Series comparison

-[Qemu-devel] [PULL 00/26] target-arm queue
+[Qemu-devel] [PULL 00/12] target-arm queue
-ARM queue, various patches accumulated over the Christmas break.
+target-arm queue: mostly aspeed changes from Cédric.
+thanks
 -- PMM
-The following changes since commit 612061b277915fadd80631eb7a6926f48a110c44:
+The following changes since commit 85182c96de61f0b600bbe834d5a23e713162e892:
-  Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-01-10' into staging (2018-01-11 11:52:40 +0000)
+  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20190912a' into staging (2019-09-13 14:37:48 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180111
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190913
-for you to fetch changes up to 0cf09852015e47a5fbb974ff7ac320366afd21ee:
+for you to fetch changes up to 27a296fce9821e3608d537756cffa6e43a46df3b:
-  hw/intc/arm_gic: reserved register addresses are RAZ/WI (2018-01-11 13:25:40 +0000)
+  qemu-ga: Convert invocation documentation to rST (2019-09-13 16:05:01 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * add aarch64_be linux-user target
+ * aspeed: add a GPIO controller to the SoC
- * Virt: ACPI: fix qemu assert due to re-assigned table data address
+ * aspeed: Various refactorings
- * imx_fec: various bug fixes and cleanups
+ * aspeed: Improve DMA controller modelling
- * hw/timer/pxa2xx_timer: replace hw_error() -> qemu_log_mask()
+ * atomic_template: fix indentation in GEN_ATOMIC_HELPER
- * hw/sd/pxa2xx_mmci: add read/write() trace events
+ * qemu-ga: Convert invocation documentation to rST
  * linux-user/arm/nwfpe: Check coprocessor number for FPA emulation
  * target/arm: Make disas_thumb2_insn() generate its own UNDEF exceptions
  * hw/intc/arm_gicv3: Make reserved register addresses RAZ/WI
  * hw/intc/arm_gic: reserved register addresses are RAZ/WI
 ----------------------------------------------------------------
-Andrey Smirnov (11):
+Christian Svensson (1):
-      imx_fec: Do not link to netdev
+      aspeed/smc: Calculate checksum on normal DMA
       imx_fec: Refactor imx_eth_enable_rx()
       imx_fec: Change queue flushing heuristics
       imx_fec: Move Tx frame buffer away from the stack
       imx_fec: Use ENET_FTRL to determine truncation length
       imx_fec: Use MIN instead of explicit ternary operator
       imx_fec: Emulate SHIFT16 in ENETx_RACC
       imx_fec: Add support for multiple Tx DMA rings
       imx_fec: Use correct length for packet size
       imx_fec: Fix a typo in imx_enet_receive()
       imx_fec: Reserve full FSL_IMX25_FEC_SIZE page for the register file
-Michael Weiser (8):
+Cédric Le Goater (7):
-      linux-user: Add support for big-endian aarch64
+      aspeed: Remove unused SoC definitions
-      linux-user: Add separate aarch64_be uname
+      aspeed: Use consistent typenames
-      linux-user: Fix endianess of aarch64 signal trampoline
+      aspeed/smc: Add support for DMAs
-      configure: Add aarch64_be-linux-user target
+      aspeed/smc: Add DMA calibration settings
-      linux-user: Add aarch64_be magic numbers to qemu-binfmt-conf.sh
+      aspeed/smc: Inject errors in DMA checksum
-      linux-user: Separate binfmt arm CPU families
+      aspeed/scu: Introduce per-SoC SCU types
-      linux-user: Activate armeb handler registration
+      aspeed/scu: Introduce a aspeed_scu_get_apb_freq() routine
       target/arm: Fix stlxp for aarch64_be
-Peter Maydell (4):
+Emilio G. Cota (1):
-      linux-user/arm/nwfpe: Check coprocessor number for FPA emulation
+      atomic_template: fix indentation in GEN_ATOMIC_HELPER
       target/arm: Make disas_thumb2_insn() generate its own UNDEF exceptions
       hw/intc/arm_gicv3: Make reserved register addresses RAZ/WI
       hw/intc/arm_gic: reserved register addresses are RAZ/WI
-Philippe Mathieu-Daudé (2):
+Peter Maydell (1):
-      hw/timer/pxa2xx_timer: replace hw_error() -> qemu_log_mask()
+      qemu-ga: Convert invocation documentation to rST
       hw/sd/pxa2xx_mmci: add read/write() trace events
-Zhaoshenglong (1):
+Rashmica Gupta (2):
-      Virt: ACPI: fix qemu assert due to re-assigned table data address
+      hw/gpio: Add basic Aspeed GPIO model for AST2400 and AST2500
       aspeed: add a GPIO controller to the SoC
- configure                                 |   5 +-
+ Makefile                      |  24 +-
- include/hw/arm/fsl-imx25.h                |   1 -
+ hw/gpio/Makefile.objs         |   1 +
- include/hw/net/imx_fec.h                  |  27 +++-
+ accel/tcg/atomic_template.h   |   2 +-
- linux-user/aarch64/target_syscall.h       |   4 +
+ include/hw/arm/aspeed_soc.h   |   4 +-
- hw/arm/fsl-imx6.c                         |   1 +
+ include/hw/gpio/aspeed_gpio.h | 100 +++++
- hw/arm/virt-acpi-build.c                  |  18 ++-
+ include/hw/misc/aspeed_scu.h  |  21 +-
- hw/intc/arm_gic.c                         |   5 +-
+ include/hw/ssi/aspeed_smc.h   |   7 +
- hw/intc/arm_gicv3_dist.c                  |  13 ++
+ hw/arm/aspeed.c               |   2 +
- hw/intc/arm_gicv3_its_common.c            |   8 +-
+ hw/arm/aspeed_soc.c           |  63 ++-
- hw/intc/arm_gicv3_redist.c                |  13 ++
+ hw/gpio/aspeed_gpio.c         | 884 ++++++++++++++++++++++++++++++++++++++++++
- hw/net/imx_fec.c                          | 210 +++++++++++++++++++++++-------
+ hw/misc/aspeed_scu.c          | 102 ++---
- hw/sd/pxa2xx_mmci.c                       |  78 +++++++----
+ hw/ssi/aspeed_smc.c           | 335 +++++++++++++++-
- hw/timer/pxa2xx_timer.c                   |  17 ++-
+ hw/timer/aspeed_timer.c       |   3 +-
- linux-user/arm/nwfpe/fpa11.c              |   9 ++
+ MAINTAINERS                   |   2 +-
- linux-user/main.c                         |   6 +
+ docs/conf.py                  |  18 +-
- linux-user/signal.c                       |  10 +-
+ docs/interop/conf.py          |   7 +
- target/arm/helper-a64.c                   |   7 +-
+ docs/interop/index.rst        |   1 +
- target/arm/translate.c                    |  23 ++--
+ docs/interop/qemu-ga.rst      | 133 +++++++
- default-configs/aarch64_be-linux-user.mak |   1 +
+ qemu-doc.texi                 |   5 -
- hw/sd/trace-events                        |   4 +
+ qemu-ga.texi                  | 137 -------
- scripts/qemu-binfmt-conf.sh               |  15 ++-
+files changed, 1585 insertions(+), 266 deletions(-)
-files changed, 356 insertions(+), 119 deletions(-)
+ create mode 100644 include/hw/gpio/aspeed_gpio.h
- create mode 100644 default-configs/aarch64_be-linux-user.mak
+ create mode 100644 hw/gpio/aspeed_gpio.c
  create mode 100644 docs/interop/qemu-ga.rst
  delete mode 100644 qemu-ga.texi

-[Qemu-devel] [PULL 01/26] linux-user: Add support for big-endian aarch64
+Deleted patch
-From: Michael Weiser <michael.weiser@gmx.de>
-Enable big-endian mode for data accesses on aarch64 for big-endian linux
-user mode. Activate it for all exception levels as documented by ARM:
-Set the SCTLR EE bit for ELs 1 through 3. Additionally set bit E0E in
-EL1 to enable it in EL0 as well.
-Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20171220212308.12614-2-michael.weiser@gmx.de
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- linux-user/main.c | 6 ++++++
-file changed, 6 insertions(+)
-diff --git a/linux-user/main.c b/linux-user/main.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/main.c
-+++ b/linux-user/main.c
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
-         }
-         env->pc = regs->pc;
-         env->xregs[31] = regs->sp;
-+#ifdef TARGET_WORDS_BIGENDIAN
-+        env->cp15.sctlr_el[1] |= SCTLR_E0E;
-+        for (i = 1; i < 4; ++i) {
-+            env->cp15.sctlr_el[i] |= SCTLR_EE;
-+        }
-+#endif
-     }
- #elif defined(TARGET_ARM)
-     {
---
-.7.4

-[Qemu-devel] [PULL 02/26] linux-user: Add separate aarch64_be uname
+Deleted patch
-From: Michael Weiser <michael.weiser@gmx.de>
-Make big-endian aarch64 systems identify as aarch64_be as expected by
-big-endian userland and toolchains.
-Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Laurent Vivier <laurent@vivier.eu>
-Message-id: 20171220212308.12614-3-michael.weiser@gmx.de
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- linux-user/aarch64/target_syscall.h | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/linux-user/aarch64/target_syscall.h b/linux-user/aarch64/target_syscall.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/aarch64/target_syscall.h
-+++ b/linux-user/aarch64/target_syscall.h
-@@ -XXX,XX +XXX,XX @@ struct target_pt_regs {
-     uint64_t        pstate;
- };
-+#if defined(TARGET_WORDS_BIGENDIAN)
-+#define UNAME_MACHINE "aarch64_be"
-+#else
- #define UNAME_MACHINE "aarch64"
-+#endif
- #define UNAME_MINIMUM_RELEASE "3.8.0"
- #define TARGET_CLONE_BACKWARDS
- #define TARGET_MINSIGSTKSZ       2048
---
-.7.4

-[Qemu-devel] [PULL 03/26] linux-user: Fix endianess of aarch64 signal trampoline
+Deleted patch
-From: Michael Weiser <michael.weiser@gmx.de>
-Since for aarch64 the signal trampoline is synthesized directly into the
-signal frame we need to make sure the instructions end up little-endian.
-Otherwise the wrong endianness will cause a SIGILL upon return from the
-signal handler on big-endian targets.
-Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20171220212308.12614-4-michael.weiser@gmx.de
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- linux-user/signal.c | 10 +++++++---
-file changed, 7 insertions(+), 3 deletions(-)
-diff --git a/linux-user/signal.c b/linux-user/signal.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/signal.c
-+++ b/linux-user/signal.c
-@@ -XXX,XX +XXX,XX @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
-     if (ka->sa_flags & TARGET_SA_RESTORER) {
-         return_addr = ka->sa_restorer;
-     } else {
--        /* mov x8,#__NR_rt_sigreturn; svc #0 */
--        __put_user(0xd2801168, &frame->tramp[0]);
--        __put_user(0xd4000001, &frame->tramp[1]);
-+        /*
-+         * mov x8,#__NR_rt_sigreturn; svc #0
-+         * Since these are instructions they need to be put as little-endian
-+         * regardless of target default or current CPU endianness.
-+         */
-+        __put_user_e(0xd2801168, &frame->tramp[0], le);
-+        __put_user_e(0xd4000001, &frame->tramp[1], le);
-         return_addr = frame_addr + offsetof(struct target_rt_sigframe, tramp);
-     }
-     env->xregs[0] = usig;
---
-.7.4

-[Qemu-devel] [PULL 04/26] configure: Add aarch64_be-linux-user target
+[Qemu-devel] [PULL 01/12] hw/gpio: Add basic Aspeed GPIO model for AST2400 and AST2500
-From: Michael Weiser <michael.weiser@gmx.de>
+From: Rashmica Gupta <rashmica.g@gmail.com>
-Add target aarch64_be-linux-user. This allows a qemu-aarch64_be binary
+GPIO pins are arranged in groups of 8 pins labeled A,B,..,Y,Z,AA,AB,AC.
-to be built that will run big-endian aarch64 binaries.
+(Note that the ast2400 controller only goes up to group AB).
 A set has four groups (except set AC which only has one) and is
 referred to by the groups it is composed of (eg ABCD,EFGH,...,YZAAAB).
 Each set is accessed and controlled by a bank of 14 registers.
-Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
+These registers operate on a per pin level where each bit in the register
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+corresponds to a pin, except for the command source registers. The command
-Reviewed-by: Laurent Vivier <laurent@vivier.eu>
+source registers operate on a per group level where bits 24, 16, 8 and 0
-Message-id: 20171220212308.12614-5-michael.weiser@gmx.de
+correspond to each group in the set.
  eg. registers for set ABCD:
  |D7...D0|C7...C0|B7...B0|A7...A0| <- GPIOs
  |31...24|23...16|15....8|7.....0| <- bit position
 Note that there are a couple of groups that only have 4 pins.
 There are two ways that this model deviates from the behaviour of the
 actual controller:
 (1) The only control source driving the GPIO pins in the model is the ARM
 model (as there currently aren't models for the LPC or Coprocessor).
 (2) None of the registers in the model are reset tolerant (needs
 integration with the watchdog).
 Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
 Tested-by: Andrew Jeffery <andrew@aj.id.au>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20190904070506.1052-2-clg@kaod.org
 [clg: fixed missing header files
       made use of HWADDR_PRIx to fix compilation on windows ]
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- configure                                 | 5 +++--
+ hw/gpio/Makefile.objs         |   1 +
- default-configs/aarch64_be-linux-user.mak | 1 +
+ include/hw/gpio/aspeed_gpio.h | 100 ++++
-files changed, 4 insertions(+), 2 deletions(-)
+ hw/gpio/aspeed_gpio.c         | 884 ++++++++++++++++++++++++++++++++++
- create mode 100644 default-configs/aarch64_be-linux-user.mak
+files changed, 985 insertions(+)
  create mode 100644 include/hw/gpio/aspeed_gpio.h
  create mode 100644 hw/gpio/aspeed_gpio.c
-diff --git a/configure b/configure
+diff --git a/hw/gpio/Makefile.objs b/hw/gpio/Makefile.objs
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/configure
+--- a/hw/gpio/Makefile.objs
-+++ b/configure
++++ b/hw/gpio/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ target_name=$(echo $target | cut -d '-' -f 1)
+@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_OMAP) += omap_gpio.o
- target_bigendian="no"
+ obj-$(CONFIG_IMX) += imx_gpio.o
+ obj-$(CONFIG_RASPI) += bcm2835_gpio.o
- case "$target_name" in
+ obj-$(CONFIG_NRF51_SOC) += nrf51_gpio.o
--  armeb|hppa|lm32|m68k|microblaze|mips|mipsn32|mips64|moxie|or1k|ppc|ppcemb|ppc64|ppc64abi32|s390x|sh4eb|sparc|sparc64|sparc32plus|xtensaeb)
++obj-$(CONFIG_ASPEED_SOC) += aspeed_gpio.o
-+  armeb|aarch64_be|hppa|lm32|m68k|microblaze|mips|mipsn32|mips64|moxie|or1k|ppc|ppcemb|ppc64|ppc64abi32|s390x|sh4eb|sparc|sparc64|sparc32plus|xtensaeb)
+diff --git a/include/hw/gpio/aspeed_gpio.h b/include/hw/gpio/aspeed_gpio.h
    target_bigendian=yes
    ;;
  esac
@@ -XXX,XX +XXX,XX @@ case "$target_name" in
      mttcg="yes"
      gdb_xml_files="arm-core.xml arm-vfp.xml arm-vfp3.xml arm-neon.xml"
    ;;
 -  aarch64)
 +  aarch64|aarch64_be)
 +    TARGET_ARCH=aarch64
      TARGET_BASE_ARCH=arm
      bflt="yes"
      mttcg="yes"
 diff --git a/default-configs/aarch64_be-linux-user.mak b/default-configs/aarch64_be-linux-user.mak
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/default-configs/aarch64_be-linux-user.mak
++++ b/include/hw/gpio/aspeed_gpio.h
-@@ -0,0 +1 @@
+@@ -XXX,XX +XXX,XX @@
-+# Default configuration for aarch64_be-linux-user
++/*
 + *  ASPEED GPIO Controller
 + *
 + *  Copyright (C) 2017-2018 IBM Corp.
 + *
 + * This code is licensed under the GPL version 2 or later.  See
 + * the COPYING file in the top-level directory.
 + */
 +
 +#ifndef ASPEED_GPIO_H
 +#define ASPEED_GPIO_H
 +
 +#include "hw/sysbus.h"
 +
 +#define TYPE_ASPEED_GPIO "aspeed.gpio"
 +#define ASPEED_GPIO(obj) OBJECT_CHECK(AspeedGPIOState, (obj), TYPE_ASPEED_GPIO)
 +#define ASPEED_GPIO_CLASS(klass) \
 +     OBJECT_CLASS_CHECK(AspeedGPIOClass, (klass), TYPE_ASPEED_GPIO)
 +#define ASPEED_GPIO_GET_CLASS(obj) \
 +     OBJECT_GET_CLASS(AspeedGPIOClass, (obj), TYPE_ASPEED_GPIO)
 +
 +#define ASPEED_GPIO_MAX_NR_SETS 8
 +#define ASPEED_REGS_PER_BANK 14
 +#define ASPEED_GPIO_MAX_NR_REGS (ASPEED_REGS_PER_BANK * ASPEED_GPIO_MAX_NR_SETS)
 +#define ASPEED_GPIO_NR_PINS 228
 +#define ASPEED_GROUPS_PER_SET 4
 +#define ASPEED_GPIO_NR_DEBOUNCE_REGS 3
 +#define ASPEED_CHARS_PER_GROUP_LABEL 4
 +
 +typedef struct GPIOSets GPIOSets;
 +
 +typedef struct GPIOSetProperties {
 +    uint32_t input;
 +    uint32_t output;
 +    char group_label[ASPEED_GROUPS_PER_SET][ASPEED_CHARS_PER_GROUP_LABEL];
 +} GPIOSetProperties;
 +
 +enum GPIORegType {
 +    gpio_not_a_reg,
 +    gpio_reg_data_value,
 +    gpio_reg_direction,
 +    gpio_reg_int_enable,
 +    gpio_reg_int_sens_0,
 +    gpio_reg_int_sens_1,
 +    gpio_reg_int_sens_2,
 +    gpio_reg_int_status,
 +    gpio_reg_reset_tolerant,
 +    gpio_reg_debounce_1,
 +    gpio_reg_debounce_2,
 +    gpio_reg_cmd_source_0,
 +    gpio_reg_cmd_source_1,
 +    gpio_reg_data_read,
 +    gpio_reg_input_mask,
 +};
 +
 +typedef struct AspeedGPIOReg {
 +    uint16_t set_idx;
 +    enum GPIORegType type;
 + } AspeedGPIOReg;
 +
 +typedef struct  AspeedGPIOClass {
 +    SysBusDevice parent_obj;
 +    const GPIOSetProperties *props;
 +    uint32_t nr_gpio_pins;
 +    uint32_t nr_gpio_sets;
 +    uint32_t gap;
 +    const AspeedGPIOReg *reg_table;
 +}  AspeedGPIOClass;
 +
 +typedef struct AspeedGPIOState {
 +    /* <private> */
 +    SysBusDevice parent;
 +
 +    /*< public >*/
 +    MemoryRegion iomem;
 +    int pending;
 +    qemu_irq irq;
 +    qemu_irq gpios[ASPEED_GPIO_NR_PINS];
 +
 +/* Parallel GPIO Registers */
 +    uint32_t debounce_regs[ASPEED_GPIO_NR_DEBOUNCE_REGS];
 +    struct GPIOSets {
 +        uint32_t data_value; /* Reflects pin values */
 +        uint32_t data_read; /* Contains last value written to data value */
 +        uint32_t direction;
 +        uint32_t int_enable;
 +        uint32_t int_sens_0;
 +        uint32_t int_sens_1;
 +        uint32_t int_sens_2;
 +        uint32_t int_status;
 +        uint32_t reset_tol;
 +        uint32_t cmd_source_0;
 +        uint32_t cmd_source_1;
 +        uint32_t debounce_1;
 +        uint32_t debounce_2;
 +        uint32_t input_mask;
 +    } sets[ASPEED_GPIO_MAX_NR_SETS];
 +} AspeedGPIOState;
 +
 +#endif /* _ASPEED_GPIO_H_ */
 diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + *  ASPEED GPIO Controller
 + *
 + *  Copyright (C) 2017-2019 IBM Corp.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include <assert.h>
 +
 +#include "qemu/osdep.h"
 +#include "qemu/host-utils.h"
 +#include "qemu/log.h"
 +#include "hw/gpio/aspeed_gpio.h"
 +#include "include/hw/misc/aspeed_scu.h"
 +#include "qapi/error.h"
 +#include "qapi/visitor.h"
 +#include "hw/irq.h"
 +#include "migration/vmstate.h"
 +
 +#define GPIOS_PER_REG 32
 +#define GPIOS_PER_SET GPIOS_PER_REG
 +#define GPIO_PIN_GAP_SIZE 4
 +#define GPIOS_PER_GROUP 8
 +#define GPIO_GROUP_SHIFT 3
 +
 +/* GPIO Source Types */
 +#define ASPEED_CMD_SRC_MASK         0x01010101
 +#define ASPEED_SOURCE_ARM           0
 +#define ASPEED_SOURCE_LPC           1
 +#define ASPEED_SOURCE_COPROCESSOR   2
 +#define ASPEED_SOURCE_RESERVED      3
 +
 +/* GPIO Interrupt Triggers */
 +/*
 + *  For each set of gpios there are three sensitivity registers that control
 + *  the interrupt trigger mode.
 + *
 + *  | 2 | 1 | 0 | trigger mode
 + *  -----------------------------
 + *  | 0 | 0 | 0 | falling-edge
 + *  | 0 | 0 | 1 | rising-edge
 + *  | 0 | 1 | 0 | level-low
 + *  | 0 | 1 | 1 | level-high
 + *  | 1 | X | X | dual-edge
 + */
 +#define ASPEED_FALLING_EDGE 0
 +#define ASPEED_RISING_EDGE  1
 +#define ASPEED_LEVEL_LOW    2
 +#define ASPEED_LEVEL_HIGH   3
 +#define ASPEED_DUAL_EDGE    4
 +
 +/* GPIO Register Address Offsets */
 +#define GPIO_ABCD_DATA_VALUE       (0x000 >> 2)
 +#define GPIO_ABCD_DIRECTION        (0x004 >> 2)
 +#define GPIO_ABCD_INT_ENABLE       (0x008 >> 2)
 +#define GPIO_ABCD_INT_SENS_0       (0x00C >> 2)
 +#define GPIO_ABCD_INT_SENS_1       (0x010 >> 2)
 +#define GPIO_ABCD_INT_SENS_2       (0x014 >> 2)
 +#define GPIO_ABCD_INT_STATUS       (0x018 >> 2)
 +#define GPIO_ABCD_RESET_TOLERANT   (0x01C >> 2)
 +#define GPIO_EFGH_DATA_VALUE       (0x020 >> 2)
 +#define GPIO_EFGH_DIRECTION        (0x024 >> 2)
 +#define GPIO_EFGH_INT_ENABLE       (0x028 >> 2)
 +#define GPIO_EFGH_INT_SENS_0       (0x02C >> 2)
 +#define GPIO_EFGH_INT_SENS_1       (0x030 >> 2)
 +#define GPIO_EFGH_INT_SENS_2       (0x034 >> 2)
 +#define GPIO_EFGH_INT_STATUS       (0x038 >> 2)
 +#define GPIO_EFGH_RESET_TOLERANT   (0x03C >> 2)
 +#define GPIO_ABCD_DEBOUNCE_1       (0x040 >> 2)
 +#define GPIO_ABCD_DEBOUNCE_2       (0x044 >> 2)
 +#define GPIO_EFGH_DEBOUNCE_1       (0x048 >> 2)
 +#define GPIO_EFGH_DEBOUNCE_2       (0x04C >> 2)
 +#define GPIO_DEBOUNCE_TIME_1       (0x050 >> 2)
 +#define GPIO_DEBOUNCE_TIME_2       (0x054 >> 2)
 +#define GPIO_DEBOUNCE_TIME_3       (0x058 >> 2)
 +#define GPIO_ABCD_COMMAND_SRC_0    (0x060 >> 2)
 +#define GPIO_ABCD_COMMAND_SRC_1    (0x064 >> 2)
 +#define GPIO_EFGH_COMMAND_SRC_0    (0x068 >> 2)
 +#define GPIO_EFGH_COMMAND_SRC_1    (0x06C >> 2)
 +#define GPIO_IJKL_DATA_VALUE       (0x070 >> 2)
 +#define GPIO_IJKL_DIRECTION        (0x074 >> 2)
 +#define GPIO_MNOP_DATA_VALUE       (0x078 >> 2)
 +#define GPIO_MNOP_DIRECTION        (0x07C >> 2)
 +#define GPIO_QRST_DATA_VALUE       (0x080 >> 2)
 +#define GPIO_QRST_DIRECTION        (0x084 >> 2)
 +#define GPIO_UVWX_DATA_VALUE       (0x088 >> 2)
 +#define GPIO_UVWX_DIRECTION        (0x08C >> 2)
 +#define GPIO_IJKL_COMMAND_SRC_0    (0x090 >> 2)
 +#define GPIO_IJKL_COMMAND_SRC_1    (0x094 >> 2)
 +#define GPIO_IJKL_INT_ENABLE       (0x098 >> 2)
 +#define GPIO_IJKL_INT_SENS_0       (0x09C >> 2)
 +#define GPIO_IJKL_INT_SENS_1       (0x0A0 >> 2)
 +#define GPIO_IJKL_INT_SENS_2       (0x0A4 >> 2)
 +#define GPIO_IJKL_INT_STATUS       (0x0A8 >> 2)
 +#define GPIO_IJKL_RESET_TOLERANT   (0x0AC >> 2)
 +#define GPIO_IJKL_DEBOUNCE_1       (0x0B0 >> 2)
 +#define GPIO_IJKL_DEBOUNCE_2       (0x0B4 >> 2)
 +#define GPIO_IJKL_INPUT_MASK       (0x0B8 >> 2)
 +#define GPIO_ABCD_DATA_READ        (0x0C0 >> 2)
 +#define GPIO_EFGH_DATA_READ        (0x0C4 >> 2)
 +#define GPIO_IJKL_DATA_READ        (0x0C8 >> 2)
 +#define GPIO_MNOP_DATA_READ        (0x0CC >> 2)
 +#define GPIO_QRST_DATA_READ        (0x0D0 >> 2)
 +#define GPIO_UVWX_DATA_READ        (0x0D4 >> 2)
 +#define GPIO_YZAAAB_DATA_READ      (0x0D8 >> 2)
 +#define GPIO_AC_DATA_READ          (0x0DC >> 2)
 +#define GPIO_MNOP_COMMAND_SRC_0    (0x0E0 >> 2)
 +#define GPIO_MNOP_COMMAND_SRC_1    (0x0E4 >> 2)
 +#define GPIO_MNOP_INT_ENABLE       (0x0E8 >> 2)
 +#define GPIO_MNOP_INT_SENS_0       (0x0EC >> 2)
 +#define GPIO_MNOP_INT_SENS_1       (0x0F0 >> 2)
 +#define GPIO_MNOP_INT_SENS_2       (0x0F4 >> 2)
 +#define GPIO_MNOP_INT_STATUS       (0x0F8 >> 2)
 +#define GPIO_MNOP_RESET_TOLERANT   (0x0FC >> 2)
 +#define GPIO_MNOP_DEBOUNCE_1       (0x100 >> 2)
 +#define GPIO_MNOP_DEBOUNCE_2       (0x104 >> 2)
 +#define GPIO_MNOP_INPUT_MASK       (0x108 >> 2)
 +#define GPIO_QRST_COMMAND_SRC_0    (0x110 >> 2)
 +#define GPIO_QRST_COMMAND_SRC_1    (0x114 >> 2)
 +#define GPIO_QRST_INT_ENABLE       (0x118 >> 2)
 +#define GPIO_QRST_INT_SENS_0       (0x11C >> 2)
 +#define GPIO_QRST_INT_SENS_1       (0x120 >> 2)
 +#define GPIO_QRST_INT_SENS_2       (0x124 >> 2)
 +#define GPIO_QRST_INT_STATUS       (0x128 >> 2)
 +#define GPIO_QRST_RESET_TOLERANT   (0x12C >> 2)
 +#define GPIO_QRST_DEBOUNCE_1       (0x130 >> 2)
 +#define GPIO_QRST_DEBOUNCE_2       (0x134 >> 2)
 +#define GPIO_QRST_INPUT_MASK       (0x138 >> 2)
 +#define GPIO_UVWX_COMMAND_SRC_0    (0x140 >> 2)
 +#define GPIO_UVWX_COMMAND_SRC_1    (0x144 >> 2)
 +#define GPIO_UVWX_INT_ENABLE       (0x148 >> 2)
 +#define GPIO_UVWX_INT_SENS_0       (0x14C >> 2)
 +#define GPIO_UVWX_INT_SENS_1       (0x150 >> 2)
 +#define GPIO_UVWX_INT_SENS_2       (0x154 >> 2)
 +#define GPIO_UVWX_INT_STATUS       (0x158 >> 2)
 +#define GPIO_UVWX_RESET_TOLERANT   (0x15C >> 2)
 +#define GPIO_UVWX_DEBOUNCE_1       (0x160 >> 2)
 +#define GPIO_UVWX_DEBOUNCE_2       (0x164 >> 2)
 +#define GPIO_UVWX_INPUT_MASK       (0x168 >> 2)
 +#define GPIO_YZAAAB_COMMAND_SRC_0  (0x170 >> 2)
 +#define GPIO_YZAAAB_COMMAND_SRC_1  (0x174 >> 2)
 +#define GPIO_YZAAAB_INT_ENABLE     (0x178 >> 2)
 +#define GPIO_YZAAAB_INT_SENS_0     (0x17C >> 2)
 +#define GPIO_YZAAAB_INT_SENS_1     (0x180 >> 2)
 +#define GPIO_YZAAAB_INT_SENS_2     (0x184 >> 2)
