ARM pullreq; contains some patches that arrived while I

was on holiday, plus the series I sent off before going

away, which got reviewed while I was away.

The following changes since commit c077a998eb3fcae2d048e3baeb5bc592d30fddde:

Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20170531' into staging (2017-06-01 15:50:40 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170601

for you to fetch changes up to cdc58be430b0bdeaef282e2e70f8135ae531616d:

hw/arm/virt: fdt: generate distance-map when needed (2017-06-01 17:27:07 +0100)

* virt: numa: provide ACPI distance info when needed

* aspeed: fix i2c controller bugs

* aspeed: add temperature sensor device

* M profile: support MPU

* gicv3: fix mishandling of BPR1, VBPR1

* load_uboot_image: don't assume a full header read

* libvixl: Correct build failures on NetBSD

Andrew Jones (3):

load_uboot_image: don't assume a full header read

hw/arm/virt-acpi-build: build SLIT when needed

hw/arm/virt: fdt: generate distance-map when needed

Cédric Le Goater (6):

aspeed/i2c: improve command handling

aspeed/i2c: handle LAST command under the RX command

aspeed/i2c: introduce a state machine

aspeed: add some I2C devices to the Aspeed machines

hw/misc: add a TMP42{1,2,3} device model

aspeed: add a temp sensor device on I2C bus 3

Kamil Rytarowski (1):

libvixl: Correct build failures on NetBSD

Michael Davidsaver (4):

armv7m: Improve "-d mmu" tracing for PMSAv7 MPU

armv7m: Implement M profile default memory map

armv7m: Classify faults as MemManage or BusFault

arm: add MPU support to M profile CPUs

Peter Maydell (12):

hw/intc/arm_gicv3_cpuif: Fix reset value for VMCR_EL2.VBPR1

hw/intc/arm_gicv3_cpuif: Don't let BPR be set below its minimum

hw/intc/arm_gicv3_cpuif: Fix priority masking for NS BPR1

arm: Use the mmu_idx we're passed in arm_cpu_do_unaligned_access()

arm: Add support for M profile CPUs having different MMU index semantics

arm: Use different ARMMMUIdx values for M profile

arm: Clean up handling of no-MPU PMSA CPUs

arm: Don't clear ARM_FEATURE_PMSA for no-mpu configs

arm: Don't let no-MPU PMSA cores write to SCTLR.M

arm: Remove unnecessary check on cpu->pmsav7_dregion

arm: All M profile cores are PMSA

arm: Implement HFNMIENA support for M profile MPU

target/arm: clear PMUVER field of AA64DFR0 when vPMU=off

disas/libvixl/Makefile.objs | 3 +

hw/misc/Makefile.objs | 1 +

target/arm/cpu.h | 118 ++++++++++--

target/arm/translate.h | 2 +-

hw/arm/aspeed.c | 36 ++++

hw/arm/virt-acpi-build.c | 4 +

hw/arm/virt.c | 21 +++

hw/core/loader.c | 3 +-

hw/i2c/aspeed_i2c.c | 65 ++++++-

hw/intc/arm_gicv3_cpuif.c | 50 ++++-

hw/intc/armv7m_nvic.c | 104 +++++++++++

hw/misc/tmp421.c | 401 ++++++++++++++++++++++++++++++++++++++++

target/arm/cpu.c | 28 ++-

target/arm/helper.c | 338 ++++++++++++++++++++++-----------

target/arm/machine.c | 7 +-

target/arm/op_helper.c | 3 +-

target/arm/translate-a64.c | 18 +-

target/arm/translate.c | 14 +-

default-configs/arm-softmmu.mak | 1 +

19 files changed, 1060 insertions(+), 157 deletions(-)

create mode 100644 hw/misc/tmp421.c

From: Andrew Jones <drjones@redhat.com>

Don't allow load_uboot_image() to proceed when less bytes than

header-size was read.

