bytes. This commit adds proper entry for both devices by
introduction the number of dies and and new 25q00 entries.
Signed-off-by: NMarcin Krzeminski <mar.krzeminski@gmail.com>
Reviewed-by: NCédric Le Goater <clg@kaod.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20170108083854.5006-4-mar.krzeminski@gmail.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Modern big flash NOR devices consist of more than one die.
Some of them do not support chip erase and instead have a die
erase command that can erase one die only. This commit adds
support for defining the number of dies in the chip, and adds
support for die erase command.

The NOR flash model is not strict, so no option to
disable chip erase has been added.
Signed-off-by: NMarcin Krzeminski <mar.krzeminski@gmail.com>
Reviewed-by: NCédric Le Goater <clg@kaod.org>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20170108083854.5006-3-mar.krzeminski@gmail.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Some flash chips have additional page program opcode that
takes only 4 byte address. This commit adds support
for such command in Qemu.
Signed-off-by: NMarcin Krzeminski <mar.krzeminski@gmail.com>
Reviewed-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20170108083854.5006-2-mar.krzeminski@gmail.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The imx25 chip provides 3 i2c buses, but they have all been named
"i2c", which makes it difficult to predict which bus a device will
be connected to when specified on the command line.

This patch addresses the issue by naming the buses uniquely:
  i2c-bus.0 i2c-bus.1 i2c-bus.2
Signed-off-by: NAlastair D'Silva <alastair@d-silva.org>
Message-id: 20170105043430.3176-2-alastair@au1.ibm.com
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

add OpenSPARC T1 emulation

# gpg: Signature made Wed 18 Jan 2017 22:25:47 GMT
# gpg:                using RSA key 0x3360C3F7411A125F
# gpg: Good signature from "Artyom Tarasenko <atar4qemu@gmail.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 2AD8 6149 17F4 B2D7 05C0  BB12 3360 C3F7 411A 125F

* remotes/artyom/tags/pull-sun4v-20170118: (30 commits)
  target-sparc: fix up niagara machine
  target-sparc: move common cpu initialisation routines to sparc64.c
  target-sparc: implement sun4v RTC
  target-sparc: add ST_BLKINIT_ ASIs for UA2005+ CPUs
  target-sparc: store the UA2005 entries in sun4u format
  target-sparc: implement UA2005 ASI_MMU (0x21)
  target-sparc: add more registers to dump_mmu
  target-sparc: implement auto-demapping for UA2005 CPUs
  target-sparc: allow 256M sized pages
  target-sparc: simplify ultrasparc_tsb_pointer
  target-sparc: implement UA2005 TSB Pointers
  target-sparc: use SparcV9MMU type for sparc64 I/D-MMUs
  target-sparc: replace the last tlb entry when no free entries left
  target-sparc: ignore writes to UA2005 CPU mondo queue register
  target-sparc: allow priveleged ASIs in hyperprivileged mode
  target-sparc: use direct address translation in hyperprivileged mode
  target-sparc: fix immediate UA2005 traps
  target-sparc: implement UA2005 rdhpstate and wrhpstate instructions
  target-sparc: implement UA2005 GL register
  target-sparc: implement UA2005 hypervisor traps
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

tcg/i386 fixes

# gpg: Signature made Tue 17 Jan 2017 22:58:04 GMT
# gpg:                using RSA key 0xAD1270CC4DD0279B
# gpg: Good signature from "Richard Henderson <rth7680@gmail.com>"
# gpg:                 aka "Richard Henderson <rth@redhat.com>"
# gpg:                 aka "Richard Henderson <rth@twiddle.net>"
# Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC  16A4 AD12 70CC 4DD0 279B

* remotes/rth/tags/pull-tcg-20170117:
  tcg/i386: Always use TZCNT when available
  Revert "tcg/i386: Rely on undefined/undocumented behaviour of BSF/BSR"
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Remove the Niagara stub implementation from sun4u.c and add a machine,
compatible with Legion simulator from the OpenSPARC T1 project.

The machine uses the firmware supplied with the OpenSPARC T1 project,
http://download.oracle.com/technetwork/systems/opensparc/OpenSPARCT1_Arch.1.5.tar.bz2
in the directory S10image/, and is able to boot the supplied Solaris 10 image.

Note that for compatibility with the naming conventions for SPARC machines
the new machine name is lowercase niagara.
Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

In OpenSPARC T1+ TWINX ASIs in store instructions are aliased
with Block Initializing Store ASIs.

"UltraSPARC T1 Supplement Draft D2.1, 14 May 2007" describes them
in the chapter "5.9 Block Initializing Store ASIs"

Integer stores of all sizes are allowed with these ASIs.
Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

According to chapter 13.3 of the
UltraSPARC T1 Supplement to the UltraSPARC Architecture 2005,
only the sun4u format is available for data-access loads.

Store UA2005 entries in the sun4u format to simplify processing.
Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Implement the behavior described in the chapter 13.9.11 of
UltraSPARC T1™ Supplement to the UltraSPARC Architecture 2005:

"If a TLB Data-In replacement is attempted with all TLB
entries locked and valid, the last TLB entry (entry 63) is
replaced."
Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Please note that QEMU doesn't impelement Real->Physical address
translation. The "Real Address" is always the "Physical Address".
Suggested-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Accordinf to UA2005, 9.3.3 "Address Space Identifiers",

"In hyperprivileged mode, all instruction fetches and loads and stores with implicit
ASIs use a physical address, regardless of the value of TL".
Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>

As described in Chapter 5.7.6 of the UltraSPARC Architecture 2005,
outstanding disrupting exceptions that are destined for privileged mode can only
cause a trap when the virtual processor is in nonprivileged or privileged mode and
PSTATE.ie = 1. At all other times, they are held pending.
Signed-off-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NRichard Henderson <rth@twiddle.net>