 +#define GPIO_YZAAAB_INT_STATUS     (0x188 >> 2)
 +#define GPIO_YZAAAB_RESET_TOLERANT (0x18C >> 2)
 +#define GPIO_YZAAAB_DEBOUNCE_1     (0x190 >> 2)
 +#define GPIO_YZAAAB_DEBOUNCE_2     (0x194 >> 2)
 +#define GPIO_YZAAAB_INPUT_MASK     (0x198 >> 2)
 +#define GPIO_AC_COMMAND_SRC_0      (0x1A0 >> 2)
 +#define GPIO_AC_COMMAND_SRC_1      (0x1A4 >> 2)
 +#define GPIO_AC_INT_ENABLE         (0x1A8 >> 2)
 +#define GPIO_AC_INT_SENS_0         (0x1AC >> 2)
 +#define GPIO_AC_INT_SENS_1         (0x1B0 >> 2)
 +#define GPIO_AC_INT_SENS_2         (0x1B4 >> 2)
 +#define GPIO_AC_INT_STATUS         (0x1B8 >> 2)
 +#define GPIO_AC_RESET_TOLERANT     (0x1BC >> 2)
 +#define GPIO_AC_DEBOUNCE_1         (0x1C0 >> 2)
 +#define GPIO_AC_DEBOUNCE_2         (0x1C4 >> 2)
 +#define GPIO_AC_INPUT_MASK         (0x1C8 >> 2)
 +#define GPIO_ABCD_INPUT_MASK       (0x1D0 >> 2)
 +#define GPIO_EFGH_INPUT_MASK       (0x1D4 >> 2)
 +#define GPIO_YZAAAB_DATA_VALUE     (0x1E0 >> 2)
 +#define GPIO_YZAAAB_DIRECTION      (0x1E4 >> 2)
 +#define GPIO_AC_DATA_VALUE         (0x1E8 >> 2)
 +#define GPIO_AC_DIRECTION          (0x1EC >> 2)
 +#define GPIO_3_6V_MEM_SIZE         0x1F0
 +#define GPIO_3_6V_REG_ARRAY_SIZE   (GPIO_3_6V_MEM_SIZE >> 2)
 +
 +static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
 +{
 +    uint32_t falling_edge = 0, rising_edge = 0;
 +    uint32_t int_trigger = extract32(regs->int_sens_0, gpio, 1)
 +                           | extract32(regs->int_sens_1, gpio, 1) << 1
 +                           | extract32(regs->int_sens_2, gpio, 1) << 2;
 +    uint32_t gpio_curr_high = extract32(regs->data_value, gpio, 1);
 +    uint32_t gpio_int_enabled = extract32(regs->int_enable, gpio, 1);
 +
 +    if (!gpio_int_enabled) {
 +        return 0;
 +    }
 +
 +    /* Detect edges */
 +    if (gpio_curr_high && !gpio_prev_high) {
 +        rising_edge = 1;
 +    } else if (!gpio_curr_high && gpio_prev_high) {
 +        falling_edge = 1;
 +    }
 +
 +    if (((int_trigger == ASPEED_FALLING_EDGE)  && falling_edge)  ||
 +        ((int_trigger == ASPEED_RISING_EDGE)  && rising_edge)    ||
 +        ((int_trigger == ASPEED_LEVEL_LOW)  && !gpio_curr_high)  ||
 +        ((int_trigger == ASPEED_LEVEL_HIGH)  && gpio_curr_high)  ||
 +        ((int_trigger >= ASPEED_DUAL_EDGE)  && (rising_edge || falling_edge)))
 +    {
 +        regs->int_status = deposit32(regs->int_status, gpio, 1, 1);
 +        return 1;
 +    }
 +    return 0;
 +}
 +
 +#define nested_struct_index(ta, pa, m, tb, pb) \
 +        (pb - ((tb *)(((char *)pa) + offsetof(ta, m))))
 +
 +static ptrdiff_t aspeed_gpio_set_idx(AspeedGPIOState *s, GPIOSets *regs)
 +{
 +    return nested_struct_index(AspeedGPIOState, s, sets, GPIOSets, regs);
 +}
 +
 +static void aspeed_gpio_update(AspeedGPIOState *s, GPIOSets *regs,
 +                               uint32_t value)
 +{
 +    uint32_t input_mask = regs->input_mask;
 +    uint32_t direction = regs->direction;
 +    uint32_t old = regs->data_value;
 +    uint32_t new = value;
 +    uint32_t diff;
 +    int gpio;
 +
 +    diff = old ^ new;
 +    if (diff) {
 +        for (gpio = 0; gpio < GPIOS_PER_REG; gpio++) {
 +            uint32_t mask = 1 << gpio;
 +
 +            /* If the gpio needs to be updated... */
 +            if (!(diff & mask)) {
 +                continue;
 +            }
 +
 +            /* ...and we're output or not input-masked... */
 +            if (!(direction & mask) && (input_mask & mask)) {
 +                continue;
 +            }
 +
 +            /* ...then update the state. */
 +            if (mask & new) {
 +                regs->data_value |= mask;
 +            } else {
 +                regs->data_value &= ~mask;
 +            }
 +
 +            /* If the gpio is set to output... */
 +            if (direction & mask) {
 +                /* ...trigger the line-state IRQ */
 +                ptrdiff_t set = aspeed_gpio_set_idx(s, regs);
 +                size_t offset = set * GPIOS_PER_SET + gpio;
 +                qemu_set_irq(s->gpios[offset], !!(new & mask));
 +            } else {
 +                /* ...otherwise if we meet the line's current IRQ policy... */
 +                if (aspeed_evaluate_irq(regs, old & mask, gpio)) {
 +                    /* ...trigger the VIC IRQ */
 +                    s->pending++;
 +                }
 +            }
 +        }
 +    }
 +    qemu_set_irq(s->irq, !!(s->pending));
 +}
 +
 +static uint32_t aspeed_adjust_pin(AspeedGPIOState *s, uint32_t pin)
 +{
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    /*
 +     * The 2500 has a 4 pin gap in group AB and the 2400 has a 4 pin
 +     * gap in group Y (and only four pins in AB but this is the last group so
 +     * it doesn't matter).
 +     */
 +    if (agc->gap && pin >= agc->gap) {
 +        pin += GPIO_PIN_GAP_SIZE;
 +    }
 +
 +    return pin;
 +}
 +
 +static bool aspeed_gpio_get_pin_level(AspeedGPIOState *s, uint32_t set_idx,
 +                                      uint32_t pin)
 +{
 +    uint32_t reg_val;
 +    uint32_t pin_mask = 1 << pin;
 +
 +    reg_val = s->sets[set_idx].data_value;
 +
 +    return !!(reg_val & pin_mask);
 +}
 +
 +static void aspeed_gpio_set_pin_level(AspeedGPIOState *s, uint32_t set_idx,
 +                                      uint32_t pin, bool level)
 +{
 +    uint32_t value = s->sets[set_idx].data_value;
 +    uint32_t pin_mask = 1 << pin;
 +
 +    if (level) {
 +        value |= pin_mask;
 +    } else {
 +        value &= !pin_mask;
 +    }
 +
 +    aspeed_gpio_update(s, &s->sets[set_idx], value);
 +}
 +
 +/*
 + *  | src_1 | src_2 |  source     |
 + *  |-----------------------------|
 + *  |   0   |   0   |  ARM        |
 + *  |   0   |   1   |  LPC        |
 + *  |   1   |   0   |  Coprocessor|
 + *  |   1   |   1   |  Reserved   |
 + *
 + *  Once the source of a set is programmed, corresponding bits in the
 + *  data_value, direction, interrupt [enable, sens[0-2]], reset_tol and
 + *  debounce registers can only be written by the source.
 + *
 + *  Source is ARM by default
 + *  only bits 24, 16, 8, and 0 can be set
 + *
 + *  we don't currently have a model for the LPC or Coprocessor
 + */
 +static uint32_t update_value_control_source(GPIOSets *regs, uint32_t old_value,
 +                                            uint32_t value)
 +{
 +    int i;
 +    int cmd_source;
 +
 +    /* assume the source is always ARM for now */
 +    int source = ASPEED_SOURCE_ARM;
 +
 +    uint32_t new_value = 0;
 +
 +    /* for each group in set */
 +    for (i = 0; i < GPIOS_PER_REG; i += GPIOS_PER_GROUP) {
 +        cmd_source = extract32(regs->cmd_source_0, i, 1)
 +                | (extract32(regs->cmd_source_1, i, 1) << 1);
 +
 +        if (source == cmd_source) {
 +            new_value |= (0xff << i) & value;
 +        } else {
 +            new_value |= (0xff << i) & old_value;
 +        }
 +    }
 +    return new_value;
 +}
 +
 +static const AspeedGPIOReg aspeed_3_6v_gpios[GPIO_3_6V_REG_ARRAY_SIZE] = {
 +    /* Set ABCD */
 +    [GPIO_ABCD_DATA_VALUE] =     { 0, gpio_reg_data_value },
 +    [GPIO_ABCD_DIRECTION] =      { 0, gpio_reg_direction },
 +    [GPIO_ABCD_INT_ENABLE] =     { 0, gpio_reg_int_enable },
 +    [GPIO_ABCD_INT_SENS_0] =     { 0, gpio_reg_int_sens_0 },
 +    [GPIO_ABCD_INT_SENS_1] =     { 0, gpio_reg_int_sens_1 },
 +    [GPIO_ABCD_INT_SENS_2] =     { 0, gpio_reg_int_sens_2 },
 +    [GPIO_ABCD_INT_STATUS] =     { 0, gpio_reg_int_status },
 +    [GPIO_ABCD_RESET_TOLERANT] = { 0, gpio_reg_reset_tolerant },
 +    [GPIO_ABCD_DEBOUNCE_1] =     { 0, gpio_reg_debounce_1 },
 +    [GPIO_ABCD_DEBOUNCE_2] =     { 0, gpio_reg_debounce_2 },
 +    [GPIO_ABCD_COMMAND_SRC_0] =  { 0, gpio_reg_cmd_source_0 },
 +    [GPIO_ABCD_COMMAND_SRC_1] =  { 0, gpio_reg_cmd_source_1 },
 +    [GPIO_ABCD_DATA_READ] =      { 0, gpio_reg_data_read },
 +    [GPIO_ABCD_INPUT_MASK] =     { 0, gpio_reg_input_mask },
 +    /* Set EFGH */
 +    [GPIO_EFGH_DATA_VALUE] =     { 1, gpio_reg_data_value },
 +    [GPIO_EFGH_DIRECTION] =      { 1, gpio_reg_direction },
 +    [GPIO_EFGH_INT_ENABLE] =     { 1, gpio_reg_int_enable },
 +    [GPIO_EFGH_INT_SENS_0] =     { 1, gpio_reg_int_sens_0 },
 +    [GPIO_EFGH_INT_SENS_1] =     { 1, gpio_reg_int_sens_1 },
 +    [GPIO_EFGH_INT_SENS_2] =     { 1, gpio_reg_int_sens_2 },
 +    [GPIO_EFGH_INT_STATUS] =     { 1, gpio_reg_int_status },
 +    [GPIO_EFGH_RESET_TOLERANT] = { 1, gpio_reg_reset_tolerant },
 +    [GPIO_EFGH_DEBOUNCE_1] =     { 1, gpio_reg_debounce_1 },
 +    [GPIO_EFGH_DEBOUNCE_2] =     { 1, gpio_reg_debounce_2 },
 +    [GPIO_EFGH_COMMAND_SRC_0] =  { 1, gpio_reg_cmd_source_0 },
 +    [GPIO_EFGH_COMMAND_SRC_1] =  { 1, gpio_reg_cmd_source_1 },
 +    [GPIO_EFGH_DATA_READ] =      { 1, gpio_reg_data_read },
 +    [GPIO_EFGH_INPUT_MASK] =     { 1, gpio_reg_input_mask },
 +    /* Set IJKL */
 +    [GPIO_IJKL_DATA_VALUE] =     { 2, gpio_reg_data_value },
 +    [GPIO_IJKL_DIRECTION] =      { 2, gpio_reg_direction },
 +    [GPIO_IJKL_INT_ENABLE] =     { 2, gpio_reg_int_enable },
 +    [GPIO_IJKL_INT_SENS_0] =     { 2, gpio_reg_int_sens_0 },
 +    [GPIO_IJKL_INT_SENS_1] =     { 2, gpio_reg_int_sens_1 },
 +    [GPIO_IJKL_INT_SENS_2] =     { 2, gpio_reg_int_sens_2 },
 +    [GPIO_IJKL_INT_STATUS] =     { 2, gpio_reg_int_status },
 +    [GPIO_IJKL_RESET_TOLERANT] = { 2, gpio_reg_reset_tolerant },
 +    [GPIO_IJKL_DEBOUNCE_1] =     { 2, gpio_reg_debounce_1 },
 +    [GPIO_IJKL_DEBOUNCE_2] =     { 2, gpio_reg_debounce_2 },
 +    [GPIO_IJKL_COMMAND_SRC_0] =  { 2, gpio_reg_cmd_source_0 },
 +    [GPIO_IJKL_COMMAND_SRC_1] =  { 2, gpio_reg_cmd_source_1 },
 +    [GPIO_IJKL_DATA_READ] =      { 2, gpio_reg_data_read },
 +    [GPIO_IJKL_INPUT_MASK] =     { 2, gpio_reg_input_mask },
 +    /* Set MNOP */
 +    [GPIO_MNOP_DATA_VALUE] =     { 3, gpio_reg_data_value },
 +    [GPIO_MNOP_DIRECTION] =      { 3, gpio_reg_direction },
 +    [GPIO_MNOP_INT_ENABLE] =     { 3, gpio_reg_int_enable },
 +    [GPIO_MNOP_INT_SENS_0] =     { 3, gpio_reg_int_sens_0 },
 +    [GPIO_MNOP_INT_SENS_1] =     { 3, gpio_reg_int_sens_1 },
 +    [GPIO_MNOP_INT_SENS_2] =     { 3, gpio_reg_int_sens_2 },
 +    [GPIO_MNOP_INT_STATUS] =     { 3, gpio_reg_int_status },
 +    [GPIO_MNOP_RESET_TOLERANT] = { 3, gpio_reg_reset_tolerant },
 +    [GPIO_MNOP_DEBOUNCE_1] =     { 3, gpio_reg_debounce_1 },
 +    [GPIO_MNOP_DEBOUNCE_2] =     { 3, gpio_reg_debounce_2 },
 +    [GPIO_MNOP_COMMAND_SRC_0] =  { 3, gpio_reg_cmd_source_0 },
 +    [GPIO_MNOP_COMMAND_SRC_1] =  { 3, gpio_reg_cmd_source_1 },
 +    [GPIO_MNOP_DATA_READ] =      { 3, gpio_reg_data_read },
 +    [GPIO_MNOP_INPUT_MASK] =     { 3, gpio_reg_input_mask },
 +    /* Set QRST */
 +    [GPIO_QRST_DATA_VALUE] =     { 4, gpio_reg_data_value },
 +    [GPIO_QRST_DIRECTION] =      { 4, gpio_reg_direction },
 +    [GPIO_QRST_INT_ENABLE] =     { 4, gpio_reg_int_enable },
 +    [GPIO_QRST_INT_SENS_0] =     { 4, gpio_reg_int_sens_0 },
 +    [GPIO_QRST_INT_SENS_1] =     { 4, gpio_reg_int_sens_1 },
 +    [GPIO_QRST_INT_SENS_2] =     { 4, gpio_reg_int_sens_2 },
 +    [GPIO_QRST_INT_STATUS] =     { 4, gpio_reg_int_status },
 +    [GPIO_QRST_RESET_TOLERANT] = { 4, gpio_reg_reset_tolerant },
 +    [GPIO_QRST_DEBOUNCE_1] =     { 4, gpio_reg_debounce_1 },
 +    [GPIO_QRST_DEBOUNCE_2] =     { 4, gpio_reg_debounce_2 },
 +    [GPIO_QRST_COMMAND_SRC_0] =  { 4, gpio_reg_cmd_source_0 },
 +    [GPIO_QRST_COMMAND_SRC_1] =  { 4, gpio_reg_cmd_source_1 },
 +    [GPIO_QRST_DATA_READ] =      { 4, gpio_reg_data_read },