Signed-off-by: Andrew Jones <drjones@redhat.com>

Message-id: 20170524091315.20284-1-drjones@redhat.com

hw/core/loader.c | 3 ++-

1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/core/loader.c b/hw/core/loader.c

--- a/hw/core/loader.c

+++ b/hw/core/loader.c

@@ -XXX,XX +XXX,XX @@ static int load_uboot_image(const char *filename, hwaddr *ep, hwaddr *loadaddr,

return -1;

size = read(fd, hdr, sizeof(uboot_image_header_t));

- if (size < 0)

+ if (size < sizeof(uboot_image_header_t)) {

goto out;

+ }

bswap_uboot_header(hdr);

2.7.4

The PMUv3 driver of linux kernel (in arch/arm64/kernel/perf_event.c)

relies on the PMUVER field of id_aa64dfr0_el1 to decide if PMU support

is present or not. This patch clears the PMUVER field under TCG mode

when vPMU=off. Without it, PMUv3 will init insider guest VMs even

with vPMU=off. This patch also removes a redundant line inside the

if-statement.

Message-id: 1495123889-32301-1-git-send-email-wei@redhat.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

target/arm/cpu.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)

}

if (!cpu->has_pmu) {

- cpu->has_pmu = false;

unset_feature(env, ARM_FEATURE_PMU);

+ cpu->id_aa64dfr0 &= ~0xf00;

}

if (!arm_feature(env, ARM_FEATURE_EL2)) {

2.7.4

From: Andrew Jones <drjones@redhat.com>

This is based on patch Shannon Zhao originally posted.

Cc: Shannon Zhao <zhaoshenglong@huawei.com>

Signed-off-by: Andrew Jones <drjones@redhat.com>

Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>

Message-id: 20170529173751.3443-3-drjones@redhat.com

hw/arm/virt.c | 21 +++++++++++++++++++++

1 file changed, 21 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void create_fdt(VirtMachineState *vms)

"clk24mhz");

qemu_fdt_setprop_cell(fdt, "/apb-pclk", "phandle", vms->clock_phandle);

+ if (have_numa_distance) {

+ int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);

+ uint32_t *matrix = g_malloc0(size);

+ int idx, i, j;

+

+ for (i = 0; i < nb_numa_nodes; i++) {

+ for (j = 0; j < nb_numa_nodes; j++) {

+ idx = (i * nb_numa_nodes + j) * 3;

+ matrix[idx + 0] = cpu_to_be32(i);

+ matrix[idx + 1] = cpu_to_be32(j);

+ matrix[idx + 2] = cpu_to_be32(numa_info[i].distance[j]);

+ }

+ }

+

+ qemu_fdt_add_subnode(fdt, "/distance-map");

+ qemu_fdt_setprop_string(fdt, "/distance-map", "compatible",

+ "numa-distance-map-v1");

+ qemu_fdt_setprop(fdt, "/distance-map", "distance-matrix",

+ matrix, size);

+ g_free(matrix);

+ }

static void fdt_add_psci_node(const VirtMachineState *vms)

2.7.4

From: Kamil Rytarowski <n54@gmx.com>

Ensure that C99 macros are defined regardless of the inclusion order of

headers in vixl. This is required at least on NetBSD.

The vixl/globals.h headers defines __STDC_CONSTANT_MACROS and must be

included before other system headers.

This file defines unconditionally the following macros, without altering

the original sources:

- __STDC_CONSTANT_MACROS

- __STDC_LIMIT_MACROS

- __STDC_FORMAT_MACROS

Signed-off-by: Kamil Rytarowski <n54@gmx.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20170514051820.15985-1-n54@gmx.com

disas/libvixl/Makefile.objs | 3 +++

1 file changed, 3 insertions(+)

diff --git a/disas/libvixl/Makefile.objs b/disas/libvixl/Makefile.objs

--- a/disas/libvixl/Makefile.objs

+++ b/disas/libvixl/Makefile.objs

@@ -XXX,XX +XXX,XX @@ libvixl_OBJS = vixl/utils.o \

# The -Wno-sign-compare is needed only for gcc 4.6, which complains about

# some signed-unsigned equality comparisons which later gcc versions do not.

$(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS := -I$(SRC_PATH)/disas/libvixl $(QEMU_CFLAGS) -Wno-sign-compare

+# Ensure that C99 macros are defined regardless of the inclusion order of

+# headers in vixl. This is required at least on NetBSD.