 +    [GPIO_QRST_INPUT_MASK] =     { 4, gpio_reg_input_mask },
 +    /* Set UVWX */
 +    [GPIO_UVWX_DATA_VALUE] =     { 5, gpio_reg_data_value },
 +    [GPIO_UVWX_DIRECTION] =      { 5, gpio_reg_direction },
 +    [GPIO_UVWX_INT_ENABLE] =     { 5, gpio_reg_int_enable },
 +    [GPIO_UVWX_INT_SENS_0] =     { 5, gpio_reg_int_sens_0 },
 +    [GPIO_UVWX_INT_SENS_1] =     { 5, gpio_reg_int_sens_1 },
 +    [GPIO_UVWX_INT_SENS_2] =     { 5, gpio_reg_int_sens_2 },
 +    [GPIO_UVWX_INT_STATUS] =     { 5, gpio_reg_int_status },
 +    [GPIO_UVWX_RESET_TOLERANT] = { 5, gpio_reg_reset_tolerant },
 +    [GPIO_UVWX_DEBOUNCE_1] =     { 5, gpio_reg_debounce_1 },
 +    [GPIO_UVWX_DEBOUNCE_2] =     { 5, gpio_reg_debounce_2 },
 +    [GPIO_UVWX_COMMAND_SRC_0] =  { 5, gpio_reg_cmd_source_0 },
 +    [GPIO_UVWX_COMMAND_SRC_1] =  { 5, gpio_reg_cmd_source_1 },
 +    [GPIO_UVWX_DATA_READ] =      { 5, gpio_reg_data_read },
 +    [GPIO_UVWX_INPUT_MASK] =     { 5, gpio_reg_input_mask },
 +    /* Set YZAAAB */
 +    [GPIO_YZAAAB_DATA_VALUE] =     { 6, gpio_reg_data_value },
 +    [GPIO_YZAAAB_DIRECTION] =      { 6, gpio_reg_direction },
 +    [GPIO_YZAAAB_INT_ENABLE] =     { 6, gpio_reg_int_enable },
 +    [GPIO_YZAAAB_INT_SENS_0] =     { 6, gpio_reg_int_sens_0 },
 +    [GPIO_YZAAAB_INT_SENS_1] =     { 6, gpio_reg_int_sens_1 },
 +    [GPIO_YZAAAB_INT_SENS_2] =     { 6, gpio_reg_int_sens_2 },
 +    [GPIO_YZAAAB_INT_STATUS] =     { 6, gpio_reg_int_status },
 +    [GPIO_YZAAAB_RESET_TOLERANT] = { 6, gpio_reg_reset_tolerant },
 +    [GPIO_YZAAAB_DEBOUNCE_1] =     { 6, gpio_reg_debounce_1 },
 +    [GPIO_YZAAAB_DEBOUNCE_2] =     { 6, gpio_reg_debounce_2 },
 +    [GPIO_YZAAAB_COMMAND_SRC_0] =  { 6, gpio_reg_cmd_source_0 },
 +    [GPIO_YZAAAB_COMMAND_SRC_1] =  { 6, gpio_reg_cmd_source_1 },
 +    [GPIO_YZAAAB_DATA_READ] =      { 6, gpio_reg_data_read },
 +    [GPIO_YZAAAB_INPUT_MASK] =     { 6, gpio_reg_input_mask },
 +    /* Set AC  (ast2500 only) */
 +    [GPIO_AC_DATA_VALUE] =         { 7, gpio_reg_data_value },
 +    [GPIO_AC_DIRECTION] =          { 7, gpio_reg_direction },
 +    [GPIO_AC_INT_ENABLE] =         { 7, gpio_reg_int_enable },
 +    [GPIO_AC_INT_SENS_0] =         { 7, gpio_reg_int_sens_0 },
 +    [GPIO_AC_INT_SENS_1] =         { 7, gpio_reg_int_sens_1 },
 +    [GPIO_AC_INT_SENS_2] =         { 7, gpio_reg_int_sens_2 },
 +    [GPIO_AC_INT_STATUS] =         { 7, gpio_reg_int_status },
 +    [GPIO_AC_RESET_TOLERANT] =     { 7, gpio_reg_reset_tolerant },
 +    [GPIO_AC_DEBOUNCE_1] =         { 7, gpio_reg_debounce_1 },
 +    [GPIO_AC_DEBOUNCE_2] =         { 7, gpio_reg_debounce_2 },
 +    [GPIO_AC_COMMAND_SRC_0] =      { 7, gpio_reg_cmd_source_0 },
 +    [GPIO_AC_COMMAND_SRC_1] =      { 7, gpio_reg_cmd_source_1 },
 +    [GPIO_AC_DATA_READ] =          { 7, gpio_reg_data_read },
 +    [GPIO_AC_INPUT_MASK] =         { 7, gpio_reg_input_mask },
 +};
 +
 +static uint64_t aspeed_gpio_read(void *opaque, hwaddr offset, uint32_t size)
 +{
 +    AspeedGPIOState *s = ASPEED_GPIO(opaque);
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    uint64_t idx = -1;
 +    const AspeedGPIOReg *reg;
 +    GPIOSets *set;
 +
 +    idx = offset >> 2;
 +    if (idx >= GPIO_DEBOUNCE_TIME_1 && idx <= GPIO_DEBOUNCE_TIME_3) {
 +        idx -= GPIO_DEBOUNCE_TIME_1;
 +        return (uint64_t) s->debounce_regs[idx];
 +    }
 +
 +    reg = &agc->reg_table[idx];
 +    if (reg->set_idx >= agc->nr_gpio_sets) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: no getter for offset 0x%"
 +                      HWADDR_PRIx"\n", __func__, offset);
 +        return 0;
 +    }
 +
 +    set = &s->sets[reg->set_idx];
 +    switch (reg->type) {
 +    case gpio_reg_data_value:
 +        return set->data_value;
 +    case gpio_reg_direction:
 +        return set->direction;
 +    case gpio_reg_int_enable:
 +        return set->int_enable;
 +    case gpio_reg_int_sens_0:
 +        return set->int_sens_0;
 +    case gpio_reg_int_sens_1:
 +        return set->int_sens_1;
 +    case gpio_reg_int_sens_2:
 +        return set->int_sens_2;
 +    case gpio_reg_int_status:
 +        return set->int_status;
 +    case gpio_reg_reset_tolerant:
 +        return set->reset_tol;
 +    case gpio_reg_debounce_1:
 +        return set->debounce_1;
 +    case gpio_reg_debounce_2:
 +        return set->debounce_2;
 +    case gpio_reg_cmd_source_0:
 +        return set->cmd_source_0;
 +    case gpio_reg_cmd_source_1:
 +        return set->cmd_source_1;
 +    case gpio_reg_data_read:
 +        return set->data_read;
 +    case gpio_reg_input_mask:
 +        return set->input_mask;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: no getter for offset 0x%"
 +                      HWADDR_PRIx"\n", __func__, offset);
 +        return 0;
 +    };
 +}
 +
 +static void aspeed_gpio_write(void *opaque, hwaddr offset, uint64_t data,
 +                              uint32_t size)
 +{
 +    AspeedGPIOState *s = ASPEED_GPIO(opaque);
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    const GPIOSetProperties *props;
 +    uint64_t idx = -1;
 +    const AspeedGPIOReg *reg;
 +    GPIOSets *set;
 +    uint32_t cleared;
 +
 +    idx = offset >> 2;
 +    if (idx >= GPIO_DEBOUNCE_TIME_1 && idx <= GPIO_DEBOUNCE_TIME_3) {
 +        idx -= GPIO_DEBOUNCE_TIME_1;
 +        s->debounce_regs[idx] = (uint32_t) data;
 +        return;
 +    }
 +
 +    reg = &agc->reg_table[idx];
 +    if (reg->set_idx >= agc->nr_gpio_sets) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: no setter for offset 0x%"
 +                      HWADDR_PRIx"\n", __func__, offset);
 +        return;
 +    }
 +
 +    set = &s->sets[reg->set_idx];
 +    props = &agc->props[reg->set_idx];
 +
 +    switch (reg->type) {
 +    case gpio_reg_data_value:
 +        data &= props->output;
 +        data = update_value_control_source(set, set->data_value, data);
 +        set->data_read = data;
 +        aspeed_gpio_update(s, set, data);
 +        return;
 +    case gpio_reg_direction:
 +        /*
 +         *   where data is the value attempted to be written to the pin:
 +         *    pin type      | input mask | output mask | expected value
 +         *    ------------------------------------------------------------
 +         *   bidirectional  |   1       |   1        |  data
 +         *   input only     |   1       |   0        |   0
 +         *   output only    |   0       |   1        |   1
 +         *   no pin / gap   |   0       |   0        |   0
 +         *
 +         *  which is captured by:
 +         *  data = ( data | ~input) & output;
 +         */
 +        data = (data | ~props->input) & props->output;
 +        set->direction = update_value_control_source(set, set->direction, data);
 +        break;
 +    case gpio_reg_int_enable:
 +        set->int_enable = update_value_control_source(set, set->int_enable,
 +                                                      data);
 +        break;
 +    case gpio_reg_int_sens_0:
 +        set->int_sens_0 = update_value_control_source(set, set->int_sens_0,
 +                                                      data);
 +        break;
 +    case gpio_reg_int_sens_1:
 +        set->int_sens_1 = update_value_control_source(set, set->int_sens_1,
 +                                                      data);
 +        break;
 +    case gpio_reg_int_sens_2:
 +        set->int_sens_2 = update_value_control_source(set, set->int_sens_2,
 +                                                      data);
 +        break;
 +    case gpio_reg_int_status:
 +        cleared = ctpop32(data & set->int_status);
 +        if (s->pending && cleared) {
 +            assert(s->pending >= cleared);
 +            s->pending -= cleared;
 +        }
 +        set->int_status &= ~data;
 +        break;
 +    case gpio_reg_reset_tolerant:
 +        set->reset_tol = update_value_control_source(set, set->reset_tol,
 +                                                     data);
 +        return;
 +    case gpio_reg_debounce_1:
 +        set->debounce_1 = update_value_control_source(set, set->debounce_1,
 +                                                      data);
 +        return;
 +    case gpio_reg_debounce_2:
 +        set->debounce_2 = update_value_control_source(set, set->debounce_2,
 +                                                      data);
 +        return;
 +    case gpio_reg_cmd_source_0:
 +        set->cmd_source_0 = data & ASPEED_CMD_SRC_MASK;
 +        return;
 +    case gpio_reg_cmd_source_1:
 +        set->cmd_source_1 = data & ASPEED_CMD_SRC_MASK;
 +        return;
 +    case gpio_reg_data_read:
 +        /* Read only register */
 +        return;
 +    case gpio_reg_input_mask:
 +        /*
 +         * feeds into interrupt generation
 +         * 0: read from data value reg will be updated
 +         * 1: read from data value reg will not be updated
 +         */
 +         set->input_mask = data & props->input;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: no setter for offset 0x%"
 +                      HWADDR_PRIx"\n", __func__, offset);
 +        return;
 +    }
 +    aspeed_gpio_update(s, set, set->data_value);
 +    return;
 +}
 +
 +static int get_set_idx(AspeedGPIOState *s, const char *group, int *group_idx)
 +{
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    int set_idx, g_idx = *group_idx;
 +
 +    for (set_idx = 0; set_idx < agc->nr_gpio_sets; set_idx++) {
 +        const GPIOSetProperties *set_props = &agc->props[set_idx];
 +        for (g_idx = 0; g_idx < ASPEED_GROUPS_PER_SET; g_idx++) {
 +            if (!strncmp(group, set_props->group_label[g_idx], strlen(group))) {
 +                *group_idx = g_idx;
 +                return set_idx;
 +            }
 +        }
 +    }
 +    return -1;
 +}
 +
 +static void aspeed_gpio_get_pin(Object *obj, Visitor *v, const char *name,
 +                                void *opaque, Error **errp)
 +{
 +    int pin = 0xfff;
 +    bool level = true;
 +    char group[3];
 +    AspeedGPIOState *s = ASPEED_GPIO(obj);
 +    int set_idx, group_idx = 0;
 +
 +    if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
 +        error_setg(errp, "%s: error reading %s", __func__, name);
 +        return;
 +    }
 +    set_idx = get_set_idx(s, group, &group_idx);
 +    if (set_idx == -1) {
 +        error_setg(errp, "%s: invalid group %s", __func__, group);
 +        return;
 +    }
 +    pin =  pin + group_idx * GPIOS_PER_GROUP;
 +    level = aspeed_gpio_get_pin_level(s, set_idx, pin);
 +    visit_type_bool(v, name, &level, errp);
 +}
 +
 +static void aspeed_gpio_set_pin(Object *obj, Visitor *v, const char *name,
 +                               void *opaque, Error **errp)
 +{
 +    Error *local_err = NULL;
 +    bool level;
 +    int pin = 0xfff;
 +    char group[3];
 +    AspeedGPIOState *s = ASPEED_GPIO(obj);
 +    int set_idx, group_idx = 0;
 +
 +    visit_type_bool(v, name, &level, &local_err);
 +    if (local_err) {
 +        error_propagate(errp, local_err);
 +        return;
 +    }
 +    if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
 +        error_setg(errp, "%s: error reading %s", __func__, name);
 +        return;
 +    }
 +    set_idx = get_set_idx(s, group, &group_idx);
 +    if (set_idx == -1) {
 +        error_setg(errp, "%s: invalid group %s", __func__, group);
 +        return;
 +    }
 +    pin =  pin + group_idx * GPIOS_PER_GROUP;
 +    aspeed_gpio_set_pin_level(s, set_idx, pin, level);
 +}
 +
 +/****************** Setup functions ******************/
 +static const GPIOSetProperties ast2400_set_props[] = {
 +    [0] = {0xffffffff,  0xffffffff,  {"A", "B", "C", "D"} },
 +    [1] = {0xffffffff,  0xffffffff,  {"E", "F", "G", "H"} },
 +    [2] = {0xffffffff,  0xffffffff,  {"I", "J", "K", "L"} },
 +    [3] = {0xffffffff,  0xffffffff,  {"M", "N", "O", "P"} },
 +    [4] = {0xffffffff,  0xffffffff,  {"Q", "R", "S", "T"} },
 +    [5] = {0xffffffff,  0x0000ffff,  {"U", "V", "W", "X"} },
 +    [6] = {0x0000000f,  0x0fffff0f,  {"Y", "Z", "AA", "AB"} },
 +};
 +
 +static const GPIOSetProperties ast2500_set_props[] = {
 +    [0] = {0xffffffff,  0xffffffff,  {"A", "B", "C", "D"} },
 +    [1] = {0xffffffff,  0xffffffff,  {"E", "F", "G", "H"} },
 +    [2] = {0xffffffff,  0xffffffff,  {"I", "J", "K", "L"} },
 +    [3] = {0xffffffff,  0xffffffff,  {"M", "N", "O", "P"} },
 +    [4] = {0xffffffff,  0xffffffff,  {"Q", "R", "S", "T"} },
 +    [5] = {0xffffffff,  0x0000ffff,  {"U", "V", "W", "X"} },
 +    [6] = {0xffffff0f,  0x0fffff0f,  {"Y", "Z", "AA", "AB"} },
 +    [7] = {0x000000ff,  0x000000ff,  {"AC"} },
 +};
 +
 +static const MemoryRegionOps aspeed_gpio_ops = {
 +    .read       = aspeed_gpio_read,
 +    .write      = aspeed_gpio_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid.min_access_size = 4,
 +    .valid.max_access_size = 4,
 +};
 +
 +static void aspeed_gpio_reset(DeviceState *dev)
 +{
 +    AspeedGPIOState *s = ASPEED_GPIO(dev);
 +
 +    /* TODO: respect the reset tolerance registers */
 +    memset(s->sets, 0, sizeof(s->sets));
 +}
 +
 +static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
 +{
 +    AspeedGPIOState *s = ASPEED_GPIO(dev);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    int pin;
 +
 +    /* Interrupt parent line */
 +    sysbus_init_irq(sbd, &s->irq);
 +
 +    /* Individual GPIOs */
 +    for (pin = 0; pin < agc->nr_gpio_pins; pin++) {
 +        sysbus_init_irq(sbd, &s->gpios[pin]);
 +    }
 +
 +    memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
 +            TYPE_ASPEED_GPIO, GPIO_3_6V_MEM_SIZE);
 +
 +    sysbus_init_mmio(sbd, &s->iomem);
 +}
 +
 +static void aspeed_gpio_init(Object *obj)
 +{
 +    AspeedGPIOState *s = ASPEED_GPIO(obj);
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    int pin;
 +
 +    for (pin = 0; pin < agc->nr_gpio_pins; pin++) {
 +        char *name;
 +        int set_idx = pin / GPIOS_PER_SET;
 +        int pin_idx = aspeed_adjust_pin(s, pin) - (set_idx * GPIOS_PER_SET);
 +        int group_idx = pin_idx >> GPIO_GROUP_SHIFT;
 +        const GPIOSetProperties *props = &agc->props[set_idx];
 +
 +        name = g_strdup_printf("gpio%s%d", props->group_label[group_idx],
 +                               pin_idx % GPIOS_PER_GROUP);
 +        object_property_add(obj, name, "bool", aspeed_gpio_get_pin,
 +                            aspeed_gpio_set_pin, NULL, NULL, NULL);
 +    }
 +}
 +
 +static const VMStateDescription vmstate_gpio_regs = {
 +    .name = TYPE_ASPEED_GPIO"/regs",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(data_value,   GPIOSets),
 +        VMSTATE_UINT32(data_read,    GPIOSets),
 +        VMSTATE_UINT32(direction,    GPIOSets),
 +        VMSTATE_UINT32(int_enable,   GPIOSets),
 +        VMSTATE_UINT32(int_sens_0,   GPIOSets),
 +        VMSTATE_UINT32(int_sens_1,   GPIOSets),
 +        VMSTATE_UINT32(int_sens_2,   GPIOSets),
 +        VMSTATE_UINT32(int_status,   GPIOSets),
 +        VMSTATE_UINT32(reset_tol,    GPIOSets),
 +        VMSTATE_UINT32(cmd_source_0, GPIOSets),
 +        VMSTATE_UINT32(cmd_source_1, GPIOSets),
 +        VMSTATE_UINT32(debounce_1,   GPIOSets),
 +        VMSTATE_UINT32(debounce_2,   GPIOSets),
 +        VMSTATE_UINT32(input_mask,   GPIOSets),
 +        VMSTATE_END_OF_LIST(),
 +    }
 +};
 +
 +static const VMStateDescription vmstate_aspeed_gpio = {
 +    .name = TYPE_ASPEED_GPIO,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_STRUCT_ARRAY(sets, AspeedGPIOState, ASPEED_GPIO_MAX_NR_SETS,
 +                             1, vmstate_gpio_regs, GPIOSets),
 +        VMSTATE_UINT32_ARRAY(debounce_regs, AspeedGPIOState,
 +                             ASPEED_GPIO_NR_DEBOUNCE_REGS),
 +        VMSTATE_END_OF_LIST(),
 +   }
 +};
 +
 +static void aspeed_gpio_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = aspeed_gpio_realize;
 +    dc->reset = aspeed_gpio_reset;
 +    dc->desc = "Aspeed GPIO Controller";
 +    dc->vmsd = &vmstate_aspeed_gpio;
 +}
 +
 +static void aspeed_gpio_ast2400_class_init(ObjectClass *klass, void *data)
 +{
 +    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 +
 +    agc->props = ast2400_set_props;
 +    agc->nr_gpio_pins = 216;
 +    agc->nr_gpio_sets = 7;
 +    agc->gap = 196;
 +    agc->reg_table = aspeed_3_6v_gpios;
 +}
 +
 +static void aspeed_gpio_2500_class_init(ObjectClass *klass, void *data)
 +{
 +    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 +
 +    agc->props = ast2500_set_props;
 +    agc->nr_gpio_pins = 228;
 +    agc->nr_gpio_sets = 8;
 +    agc->gap = 220;
 +    agc->reg_table = aspeed_3_6v_gpios;
 +}
 +
 +static const TypeInfo aspeed_gpio_info = {
 +    .name           = TYPE_ASPEED_GPIO,
 +    .parent         = TYPE_SYS_BUS_DEVICE,
 +    .instance_size  = sizeof(AspeedGPIOState),
 +    .class_size     = sizeof(AspeedGPIOClass),
 +    .class_init     = aspeed_gpio_class_init,
 +    .abstract       = true,
 +};
 +
 +static const TypeInfo aspeed_gpio_ast2400_info = {
 +    .name           = TYPE_ASPEED_GPIO "-ast2400",
 +    .parent         = TYPE_ASPEED_GPIO,
 +    .class_init     = aspeed_gpio_ast2400_class_init,
 +    .instance_init  = aspeed_gpio_init,
 +};
 +
 +static const TypeInfo aspeed_gpio_ast2500_info = {
 +    .name           = TYPE_ASPEED_GPIO "-ast2500",
 +    .parent         = TYPE_ASPEED_GPIO,
 +    .class_init     = aspeed_gpio_2500_class_init,
 +    .instance_init  = aspeed_gpio_init,
 +};
 +
 +static void aspeed_gpio_register_types(void)
 +{
 +    type_register_static(&aspeed_gpio_info);
 +    type_register_static(&aspeed_gpio_ast2400_info);
 +    type_register_static(&aspeed_gpio_ast2500_info);
 +}
 +
 +type_init(aspeed_gpio_register_types);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 05/26] linux-user: Add aarch64_be magic numbers to qemu-binfmt-conf.sh
+Deleted patch
-From: Michael Weiser <michael.weiser@gmx.de>
-As we now have a linux-user aarch64_be target, we can add it to the list
-of supported targets in qemu-binfmt-conf.sh
-Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
-Reviewed-by: Laurent Vivier <laurent@vivier.eu>
-Message-id: 20171220212308.12614-6-michael.weiser@gmx.de
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- scripts/qemu-binfmt-conf.sh | 6 +++++-
-file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
-index XXXXXXX..XXXXXXX 100755
---- a/scripts/qemu-binfmt-conf.sh
-+++ b/scripts/qemu-binfmt-conf.sh
-@@ -XXX,XX +XXX,XX @@
- qemu_target_list="i386 i486 alpha arm sparc32plus ppc ppc64 ppc64le m68k \
- mips mipsel mipsn32 mipsn32el mips64 mips64el \
--sh4 sh4eb s390x aarch64 hppa"
-+sh4 sh4eb s390x aarch64 aarch64_be hppa"
- i386_magic='\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x03\x00'
- i386_mask='\xff\xff\xff\xff\xff\xfe\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'
-@@ -XXX,XX +XXX,XX @@ aarch64_magic='\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x
- aarch64_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'
- aarch64_family=arm
-+aarch64_be_magic='\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7'
-+aarch64_be_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
-+aarch64_be_family=arm
-+
- hppa_magic='\x7f\x45\x4c\x46\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x0f'
- hppa_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
- hppa_family=hppa
---
-.7.4

-[Qemu-devel] [PULL 06/26] linux-user: Separate binfmt arm CPU families
+Deleted patch
-From: Michael Weiser <michael.weiser@gmx.de>
-Give big-endian arm and aarch64 CPUs their own family in
-qemu-binfmt-conf.sh to make sure we register qemu-user for binaries of
-the opposite endianness on arm and aarch64. Apart from the family
-assignments of the magic values, qemu_get_family() needs to be able to
-distinguish the two and recognise aarch64{,_be} as well.
-Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
-Reviewed-by: Laurent Vivier <laurent@vivier.eu>
-Message-id: 20171220212308.12614-7-michael.weiser@gmx.de
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- scripts/qemu-binfmt-conf.sh | 9 ++++++---
-file changed, 6 insertions(+), 3 deletions(-)
-diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
-index XXXXXXX..XXXXXXX 100755
---- a/scripts/qemu-binfmt-conf.sh
-+++ b/scripts/qemu-binfmt-conf.sh
-@@ -XXX,XX +XXX,XX @@ arm_family=arm
- armeb_magic='\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x28'
- armeb_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
--armeb_family=arm
-+armeb_family=armeb
- sparc_magic='\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x02'
- sparc_mask='\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
-@@ -XXX,XX +XXX,XX @@ aarch64_family=arm
- aarch64_be_magic='\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7'
- aarch64_be_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
--aarch64_be_family=arm
-+aarch64_be_family=armeb
- hppa_magic='\x7f\x45\x4c\x46\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x0f'
- hppa_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
-@@ -XXX,XX +XXX,XX @@ qemu_get_family() {
-     ppc64el|ppc64le)
-         echo "ppcle"
-         ;;
--    arm|armel|armhf|arm64|armv[4-9]*)
-+    arm|armel|armhf|arm64|armv[4-9]*l|aarch64)
-         echo "arm"
-         ;;
-+    armeb|armv[4-9]*b|aarch64_be)
-+        echo "armeb"
-+        ;;
-     sparc*)
-         echo "sparc"
-         ;;
---
-.7.4

-[Qemu-devel] [PULL 07/26] linux-user: Activate armeb handler registration
+Deleted patch
-From: Michael Weiser <michael.weiser@gmx.de>
-armeb is missing from the target list in qemu-binfmt-conf.sh. Add it so
-the handler for those binaries gets registered by the script.
-Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
-Reviewed-by: Laurent Vivier <laurent@vivier.eu>
-Message-id: 20171220212308.12614-8-michael.weiser@gmx.de
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- scripts/qemu-binfmt-conf.sh | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
-index XXXXXXX..XXXXXXX 100755
---- a/scripts/qemu-binfmt-conf.sh
-+++ b/scripts/qemu-binfmt-conf.sh
-@@ -XXX,XX +XXX,XX @@
- # enable automatic i386/ARM/M68K/MIPS/SPARC/PPC/s390/HPPA
- # program execution by the kernel
--qemu_target_list="i386 i486 alpha arm sparc32plus ppc ppc64 ppc64le m68k \
-+qemu_target_list="i386 i486 alpha arm armeb sparc32plus ppc ppc64 ppc64le m68k \
- mips mipsel mipsn32 mipsn32el mips64 mips64el \
- sh4 sh4eb s390x aarch64 aarch64_be hppa"
---
-.7.4

-[Qemu-devel] [PULL 08/26] target/arm: Fix stlxp for aarch64_be
+Deleted patch
-From: Michael Weiser <michael.weiser@gmx.de>
-ldxp loads two consecutive doublewords from memory regardless of CPU
-endianness. On store, stlxp currently assumes to work with a 128bit
-value and consequently switches order in big-endian mode. With this
-change it packs the doublewords in reverse order in anticipation of the
-bit big-endian store operation interposing them so they end up in
-memory in the right order. This makes it work for both MTTCG and !MTTCG.