+$(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS += -D__STDC_CONSTANT_MACROS -D__STDC_LIMIT_MACROS -D__STDC_FORMAT_MACROS

common-obj-$(CONFIG_ARM_A64_DIS) += $(libvixl_OBJS)

2.7.4

Implement HFNMIENA support for the M profile MPU. This bit controls

whether the MPU is treated as enabled when executing at execution

priorities of less than zero (in NMI, HardFault or with the FAULTMASK

bit set).

Doing this requires us to use a different MMU index for "running

at execution priority < 0", because we will have different

access permissions for that case versus the normal case.

Message-id: 1493122030-32191-14-git-send-email-peter.maydell@linaro.org

target/arm/cpu.h | 24 +++++++++++++++++++++++-

target/arm/helper.c | 18 +++++++++++++++++-

target/arm/translate.c | 1 +

3 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,

* for the accesses done as part of a stage 1 page table walk, rather than

* having to walk the stage 2 page table over and over.)

*

+ * R profile CPUs have an MPU, but can use the same set of MMU indexes

+ * as A profile. They only need to distinguish NS EL0 and NS EL1 (and

+ * NS EL2 if we ever model a Cortex-R52).

+ *

+ * M profile CPUs are rather different as they do not have a true MMU.

+ * They have the following different MMU indexes:

+ * User

+ * Privileged

+ * Execution priority negative (this is like privileged, but the

+ * MPU HFNMIENA bit means that it may have different access permission

+ * check results to normal privileged code, so can't share a TLB).

+ *

* The ARMMMUIdx and the mmu index value used by the core QEMU TLB code

* are not quite the same -- different CPU types (most notably M profile

* vs A/R profile) would like to use MMU indexes with different semantics,

@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {

ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A,

ARMMMUIdx_MUser = 0 | ARM_MMU_IDX_M,

ARMMMUIdx_MPriv = 1 | ARM_MMU_IDX_M,

+ ARMMMUIdx_MNegPri = 2 | ARM_MMU_IDX_M,

/* Indexes below here don't have TLBs and are used only for AT system

* instructions or for the first stage of an S12 page table walk.

*/

@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {

ARMMMUIdxBit_S2NS = 1 << 6,

ARMMMUIdxBit_MUser = 1 << 0,

ARMMMUIdxBit_MPriv = 1 << 1,

+ ARMMMUIdxBit_MNegPri = 1 << 2,

} ARMMMUIdxBit;

#define MMU_USER_IDX 0

@@ -XXX,XX +XXX,XX @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)

case ARM_MMU_IDX_A:

return mmu_idx & 3;

case ARM_MMU_IDX_M:

- return mmu_idx & 1;

+ return mmu_idx == ARMMMUIdx_MUser ? 0 : 1;

default:

g_assert_not_reached();

}

@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)

if (arm_feature(env, ARM_FEATURE_M)) {

ARMMMUIdx mmu_idx = el == 0 ? ARMMMUIdx_MUser : ARMMMUIdx_MPriv;

+ /* Execution priority is negative if FAULTMASK is set or

+ * we're in a HardFault or NMI handler.

+ if ((env->v7m.exception > 0 && env->v7m.exception <= 3)

+ || env->daif & PSTATE_F) {

+ return arm_to_core_mmu_idx(ARMMMUIdx_MNegPri);

+ }

+

return arm_to_core_mmu_idx(mmu_idx);

}

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)

case ARMMMUIdx_S1NSE0:

case ARMMMUIdx_S1NSE1:

case ARMMMUIdx_MPriv:

+ case ARMMMUIdx_MNegPri:

case ARMMMUIdx_MUser:

return 1;

default:

@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)

case ARMMMUIdx_S1E2:

case ARMMMUIdx_S2NS:

case ARMMMUIdx_MPriv:

+ case ARMMMUIdx_MNegPri:

case ARMMMUIdx_MUser:

return false;

case ARMMMUIdx_S1E3:

@@ -XXX,XX +XXX,XX @@ static inline bool regime_translation_disabled(CPUARMState *env,

ARMMMUIdx mmu_idx)

{

if (arm_feature(env, ARM_FEATURE_M)) {

- return !(env->v7m.mpu_ctrl & R_V7M_MPU_CTRL_ENABLE_MASK);

+ switch (env->v7m.mpu_ctrl &

+ (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {

+ case R_V7M_MPU_CTRL_ENABLE_MASK:

+ /* Enabled, but not for HardFault and NMI */

+ return mmu_idx == ARMMMUIdx_MNegPri;

+ case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK:

+ /* Enabled for all cases */

+ return false;

+ case 0:

+ default:

+ /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but

+ * we warned about that in armv7m_nvic.c when the guest set it.