-It effectively implements the ARM ARM STLXP operation pseudo-code:
-data = if BigEndian() then el1:el2 else el2:el1;
-With this change an aarch64_be Linux 4.14.4 kernel succeeds to boot up
-in system emulation mode.
-Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper-a64.c | 7 +++++--
-file changed, 5 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper-a64.c
-+++ b/target/arm/helper-a64.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t do_paired_cmpxchg64_be(CPUARMState *env, uint64_t addr,
-     Int128 oldv, cmpv, newv;
-     bool success;
--    cmpv = int128_make128(env->exclusive_val, env->exclusive_high);
--    newv = int128_make128(new_lo, new_hi);
-+    /* high and low need to be switched here because this is not actually a
-+     * 128bit store but two doublewords stored consecutively
-+     */
-+    cmpv = int128_make128(env->exclusive_high, env->exclusive_val);
-+    newv = int128_make128(new_hi, new_lo);
-     if (parallel) {
- #ifndef CONFIG_ATOMIC128
---
-.7.4

-[Qemu-devel] [PULL 22/26] hw/sd/pxa2xx_mmci: add read/write() trace events
+[Qemu-devel] [PULL 02/12] aspeed: add a GPIO controller to the SoC
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Rashmica Gupta <rashmica.g@gmail.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 20180104000156.30932-1-f4bug@amsat.org
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
-[PMM: add missing include]
+Message-id: 20190904070506.1052-3-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/pxa2xx_mmci.c | 78 ++++++++++++++++++++++++++++++++++-------------------
+ include/hw/arm/aspeed_soc.h |  3 +++
- hw/sd/trace-events  |  4 +++
+ hw/arm/aspeed_soc.c         | 17 +++++++++++++++++
-files changed, 54 insertions(+), 28 deletions(-)
+files changed, 20 insertions(+)
-diff --git a/hw/sd/pxa2xx_mmci.c b/hw/sd/pxa2xx_mmci.c
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/pxa2xx_mmci.c
+--- a/include/hw/arm/aspeed_soc.h
-+++ b/hw/sd/pxa2xx_mmci.c
++++ b/include/hw/arm/aspeed_soc.h
 @@ -XXX,XX +XXX,XX @@
- #include "hw/qdev.h"
+ #include "hw/watchdog/wdt_aspeed.h"
- #include "hw/qdev-properties.h"
+ #include "hw/net/ftgmac100.h"
- #include "qemu/error-report.h"
+ #include "target/arm/cpu.h"
-+#include "qemu/log.h"
++#include "hw/gpio/aspeed_gpio.h"
-+#include "trace.h"
+ #define ASPEED_SPIS_NUM  2
- #define TYPE_PXA2XX_MMCI "pxa2xx-mmci"
+ #define ASPEED_WDTS_NUM  3
- #define PXA2XX_MMCI(obj) OBJECT_CHECK(PXA2xxMMCIState, (obj), TYPE_PXA2XX_MMCI)
+@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_mmci_wakequeues(PXA2xxMMCIState *s)
+     AspeedSDMCState sdmc;
- static uint64_t pxa2xx_mmci_read(void *opaque, hwaddr offset, unsigned size)
+     AspeedWDTState wdt[ASPEED_WDTS_NUM];
- {
+     FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
-     PXA2xxMMCIState *s = (PXA2xxMMCIState *) opaque;
++    AspeedGPIOState gpio;
--    uint32_t ret;
+ } AspeedSoCState;
-+    uint32_t ret = 0;
+ #define TYPE_ASPEED_SOC "aspeed-soc"
-     switch (offset) {
+@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
-     case MMC_STRPCL:
+     int spis_num;
--        return 0;
+     const char *fmc_typename;
-+        break;
+     const char **spi_typename;
-     case MMC_STAT:
++    const char *gpio_typename;
--        return s->status;
+     int wdts_num;
-+        ret = s->status;
+     const int *irqmap;
-+        break;
+     const hwaddr *memmap;
-     case MMC_CLKRT:
+diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
--        return s->clkrt;
+index XXXXXXX..XXXXXXX 100644
-+        ret = s->clkrt;
+--- a/hw/arm/aspeed_soc.c
-+        break;
++++ b/hw/arm/aspeed_soc.c
-     case MMC_SPI:
+@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
--        return s->spi;
+         .spis_num     = 1,
-+        ret = s->spi;
+         .fmc_typename = "aspeed.smc.fmc",
-+        break;
+         .spi_typename = aspeed_soc_ast2400_typenames,
-     case MMC_CMDAT:
++        .gpio_typename = "aspeed.gpio-ast2400",
--        return s->cmdat;
+         .wdts_num     = 2,
-+        ret = s->cmdat;
+         .irqmap       = aspeed_soc_ast2400_irqmap,
-+        break;
+         .memmap       = aspeed_soc_ast2400_memmap,
-     case MMC_RESTO:
+@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
--        return s->resp_tout;
+         .spis_num     = 1,
-+        ret = s->resp_tout;
+         .fmc_typename = "aspeed.smc.fmc",
-+        break;
+         .spi_typename = aspeed_soc_ast2400_typenames,
-     case MMC_RDTO:
++        .gpio_typename = "aspeed.gpio-ast2400",
--        return s->read_tout;
+         .wdts_num     = 2,
-+        ret = s->read_tout;
+         .irqmap       = aspeed_soc_ast2400_irqmap,
-+        break;
+         .memmap       = aspeed_soc_ast2400_memmap,
-     case MMC_BLKLEN:
+@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
--        return s->blklen;
+         .spis_num     = 1,
-+        ret = s->blklen;
+         .fmc_typename = "aspeed.smc.fmc",
-+        break;
+         .spi_typename = aspeed_soc_ast2400_typenames,
-     case MMC_NUMBLK:
++        .gpio_typename = "aspeed.gpio-ast2400",
--        return s->numblk;
+         .wdts_num     = 2,
-+        ret = s->numblk;
+         .irqmap       = aspeed_soc_ast2400_irqmap,
-+        break;
+         .memmap       = aspeed_soc_ast2400_memmap,
-     case MMC_PRTBUF:
+@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
--        return 0;
+         .spis_num     = 2,
-+        break;
+         .fmc_typename = "aspeed.smc.ast2500-fmc",
-     case MMC_I_MASK:
+         .spi_typename = aspeed_soc_ast2500_typenames,
--        return s->intmask;
++        .gpio_typename = "aspeed.gpio-ast2500",
-+        ret = s->intmask;
+         .wdts_num     = 3,
-+        break;
+         .irqmap       = aspeed_soc_ast2500_irqmap,
-     case MMC_I_REG:
+         .memmap       = aspeed_soc_ast2500_memmap,
--        return s->intreq;
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
-+        ret = s->intreq;
-+        break;
+     sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
-     case MMC_CMD:
+                           TYPE_ASPEED_XDMA);
--        return s->cmd | 0x40;
++
-+        ret = s->cmd | 0x40;
++    sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
-+        break;
++                          sc->info->gpio_typename);
      case MMC_ARGH:
 -        return s->arg >> 16;
 +        ret = s->arg >> 16;
 +        break;
      case MMC_ARGL:
 -        return s->arg & 0xffff;
 +        ret = s->arg & 0xffff;
 +        break;
      case MMC_RES:
 -        if (s->resp_len < 9)
 -            return s->resp_fifo[s->resp_len ++];
 -        return 0;
 +        ret = (s->resp_len < 9) ? s->resp_fifo[s->resp_len++] : 0;
 +        break;
      case MMC_RXFIFO:
 -        ret = 0;
          while (size-- && s->rx_len) {
              ret |= s->rx_fifo[s->rx_start++] << (size << 3);
              s->rx_start &= 0x1f;
@@ -XXX,XX +XXX,XX @@ static uint64_t pxa2xx_mmci_read(void *opaque, hwaddr offset, unsigned size)
          }
          s->intreq &= ~INT_RXFIFO_REQ;
          pxa2xx_mmci_fifo_update(s);
 -        return ret;
 +        break;
      case MMC_RDWAIT:
 -        return 0;
 +        break;
      case MMC_BLKS_REM:
 -        return s->numblk;
 +        ret = s->numblk;
 +        break;
      default:
 -        hw_error("%s: Bad offset " REG_FMT "\n", __FUNCTION__, offset);
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: incorrect register 0x%02" HWADDR_PRIx "\n",
 +                      __func__, offset);
      }
 +    trace_pxa2xx_mmci_read(size, offset, ret);
 -    return 0;
 +    return ret;
  }
- static void pxa2xx_mmci_write(void *opaque,
+ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_mmci_write(void *opaque,
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
- {
+                     sc->info->memmap[ASPEED_XDMA]);
-     PXA2xxMMCIState *s = (PXA2xxMMCIState *) opaque;
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
+                        aspeed_soc_get_irq(s, ASPEED_XDMA));
-+    trace_pxa2xx_mmci_write(size, offset, value);
++
-     switch (offset) {
++    /* GPIO */
-     case MMC_STRPCL:
++    object_property_set_bool(OBJECT(&s->gpio), true, "realized", &err);
-         if (value & STRPCL_STRT_CLK) {
++    if (err) {
-@@ -XXX,XX +XXX,XX @@ static void pxa2xx_mmci_write(void *opaque,
++        error_propagate(errp, err);
++        return;
-     case MMC_SPI:
++    }
-         s->spi = value & 0xf;
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->info->memmap[ASPEED_GPIO]);
--        if (value & SPI_SPI_MODE)
++    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
--            printf("%s: attempted to use card in SPI mode\n", __FUNCTION__);
++                       aspeed_soc_get_irq(s, ASPEED_GPIO));
 +        if (value & SPI_SPI_MODE) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: attempted to use card in SPI mode\n", __func__);
 +        }
          break;
      case MMC_CMDAT:
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_mmci_write(void *opaque,
          break;
      default:
 -        hw_error("%s: Bad offset " REG_FMT "\n", __FUNCTION__, offset);
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: incorrect reg 0x%02" HWADDR_PRIx " "
 +                      "(value 0x%08" PRIx64 ")\n", __func__, offset, value);
      }
  }
+ static Property aspeed_soc_properties[] = {
-diff --git a/hw/sd/trace-events b/hw/sd/trace-events
+     DEFINE_PROP_UINT32("num-cpus", AspeedSoCState, num_cpus, 0),
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sd/trace-events
 +++ b/hw/sd/trace-events
@@ -XXX,XX +XXX,XX @@
  # hw/sd/milkymist-memcard.c
  milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
  milkymist_memcard_memory_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 +
 +# hw/sd/pxa2xx_mmci.c
 +pxa2xx_mmci_read(uint8_t size, uint32_t addr, uint32_t value) "size %d addr 0x%02x value 0x%08x"
 +pxa2xx_mmci_write(uint8_t size, uint32_t addr, uint32_t value) "size %d addr 0x%02x value 0x%08x"
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 13/26] imx_fec: Move Tx frame buffer away from the stack
+[Qemu-devel] [PULL 03/12] aspeed: Remove unused SoC definitions
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Cédric Le Goater <clg@kaod.org>
-Make Tx frame assembly buffer to be a paort of IMXFECState structure
+There are no QEMU Aspeed machines using the SoCs "ast2400-a0" or
-to avoid a concern about having large data buffer on the stack.
+"ast2400".
-Cc: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Cc: Jason Wang <jasowang@redhat.com>
+Message-id: 20190904070506.1052-4-clg@kaod.org
 Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Cc: yurovsky@gmail.com
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/net/imx_fec.h |  3 +++
+ hw/arm/aspeed_soc.c | 26 --------------------------
- hw/net/imx_fec.c         | 22 +++++++++++-----------
+file changed, 26 deletions(-)
 files changed, 14 insertions(+), 11 deletions(-)
-diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
+diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/net/imx_fec.h
+--- a/hw/arm/aspeed_soc.c
-+++ b/include/hw/net/imx_fec.h
++++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@ typedef struct IMXFECState {
+@@ -XXX,XX +XXX,XX @@ static const char *aspeed_soc_ast2500_typenames[] = {
-     uint32_t phy_int_mask;
+ static const AspeedSoCInfo aspeed_socs[] = {
-     bool is_fec;
+     {
-+
+-        .name         = "ast2400-a0",
-+    /* Buffer used to assemble a Tx frame */
+-        .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
-+    uint8_t frame[ENET_MAX_FRAME_SIZE];
+-        .silicon_rev  = AST2400_A0_SILICON_REV,
- } IMXFECState;
+-        .sram_size    = 0x8000,
+-        .spis_num     = 1,
- #endif
+-        .fmc_typename = "aspeed.smc.fmc",
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+-        .spi_typename = aspeed_soc_ast2400_typenames,
-index XXXXXXX..XXXXXXX 100644
+-        .gpio_typename = "aspeed.gpio-ast2400",
---- a/hw/net/imx_fec.c
+-        .wdts_num     = 2,
-+++ b/hw/net/imx_fec.c
+-        .irqmap       = aspeed_soc_ast2400_irqmap,
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_update(IMXFECState *s)
+-        .memmap       = aspeed_soc_ast2400_memmap,
- static void imx_fec_do_tx(IMXFECState *s)
+-        .num_cpus     = 1,
- {
+-    }, {
-     int frame_size = 0, descnt = 0;
+         .name         = "ast2400-a1",
--    uint8_t frame[ENET_MAX_FRAME_SIZE];
+         .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
--    uint8_t *ptr = frame;
+         .silicon_rev  = AST2400_A1_SILICON_REV,
-+    uint8_t *ptr = s->frame;
+@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
-     uint32_t addr = s->tx_descriptor;
+         .irqmap       = aspeed_soc_ast2400_irqmap,
+         .memmap       = aspeed_soc_ast2400_memmap,
-     while (descnt++ < IMX_MAX_DESC) {
+         .num_cpus     = 1,
-@@ -XXX,XX +XXX,XX @@ static void imx_fec_do_tx(IMXFECState *s)
+-    }, {
-         frame_size += len;
+-        .name         = "ast2400",
-         if (bd.flags & ENET_BD_L) {
+-        .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
-             /* Last buffer in frame.  */
+-        .silicon_rev  = AST2400_A0_SILICON_REV,
--            qemu_send_packet(qemu_get_queue(s->nic), frame, frame_size);
+-        .sram_size    = 0x8000,
--            ptr = frame;
+-        .spis_num     = 1,
-+            qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size);
+-        .fmc_typename = "aspeed.smc.fmc",
-+            ptr = s->frame;
+-        .spi_typename = aspeed_soc_ast2400_typenames,
-             frame_size = 0;
+-        .gpio_typename = "aspeed.gpio-ast2400",
-             s->regs[ENET_EIR] |= ENET_INT_TXF;
+-        .wdts_num     = 2,
-         }
+-        .irqmap       = aspeed_soc_ast2400_irqmap,
-@@ -XXX,XX +XXX,XX @@ static void imx_fec_do_tx(IMXFECState *s)
+-        .memmap       = aspeed_soc_ast2400_memmap,
- static void imx_enet_do_tx(IMXFECState *s)
+-        .num_cpus     = 1,
- {
+     }, {
-     int frame_size = 0, descnt = 0;
+         .name         = "ast2500-a1",
--    uint8_t frame[ENET_MAX_FRAME_SIZE];
+         .cpu_type     = ARM_CPU_TYPE_NAME("arm1176"),
 -    uint8_t *ptr = frame;
 +    uint8_t *ptr = s->frame;
      uint32_t addr = s->tx_descriptor;
      while (descnt++ < IMX_MAX_DESC) {
@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s)
          frame_size += len;
          if (bd.flags & ENET_BD_L) {
              if (bd.option & ENET_BD_PINS) {
 -                struct ip_header *ip_hd = PKT_GET_IP_HDR(frame);
 +                struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame);
                  if (IP_HEADER_VERSION(ip_hd) == 4) {
 -                    net_checksum_calculate(frame, frame_size);
 +                    net_checksum_calculate(s->frame, frame_size);
                  }
              }
              if (bd.option & ENET_BD_IINS) {
 -                struct ip_header *ip_hd = PKT_GET_IP_HDR(frame);
 +                struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame);
                  /* We compute checksum only for IPv4 frames */
                  if (IP_HEADER_VERSION(ip_hd) == 4) {
                      uint16_t csum;
@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s)
                  }
              }
              /* Last buffer in frame.  */
 -            qemu_send_packet(qemu_get_queue(s->nic), frame, len);
 -            ptr = frame;
 +
 +            qemu_send_packet(qemu_get_queue(s->nic), s->frame, len);
 +            ptr = s->frame;
 +
              frame_size = 0;
              if (bd.option & ENET_BD_TX_INT) {
                  s->regs[ENET_EIR] |= ENET_INT_TXF;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 11/26] imx_fec: Refactor imx_eth_enable_rx()
+[Qemu-devel] [PULL 04/12] aspeed: Use consistent typenames
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Cédric Le Goater <clg@kaod.org>
-Refactor imx_eth_enable_rx() to have more meaningfull variable name
+Improve the naming of the different controller models to ease their
-than 'tmp' and to reduce number of logical negations done.
+generation when initializing the SoC. The rename of the SMC types is
 breaking migration compatibility.
-Cc: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Cc: Jason Wang <jasowang@redhat.com>
+Message-id: 20190904070506.1052-5-clg@kaod.org
 Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Cc: yurovsky@gmail.com
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/imx_fec.c | 8 ++++----
+ include/hw/arm/aspeed_soc.h |  3 ---
-file changed, 4 insertions(+), 4 deletions(-)
+ hw/arm/aspeed_soc.c         | 25 ++++++++++++-------------
  hw/ssi/aspeed_smc.c         | 12 ++++++------
 files changed, 18 insertions(+), 22 deletions(-)
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
+--- a/include/hw/arm/aspeed_soc.h
-+++ b/hw/net/imx_fec.c
++++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_do_tx(IMXFECState *s)
+@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
- static void imx_eth_enable_rx(IMXFECState *s)
+     uint32_t silicon_rev;
- {
+     uint64_t sram_size;
-     IMXFECBufDesc bd;
+     int spis_num;
--    bool tmp;
+-    const char *fmc_typename;
-+    bool rx_ring_full;
+-    const char **spi_typename;
+-    const char *gpio_typename;
-     imx_fec_read_bd(&bd, s->rx_descriptor);
+     int wdts_num;
+     const int *irqmap;
--    tmp = ((bd.flags & ENET_BD_E) != 0);
+     const hwaddr *memmap;
-+    rx_ring_full = !(bd.flags & ENET_BD_E);
+diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
+index XXXXXXX..XXXXXXX 100644
--    if (!tmp) {
+--- a/hw/arm/aspeed_soc.c
-+    if (rx_ring_full) {
++++ b/hw/arm/aspeed_soc.c
-         FEC_PRINTF("RX buffer full\n");
+@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2400_irqmap[] = {
-     } else if (!s->regs[ENET_RDAR]) {
-         qemu_flush_queued_packets(qemu_get_queue(s->nic));
+ #define aspeed_soc_ast2500_irqmap aspeed_soc_ast2400_irqmap
 -static const char *aspeed_soc_ast2400_typenames[] = { "aspeed.smc.spi" };
 -static const char *aspeed_soc_ast2500_typenames[] = {
 -    "aspeed.smc.ast2500-spi1", "aspeed.smc.ast2500-spi2" };
 -
  static const AspeedSoCInfo aspeed_socs[] = {
      {
          .name         = "ast2400-a1",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .silicon_rev  = AST2400_A1_SILICON_REV,
          .sram_size    = 0x8000,
          .spis_num     = 1,
 -        .fmc_typename = "aspeed.smc.fmc",
 -        .spi_typename = aspeed_soc_ast2400_typenames,
 -        .gpio_typename = "aspeed.gpio-ast2400",
          .wdts_num     = 2,
          .irqmap       = aspeed_soc_ast2400_irqmap,
          .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .silicon_rev  = AST2500_A1_SILICON_REV,
          .sram_size    = 0x9000,
          .spis_num     = 2,
 -        .fmc_typename = "aspeed.smc.ast2500-fmc",
 -        .spi_typename = aspeed_soc_ast2500_typenames,
 -        .gpio_typename = "aspeed.gpio-ast2500",
          .wdts_num     = 3,
          .irqmap       = aspeed_soc_ast2500_irqmap,
          .memmap       = aspeed_soc_ast2500_memmap,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      AspeedSoCState *s = ASPEED_SOC(obj);
      AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
      int i;
 +    char socname[8];
 +    char typename[64];
 +
 +    if (sscanf(sc->info->name, "%7s", socname) != 1) {
 +        g_assert_not_reached();
 +    }
      for (i = 0; i < sc->info->num_cpus; i++) {
          object_initialize_child(obj, "cpu[*]", OBJECT(&s->cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      sysbus_init_child_obj(obj, "i2c", OBJECT(&s->i2c), sizeof(s->i2c),
                            TYPE_ASPEED_I2C);
 +    snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
      sysbus_init_child_obj(obj, "fmc", OBJECT(&s->fmc), sizeof(s->fmc),
 -                          sc->info->fmc_typename);
 +                          typename);
      object_property_add_alias(obj, "num-cs", OBJECT(&s->fmc), "num-cs",
                                &error_abort);
      for (i = 0; i < sc->info->spis_num; i++) {
 +        snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
          sysbus_init_child_obj(obj, "spi[*]", OBJECT(&s->spi[i]),
 -                              sizeof(s->spi[i]), sc->info->spi_typename[i]);
 +                              sizeof(s->spi[i]), typename);
      }
--    s->regs[ENET_RDAR] = tmp ? ENET_RDAR_RDAR : 0;
+     sysbus_init_child_obj(obj, "sdmc", OBJECT(&s->sdmc), sizeof(s->sdmc),
-+    s->regs[ENET_RDAR] = rx_ring_full ? 0 : ENET_RDAR_RDAR;
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
                            TYPE_ASPEED_XDMA);
 +    snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
      sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
 -                          sc->info->gpio_typename);
 +                          typename);
  }
- static void imx_eth_reset(DeviceState *d)
+ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
 diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/aspeed_smc.c
 +++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSegments aspeed_segments_ast2500_spi2[] = {
  static const AspeedSMCController controllers[] = {
      {
 -        .name              = "aspeed.smc.smc",
 +        .name              = "aspeed.smc-ast2400",
          .r_conf            = R_CONF,
          .r_ce_ctrl         = R_CE_CTRL,
          .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .has_dma           = false,
          .nregs             = ASPEED_SMC_R_SMC_MAX,
      }, {
 -        .name              = "aspeed.smc.fmc",
 +        .name              = "aspeed.fmc-ast2400",
          .r_conf            = R_CONF,
          .r_ce_ctrl         = R_CE_CTRL,
          .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .has_dma           = true,
          .nregs             = ASPEED_SMC_R_MAX,
      }, {
 -        .name              = "aspeed.smc.spi",
 +        .name              = "aspeed.spi1-ast2400",
          .r_conf            = R_SPI_CONF,
          .r_ce_ctrl         = 0xff,
          .r_ctrl0           = R_SPI_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .has_dma           = false,
          .nregs             = ASPEED_SMC_R_SPI_MAX,
      }, {
 -        .name              = "aspeed.smc.ast2500-fmc",
 +        .name              = "aspeed.fmc-ast2500",
          .r_conf            = R_CONF,
          .r_ce_ctrl         = R_CE_CTRL,
          .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .has_dma           = true,
          .nregs             = ASPEED_SMC_R_MAX,
      }, {
 -        .name              = "aspeed.smc.ast2500-spi1",
 +        .name              = "aspeed.spi1-ast2500",
          .r_conf            = R_CONF,
          .r_ce_ctrl         = R_CE_CTRL,
          .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .has_dma           = false,
          .nregs             = ASPEED_SMC_R_MAX,
      }, {
 -        .name              = "aspeed.smc.ast2500-spi2",
 +        .name              = "aspeed.spi2-ast2500",
          .r_conf            = R_CONF,
          .r_ce_ctrl         = R_CE_CTRL,
          .r_ctrl0           = R_CTRL0,
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 17/26] imx_fec: Add support for multiple Tx DMA rings
+[Qemu-devel] [PULL 05/12] aspeed/smc: Add support for DMAs
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Cédric Le Goater <clg@kaod.org>
-More recent version of the IP block support more than one Tx DMA ring,
+The FMC controller on the Aspeed SoCs support DMA to access the flash
-so add the code implementing that feature.
+modules. It can operate in a normal mode, to copy to or from the flash
+module mapping window, or in a checksum calculation mode, to evaluate
-Cc: Peter Maydell <peter.maydell@linaro.org>
+the best clock settings for reads.
-Cc: Jason Wang <jasowang@redhat.com>
-Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The model introduces two custom address spaces for DMAs: one for the
-Cc: qemu-devel@nongnu.org
+AHB window of the FMC flash devices and one for the DRAM. The latter
-Cc: qemu-arm@nongnu.org
+is populated using a "dram" link set from the machine with the RAM
-Cc: yurovsky@gmail.com
+container region.
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Acked-by: Joel Stanley <joel@jms.id.au>
 Message-id: 20190904070506.1052-6-clg@kaod.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/net/imx_fec.h |  18 ++++++-
+ include/hw/ssi/aspeed_smc.h |   6 +
- hw/net/imx_fec.c         | 133 ++++++++++++++++++++++++++++++++++++++++-------
+ hw/arm/aspeed.c             |   2 +
-files changed, 130 insertions(+), 21 deletions(-)
+ hw/arm/aspeed_soc.c         |   2 +
+ hw/ssi/aspeed_smc.c         | 222 +++++++++++++++++++++++++++++++++++-
-diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
+files changed, 226 insertions(+), 6 deletions(-)
 diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/net/imx_fec.h
+--- a/include/hw/ssi/aspeed_smc.h
-+++ b/include/hw/net/imx_fec.h
++++ b/include/hw/ssi/aspeed_smc.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCController {
      hwaddr flash_window_base;
      uint32_t flash_window_size;
      bool has_dma;
 +    hwaddr dma_flash_mask;
 +    hwaddr dma_dram_mask;
      uint32_t nregs;
  } AspeedSMCController;
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCState {
      /* for DMA support */
      uint64_t sdram_base;
 +    AddressSpace flash_as;
 +    MemoryRegion *dram_mr;
 +    AddressSpace dram_as;
 +
      AspeedSMCFlash *flashes;
      uint8_t snoop_index;
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed.c
 +++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
                              &error_abort);
      object_property_set_int(OBJECT(&bmc->soc), machine->smp.cpus, "num-cpus",
                              &error_abort);
 +    object_property_set_link(OBJECT(&bmc->soc), OBJECT(&bmc->ram_container),
 +                             "dram", &error_abort);
      if (machine->kernel_filename) {
          /*
           * When booting with a -kernel command line there is no u-boot
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                            typename);
      object_property_add_alias(obj, "num-cs", OBJECT(&s->fmc), "num-cs",
                                &error_abort);
 +    object_property_add_alias(obj, "dram", OBJECT(&s->fmc), "dram",
 +                              &error_abort);
      for (i = 0; i < sc->info->spis_num; i++) {
          snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
 diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/aspeed_smc.c
 +++ b/hw/ssi/aspeed_smc.c
 @@ -XXX,XX +XXX,XX @@
- #define ENET_TFWR              81
+ #include "qemu/log.h"
- #define ENET_FRBR              83
+ #include "qemu/module.h"
- #define ENET_FRSR              84
+ #include "qemu/error-report.h"
-+#define ENET_TDSR1             89
++#include "qapi/error.h"
-+#define ENET_TDSR2             92
++#include "exec/address-spaces.h"
- #define ENET_RDSR              96
- #define ENET_TDSR              97
+ #include "hw/irq.h"
- #define ENET_MRBR              98
+ #include "hw/qdev-properties.h"
 @@ -XXX,XX +XXX,XX @@
- #define ENET_FTRL              108
+ #define   DMA_CTRL_FREQ_SHIFT   4
- #define ENET_TACC              112
+ #define   DMA_CTRL_MODE         (1 << 3)
- #define ENET_RACC              113
+ #define   DMA_CTRL_CKSUM        (1 << 2)
-+#define ENET_TDAR1             121
+-#define   DMA_CTRL_DIR          (1 << 1)
-+#define ENET_TDAR2             123
+-#define   DMA_CTRL_EN           (1 << 0)
- #define ENET_MIIGSK_CFGR       192
++#define   DMA_CTRL_WRITE        (1 << 1)
- #define ENET_MIIGSK_ENR        194
++#define   DMA_CTRL_ENABLE       (1 << 0)
- #define ENET_ATCR              256
  /* DMA Flash Side Address */
  #define R_DMA_FLASH_ADDR  (0x84 / 4)
 @@ -XXX,XX +XXX,XX @@
- #define ENET_INT_WAKEUP        (1 << 17)
+ #define ASPEED_SOC_SPI_FLASH_BASE   0x30000000
- #define ENET_INT_TS_AVAIL      (1 << 16)
+ #define ASPEED_SOC_SPI2_FLASH_BASE  0x38000000
- #define ENET_INT_TS_TIMER      (1 << 15)
-+#define ENET_INT_TXF2          (1 <<  7)
++/*
-+#define ENET_INT_TXB2          (1 <<  6)
++ * DMA DRAM addresses should be 4 bytes aligned and the valid address
-+#define ENET_INT_TXF1          (1 <<  3)
++ * range is 0x40000000 - 0x5FFFFFFF (AST2400)
-+#define ENET_INT_TXB1          (1 <<  2)
++ *          0x80000000 - 0xBFFFFFFF (AST2500)
++ *
- #define ENET_INT_MAC           (ENET_INT_HB | ENET_INT_BABR | ENET_INT_BABT | \
++ * DMA flash addresses should be 4 bytes aligned and the valid address
-                                 ENET_INT_GRA | ENET_INT_TXF | ENET_INT_TXB | \
++ * range is 0x20000000 - 0x2FFFFFFF.