+ */

+ return true;

+ }

}

if (mmu_idx == ARMMMUIdx_S2NS) {

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)

return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0);

case ARMMMUIdx_MUser:

case ARMMMUIdx_MPriv:

+ case ARMMMUIdx_MNegPri:

return arm_to_core_mmu_idx(ARMMMUIdx_MUser);

case ARMMMUIdx_S2NS:

default:

2.7.4

All M profile CPUs are PMSA, so set the feature bit.

(We haven't actually implemented the M profile MPU register

interface yet, but setting this feature bit gives us closer

to correct behaviour for the MPU-disabled case.)

Message-id: 1493122030-32191-11-git-send-email-peter.maydell@linaro.org

target/arm/cpu.c | 8 ++++++++

1 file changed, 8 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)

{

ARMCPU *cpu = ARM_CPU(obj);

+ /* M profile implies PMSA. We have to do this here rather than

+ * in realize with the other feature-implication checks because

+ * we look at the PMSA bit to see if we should add some properties.

+ */

+ if (arm_feature(&cpu->env, ARM_FEATURE_M)) {

+ set_feature(&cpu->env, ARM_FEATURE_PMSA);

+ }

+

if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||

arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {

qdev_property_add_static(DEVICE(obj), &arm_cpu_reset_cbar_property,

2.7.4

If the CPU is a PMSA config with no MPU implemented, then the

SCTLR.M bit should be RAZ/WI, so that the guest can never

turn on the non-existent MPU.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 1493122030-32191-7-git-send-email-peter.maydell@linaro.org

target/arm/helper.c | 5 +++++

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,

return;

}

+ if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {

+ /* M bit is RAZ/WI for PMSA with no MPU implemented */

+ value &= ~SCTLR_M;

+ }

raw_write(env, ri, value);

/* ??? Lots of these bits are not implemented. */

/* This may enable/disable the MMU, so do a TLB flush. */

2.7.4

When identifying the DFSR format for an alignment fault, use

the mmu index that we are passed, rather than calling cpu_mmu_index()

to get the mmu index for the current CPU state. This doesn't actually

make any difference since the only cases where the current MMU index

differs from the index used for the load are the "unprivileged

load/store" instructions, and in that case the mmu index may

differ but the translation regime is the same (apart from the

"use from Hyp mode" case which is UNPREDICTABLE).

However it's the more logical thing to do.

Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>

Message-id: 1493122030-32191-2-git-send-email-peter.maydell@linaro.org

target/arm/op_helper.c | 2 +-

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c

--- a/target/arm/op_helper.c

+++ b/target/arm/op_helper.c

@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,

/* the DFSR for an alignment fault depends on whether we're using

* the LPAE long descriptor format, or the short descriptor format

*/

- if (arm_s1_regime_using_lpae_format(env, cpu_mmu_index(env, false))) {

+ if (arm_s1_regime_using_lpae_format(env, mmu_idx)) {

env->exception.fsr = (1 << 9) | 0x21;

} else {

env->exception.fsr = 0x1;

2.7.4

When we calculate the mask to use to get the group priority from

an interrupt priority, the way that NS BPR1 is handled differs

from how BPR0 and S BPR1 work -- a BPR1 value of 1 means

the group priority is in bits [7:1], whereas for BPR0 and S BPR1

this is indicated by a 0 BPR value.

Subtract 1 from the BPR value before creating the mask if

we're using the NS BPR value, for both hardware and virtual

interrupts, as the GICv3 pseudocode does, and fix the comments

accordingly.

Message-id: 1493226792-3237-4-git-send-email-peter.maydell@linaro.org

hw/intc/arm_gicv3_cpuif.c | 42 ++++++++++++++++++++++++++++++++++++++----

1 file changed, 38 insertions(+), 4 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c

--- a/hw/intc/arm_gicv3_cpuif.c

+++ b/hw/intc/arm_gicv3_cpuif.c

@@ -XXX,XX +XXX,XX @@ static uint32_t icv_gprio_mask(GICv3CPUState *cs, int group)

/* Return a mask word which clears the subpriority bits from

* a priority value for a virtual interrupt in the specified group.

- * This depends on the VBPR value:

+ * This depends on the VBPR value.

+ * If using VBPR0 then:

* a BPR of 0 means the group priority bits are [7:1];

* a BPR of 1 means they are [7:2], and so on down to

* a BPR of 7 meaning no group priority bits at all.

+ * If using VBPR1 then:

+ * a BPR of 0 is impossible (the minimum value is 1)

+ * a BPR of 1 means the group priority bits are [7:1];

+ * a BPR of 2 means they are [7:2], and so on down to

+ * a BPR of 7 meaning the group priority is [7].

+ *

* Which BPR to use depends on the group of the interrupt and

* the current ICH_VMCR_EL2.VCBPR settings.

+ *

+ * This corresponds to the VGroupBits() pseudocode.

*/

+ int bpr;

+

if (group == GICV3_G1NS && cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {

group = GICV3_G0;

}

- return ~0U << (read_vbpr(cs, group) + 1);

+ bpr = read_vbpr(cs, group);

+ if (group == GICV3_G1NS) {

+ assert(bpr > 0);

+ bpr--;

+ }

+

+ return ~0U << (bpr + 1);

static bool icv_hppi_can_preempt(GICv3CPUState *cs, uint64_t lr)

@@ -XXX,XX +XXX,XX @@ static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)

{

/* Return a mask word which clears the subpriority bits from

* a priority value for an interrupt in the specified group.

- * This depends on the BPR value:

+ * This depends on the BPR value. For CBPR0 (S or NS):

* a BPR of 0 means the group priority bits are [7:1];

* a BPR of 1 means they are [7:2], and so on down to

* a BPR of 7 meaning no group priority bits at all.

+ * For CBPR1 NS:

+ * a BPR of 0 is impossible (the minimum value is 1)

+ * a BPR of 1 means the group priority bits are [7:1];

+ * a BPR of 2 means they are [7:2], and so on down to

+ * a BPR of 7 meaning the group priority is [7].

+ *

* Which BPR to use depends on the group of the interrupt and

* the current ICC_CTLR.CBPR settings.

+ *

+ * This corresponds to the GroupBits() pseudocode.

*/

+ int bpr;

+

if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) ||

(group == GICV3_G1NS &&

cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {

group = GICV3_G0;

}

- return ~0U << ((cs->icc_bpr[group] & 7) + 1);

+ bpr = cs->icc_bpr[group] & 7;

+

+ if (group == GICV3_G1NS) {

+ assert(bpr > 0);

+ bpr--;

+ }

+

+ return ~0U << (bpr + 1);

static bool icc_no_enabled_hppi(GICv3CPUState *cs)

2.7.4

From: Cédric Le Goater <clg@kaod.org>

Largely inspired by the TMP105 temperature sensor, here is a model for

the TMP42{1,2,3} temperature sensors.

Specs can be found here :

    http://www.ti.com/lit/gpn/tmp421

Signed-off-by: Cédric Le Goater <clg@kaod.org>

Message-id: 1494827476-1487-6-git-send-email-clg@kaod.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/misc/Makefile.objs | 1 +

hw/misc/tmp421.c | 401 ++++++++++++++++++++++++++++++++++++++++

default-configs/arm-softmmu.mak | 1 +

3 files changed, 403 insertions(+)

create mode 100644 hw/misc/tmp421.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs

--- a/hw/misc/Makefile.objs

+++ b/hw/misc/Makefile.objs

common-obj-$(CONFIG_APPLESMC) += applesmc.o

common-obj-$(CONFIG_MAX111X) += max111x.o

common-obj-$(CONFIG_TMP105) += tmp105.o

+common-obj-$(CONFIG_TMP421) += tmp421.o

common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o

common-obj-$(CONFIG_SGA) += sga.o

common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o

diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/hw/misc/tmp421.c

+/*

+ * Texas Instruments TMP421 temperature sensor.

+ *

+ * Copyright (c) 2016 IBM Corporation.

+ *

+ * Largely inspired by :

+ *

+ * Texas Instruments TMP105 temperature sensor.

+ *

+ * Copyright (C) 2008 Nokia Corporation

+ * Written by Andrzej Zaborowski <andrew@openedhand.com>

+ *

+ * This program is free software; you can redistribute it and/or

+ * modify it under the terms of the GNU General Public License as

+ * published by the Free Software Foundation; either version 2 or

+ * (at your option) version 3 of the License.

+ *

+ * This program is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

+ * GNU General Public License for more details.

+ *

+ * You should have received a copy of the GNU General Public License along

+ * with this program; if not, see <http://www.gnu.org/licenses/>.

+ */

+

+#include "qemu/osdep.h"

+#include "hw/hw.h"

+#include "hw/i2c/i2c.h"

+#include "qapi/error.h"

+#include "qapi/visitor.h"

+

+/* Manufacturer / Device ID's */

+#define TMP421_MANUFACTURER_ID 0x55

+#define TMP421_DEVICE_ID 0x21

+#define TMP422_DEVICE_ID 0x22

+#define TMP423_DEVICE_ID 0x23

+

+typedef struct DeviceInfo {

+ int model;

+typedef struct TMP421State {

+ /*< private >*/

+ I2CSlave i2c;

+ /*< public >*/

+

+ int16_t temperature[4];

+

+ uint8_t status;

+ uint8_t config[2];

+ uint8_t rate;

+

+ uint8_t len;

+ uint8_t buf[2];

+ uint8_t pointer;

+

+} TMP421State;

+

+typedef struct TMP421Class {

+ I2CSlaveClass parent_class;

+ DeviceInfo *dev;

+} TMP421Class;

+

+#define TYPE_TMP421 "tmp421-generic"

+#define TMP421(obj) OBJECT_CHECK(TMP421State, (obj), TYPE_TMP421)

+

+#define TMP421_CLASS(klass) \

+ OBJECT_CLASS_CHECK(TMP421Class, (klass), TYPE_TMP421)

+#define TMP421_GET_CLASS(obj) \

+ OBJECT_GET_CLASS(TMP421Class, (obj), TYPE_TMP421)

+

+/* the TMP421 registers */

+#define TMP421_STATUS_REG 0x08

+#define TMP421_STATUS_BUSY (1 << 7)

+#define TMP421_CONFIG_REG_1 0x09

+#define TMP421_CONFIG_RANGE (1 << 2)

+#define TMP421_CONFIG_SHUTDOWN (1 << 6)

+#define TMP421_CONFIG_REG_2 0x0A

+#define TMP421_CONFIG_RC (1 << 2)

+#define TMP421_CONFIG_LEN (1 << 3)

+#define TMP421_CONFIG_REN (1 << 4)

+#define TMP421_CONFIG_REN2 (1 << 5)

+#define TMP421_CONFIG_REN3 (1 << 6)

+

+#define TMP421_CONVERSION_RATE_REG 0x0B

+#define TMP421_ONE_SHOT 0x0F

+

+#define TMP421_RESET 0xFC

+#define TMP421_MANUFACTURER_ID_REG 0xFE

+#define TMP421_DEVICE_ID_REG 0xFF

+

+#define TMP421_TEMP_MSB0 0x00

+#define TMP421_TEMP_MSB1 0x01

+#define TMP421_TEMP_MSB2 0x02

+#define TMP421_TEMP_MSB3 0x03

+#define TMP421_TEMP_LSB0 0x10

+#define TMP421_TEMP_LSB1 0x11

+#define TMP421_TEMP_LSB2 0x12

+#define TMP421_TEMP_LSB3 0x13

+

+static const int32_t mins[2] = { -40000, -55000 };

+static const int32_t maxs[2] = { 127000, 150000 };

+

+static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,

+ void *opaque, Error **errp)

+{

+ TMP421State *s = TMP421(obj);

+ bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);

+ int offset = ext_range * 64 * 256;

+ int64_t value;

+ int tempid;

+

+ if (sscanf(name, "temperature%d", &tempid) != 1) {

+ error_setg(errp, "error reading %s: %m", name);

+ return;

+ }

+

+ if (tempid >= 4 || tempid < 0) {

+ error_setg(errp, "error reading %s", name);

+ return;

+ }

+

+ value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;

+

+ visit_type_int(v, name, &value, errp);

+}

+

+/* Units are 0.001 centigrades relative to 0 C. s->temperature is 8.8

+ * fixed point, so units are 1/256 centigrades. A simple ratio will do.

+ */

+static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,

+ void *opaque, Error **errp)

+{

+ TMP421State *s = TMP421(obj);

+ Error *local_err = NULL;

+ int64_t temp;

+ bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);

+ int offset = ext_range * 64 * 256;

+ int tempid;

+

+ visit_type_int(v, name, &temp, &local_err);

+ if (local_err) {

+ error_propagate(errp, local_err);

+ return;

+ }

+

+ if (temp >= maxs[ext_range] || temp < mins[ext_range]) {

+ error_setg(errp, "value %" PRId64 ".%03" PRIu64 " °C is out of range",

+ temp / 1000, temp % 1000);

+ return;

+ }

+

+ if (sscanf(name, "temperature%d", &tempid) != 1) {

+ error_setg(errp, "error reading %s: %m", name);

+ return;

+ }

+

+ if (tempid >= 4 || tempid < 0) {

+ error_setg(errp, "error reading %s", name);

+ return;

+ }

+

+ s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;

+}

+

+static void tmp421_read(TMP421State *s)

+{

+ TMP421Class *sc = TMP421_GET_CLASS(s);

+

+ s->len = 0;

+

+ switch (s->pointer) {

+ case TMP421_MANUFACTURER_ID_REG:

+ s->buf[s->len++] = TMP421_MANUFACTURER_ID;

+ break;

+ case TMP421_DEVICE_ID_REG:

+ s->buf[s->len++] = sc->dev->model;

+ break;

+ case TMP421_CONFIG_REG_1:

+ s->buf[s->len++] = s->config[0];

+ break;

+ case TMP421_CONFIG_REG_2:

+ s->buf[s->len++] = s->config[1];

+ break;

+ case TMP421_CONVERSION_RATE_REG:

+ s->buf[s->len++] = s->rate;

+ break;

+ case TMP421_STATUS_REG:

+ s->buf[s->len++] = s->status;

+ break;

+

+ /* FIXME: check for channel enablement in config registers */

+ case TMP421_TEMP_MSB0:

+ s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);

+ s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;

+ break;

+ case TMP421_TEMP_MSB1:

+ s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);

+ s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;

+ break;

+ case TMP421_TEMP_MSB2:

+ s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);

+ s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;

+ break;

+ case TMP421_TEMP_MSB3:

+ s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);

+ s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;

+ break;

+ case TMP421_TEMP_LSB0:

+ s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;

+ break;

+ case TMP421_TEMP_LSB1:

+ s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;

+ break;

+ case TMP421_TEMP_LSB2:

+ s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;

+ break;

+ case TMP421_TEMP_LSB3:

+ s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;

+ break;

+ }

+}

+

+static void tmp421_reset(I2CSlave *i2c);

+

+static void tmp421_write(TMP421State *s)

+{

+ switch (s->pointer) {

+ case TMP421_CONVERSION_RATE_REG:

+ s->rate = s->buf[0];

+ break;

+ case TMP421_CONFIG_REG_1:

+ s->config[0] = s->buf[0];

+ break;

+ case TMP421_CONFIG_REG_2:

+ s->config[1] = s->buf[0];

+ break;

+ case TMP421_RESET:

+ tmp421_reset(I2C_SLAVE(s));

+ break;

+ }

+}

+

+static int tmp421_rx(I2CSlave *i2c)

+{

+ TMP421State *s = TMP421(i2c);

+

+ if (s->len < 2) {

+ return s->buf[s->len++];

+ } else {

+ return 0xff;

+ }

+}