-                                 ENET_INT_RXF | ENET_INT_RXB | ENET_INT_MII | \
++ *
-                                 ENET_INT_EBERR | ENET_INT_LC | ENET_INT_RL | \
++ * DMA length is from 4 bytes to 32MB
-                                 ENET_INT_UN | ENET_INT_PLR | ENET_INT_WAKEUP | \
++ *   0: 4 bytes
--                                ENET_INT_TS_AVAIL)
++ *   0x7FFFFF: 32M bytes
-+                                ENET_INT_TS_AVAIL | ENET_INT_TXF1 | \
++ */
-+                                ENET_INT_TXB1 | ENET_INT_TXF2 | ENET_INT_TXB2)
++#define DMA_DRAM_ADDR(s, val)   ((s)->sdram_base | \
++                                 ((val) & (s)->ctrl->dma_dram_mask))
- /* RDAR */
++#define DMA_FLASH_ADDR(s, val)  ((s)->ctrl->flash_window_base | \
- #define ENET_RDAR_RDAR         (1 << 24)
++                                ((val) & (s)->ctrl->dma_flash_mask))
-@@ -XXX,XX +XXX,XX @@ typedef struct {
++#define DMA_LENGTH(val)         ((val) & 0x01FFFFFC)
++
- #define ENET_BD_BDU            (1 << 31)
+ /* Flash opcodes. */
+ #define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
-+#define ENET_TX_RING_NUM       3
-+
+@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
-+
+         .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
- typedef struct IMXFECState {
+         .flash_window_size = 0x10000000,
-     /*< private >*/
+         .has_dma           = true,
-     SysBusDevice parent_obj;
++        .dma_flash_mask    = 0x0FFFFFFC,
-@@ -XXX,XX +XXX,XX @@ typedef struct IMXFECState {
++        .dma_dram_mask     = 0x1FFFFFFC,
+         .nregs             = ASPEED_SMC_R_MAX,
-     uint32_t regs[ENET_MAX];
+     }, {
-     uint32_t rx_descriptor;
+         .name              = "aspeed.spi1-ast2400",
--    uint32_t tx_descriptor;
+@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
-+
+         .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
-+    uint32_t tx_descriptor[ENET_TX_RING_NUM];
+         .flash_window_size = 0x10000000,
-+    uint32_t tx_ring_num;
+         .has_dma           = true,
++        .dma_flash_mask    = 0x0FFFFFFC,
-     uint32_t phy_status;
++        .dma_dram_mask     = 0x3FFFFFFC,
-     uint32_t phy_control;
+         .nregs             = ASPEED_SMC_R_MAX,
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+     }, {
-index XXXXXXX..XXXXXXX 100644
+         .name              = "aspeed.spi1-ast2500",
---- a/hw/net/imx_fec.c
+@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reset(DeviceState *d)
-+++ b/hw/net/imx_fec.c
-@@ -XXX,XX +XXX,XX @@ static const char *imx_eth_reg_name(IMXFECState *s, uint32_t index)
+     memset(s->regs, 0, sizeof s->regs);
 -    /* Pretend DMA is done (u-boot initialization) */
 -    s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS;
 -
      /* Unselect all slaves */
      for (i = 0; i < s->num_cs; ++i) {
          s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
          addr == s->r_ce_ctrl ||
          addr == R_INTR_CTRL ||
          addr == R_DUMMY_DATA ||
 +        (s->ctrl->has_dma && addr == R_DMA_CTRL) ||
 +        (s->ctrl->has_dma && addr == R_DMA_FLASH_ADDR) ||
 +        (s->ctrl->has_dma && addr == R_DMA_DRAM_ADDR) ||
 +        (s->ctrl->has_dma && addr == R_DMA_LEN) ||
 +        (s->ctrl->has_dma && addr == R_DMA_CHECKSUM) ||
          (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) ||
          (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->ctrl->max_slaves)) {
          return s->regs[addr];
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
      }
  }
 +/*
-+ * Versions of this device with more than one TX descriptor save the
++ * Accumulate the result of the reads to provide a checksum that will
-+ * 2nd and 3rd descriptors in a subsection, to maintain migration
++ * be used to validate the read timing settings.
 + * compatibility with previous versions of the device that only
 + * supported a single descriptor.
 + */
-+static bool imx_eth_is_multi_tx_ring(void *opaque)
++static void aspeed_smc_dma_checksum(AspeedSMCState *s)
 +{
-+    IMXFECState *s = IMX_FEC(opaque);
++    MemTxResult result;
-+
++    uint32_t data;
-+    return s->tx_ring_num > 1;
++
-+}
++    if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
 +
 +static const VMStateDescription vmstate_imx_eth_txdescs = {
 +    .name = "imx.fec/txdescs",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = imx_eth_is_multi_tx_ring,
 +    .fields = (VMStateField[]) {
 +         VMSTATE_UINT32(tx_descriptor[1], IMXFECState),
 +         VMSTATE_UINT32(tx_descriptor[2], IMXFECState),
 +         VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static const VMStateDescription vmstate_imx_eth = {
      .name = TYPE_IMX_FEC,
      .version_id = 2,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_eth = {
      .fields = (VMStateField[]) {
          VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX),
          VMSTATE_UINT32(rx_descriptor, IMXFECState),
 -        VMSTATE_UINT32(tx_descriptor, IMXFECState),
 -
 +        VMSTATE_UINT32(tx_descriptor[0], IMXFECState),
          VMSTATE_UINT32(phy_status, IMXFECState),
          VMSTATE_UINT32(phy_control, IMXFECState),
          VMSTATE_UINT32(phy_advertise, IMXFECState),
          VMSTATE_UINT32(phy_int, IMXFECState),
          VMSTATE_UINT32(phy_int_mask, IMXFECState),
          VMSTATE_END_OF_LIST()
 -    }
 +    },
 +    .subsections = (const VMStateDescription * []) {
 +        &vmstate_imx_eth_txdescs,
 +        NULL
 +    },
  };
  #define PHY_INT_ENERGYON            (1 << 7)
@@ -XXX,XX +XXX,XX @@ static void imx_fec_do_tx(IMXFECState *s)
  {
      int frame_size = 0, descnt = 0;
      uint8_t *ptr = s->frame;
 -    uint32_t addr = s->tx_descriptor;
 +    uint32_t addr = s->tx_descriptor[0];
      while (descnt++ < IMX_MAX_DESC) {
          IMXFECBufDesc bd;
@@ -XXX,XX +XXX,XX @@ static void imx_fec_do_tx(IMXFECState *s)
          }
      }
 -    s->tx_descriptor = addr;
 +    s->tx_descriptor[0] = addr;
      imx_eth_update(s);
  }
 -static void imx_enet_do_tx(IMXFECState *s)
 +static void imx_enet_do_tx(IMXFECState *s, uint32_t index)
  {
      int frame_size = 0, descnt = 0;
 +
      uint8_t *ptr = s->frame;
 -    uint32_t addr = s->tx_descriptor;
 +    uint32_t addr, int_txb, int_txf, tdsr;
 +    size_t ring;
 +
 +    switch (index) {
 +    case ENET_TDAR:
 +        ring    = 0;
 +        int_txb = ENET_INT_TXB;
 +        int_txf = ENET_INT_TXF;
 +        tdsr    = ENET_TDSR;
 +        break;
 +    case ENET_TDAR1:
 +        ring    = 1;
 +        int_txb = ENET_INT_TXB1;
 +        int_txf = ENET_INT_TXF1;
 +        tdsr    = ENET_TDSR1;
 +        break;
 +    case ENET_TDAR2:
 +        ring    = 2;
 +        int_txb = ENET_INT_TXB2;
 +        int_txf = ENET_INT_TXF2;
 +        tdsr    = ENET_TDSR2;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "%s: bogus value for index %x\n",
++                      "%s: invalid direction for DMA checksum\n",  __func__);
-+                      __func__, index);
++        return;
-+        abort();
++    }
-+        break;
++
-+    }
++    while (s->regs[R_DMA_LEN]) {
-+
++        data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
-+    addr = s->tx_descriptor[ring];
++                                    MEMTXATTRS_UNSPECIFIED, &result);
++        if (result != MEMTX_OK) {
-     while (descnt++ < IMX_MAX_DESC) {
++            qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash read failed @%08x\n",
-         IMXENETBufDesc bd;
++                          __func__, s->regs[R_DMA_FLASH_ADDR]);
@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s)
              frame_size = 0;
              if (bd.option & ENET_BD_TX_INT) {
 -                s->regs[ENET_EIR] |= ENET_INT_TXF;
 +                s->regs[ENET_EIR] |= int_txf;
              }
          }
          if (bd.option & ENET_BD_TX_INT) {
 -            s->regs[ENET_EIR] |= ENET_INT_TXB;
 +            s->regs[ENET_EIR] |= int_txb;
          }
          bd.flags &= ~ENET_BD_R;
          /* Write back the modified descriptor.  */
          imx_enet_write_bd(&bd, addr);
          /* Advance to the next descriptor.  */
          if ((bd.flags & ENET_BD_W) != 0) {
 -            addr = s->regs[ENET_TDSR];
 +            addr = s->regs[tdsr];
          } else {
              addr += sizeof(bd);
          }
      }
 -    s->tx_descriptor = addr;
 +    s->tx_descriptor[ring] = addr;
      imx_eth_update(s);
  }
 -static void imx_eth_do_tx(IMXFECState *s)
 +static void imx_eth_do_tx(IMXFECState *s, uint32_t index)
  {
      if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) {
 -        imx_enet_do_tx(s);
 +        imx_enet_do_tx(s, index);
      } else {
          imx_fec_do_tx(s);
      }
@@ -XXX,XX +XXX,XX @@ static void imx_eth_reset(DeviceState *d)
      }
      s->rx_descriptor = 0;
 -    s->tx_descriptor = 0;
 +    memset(s->tx_descriptor, 0, sizeof(s->tx_descriptor));
      /* We also reset the PHY */
      phy_reset(s);
@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
                             unsigned size)
  {
      IMXFECState *s = IMX_FEC(opaque);
 +    const bool single_tx_ring = !imx_eth_is_multi_tx_ring(s);
      uint32_t index = offset >> 2;
      FEC_PRINTF("reg[%s] <= 0x%" PRIx32 "\n", imx_eth_reg_name(s, index),
@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
              s->regs[index] = 0;
          }
          break;
 -    case ENET_TDAR:
 +    case ENET_TDAR1:    /* FALLTHROUGH */
 +    case ENET_TDAR2:    /* FALLTHROUGH */
 +        if (unlikely(single_tx_ring)) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "[%s]%s: trying to access TDAR2 or TDAR1\n",
 +                          TYPE_IMX_FEC, __func__);
 +            return;
 +        }
-+    case ENET_TDAR:     /* FALLTHROUGH */
++
-         if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
++        /*
-             s->regs[index] = ENET_TDAR_TDAR;
++         * When the DMA is on-going, the DMA registers are updated
--            imx_eth_do_tx(s);
++         * with the current working addresses and length.
-+            imx_eth_do_tx(s, index);
++         */
 +        s->regs[R_DMA_CHECKSUM] += data;
 +        s->regs[R_DMA_FLASH_ADDR] += 4;
 +        s->regs[R_DMA_LEN] -= 4;
 +    }
 +}
 +
 +static void aspeed_smc_dma_rw(AspeedSMCState *s)
 +{
 +    MemTxResult result;
 +    uint32_t data;
 +
 +    while (s->regs[R_DMA_LEN]) {
 +        if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
 +            data = address_space_ldl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
 +                                        MEMTXATTRS_UNSPECIFIED, &result);
 +            if (result != MEMTX_OK) {
 +                qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n",
 +                              __func__, s->regs[R_DMA_DRAM_ADDR]);
 +                return;
 +            }
 +
 +            address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
 +                                 data, MEMTXATTRS_UNSPECIFIED, &result);
 +            if (result != MEMTX_OK) {
 +                qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash write failed @%08x\n",
 +                              __func__, s->regs[R_DMA_FLASH_ADDR]);
 +                return;
 +            }
 +        } else {
 +            data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
 +                                        MEMTXATTRS_UNSPECIFIED, &result);
 +            if (result != MEMTX_OK) {
 +                qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash read failed @%08x\n",
 +                              __func__, s->regs[R_DMA_FLASH_ADDR]);
 +                return;
 +            }
 +
 +            address_space_stl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
 +                                 data, MEMTXATTRS_UNSPECIFIED, &result);
 +            if (result != MEMTX_OK) {
 +                qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n",
 +                              __func__, s->regs[R_DMA_DRAM_ADDR]);
 +                return;
 +            }
 +        }
 +
 +        /*
 +         * When the DMA is on-going, the DMA registers are updated
 +         * with the current working addresses and length.
 +         */
 +        s->regs[R_DMA_FLASH_ADDR] += 4;
 +        s->regs[R_DMA_DRAM_ADDR] += 4;
 +        s->regs[R_DMA_LEN] -= 4;
 +    }
 +}
 +
 +static void aspeed_smc_dma_stop(AspeedSMCState *s)
 +{
 +    /*
 +     * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the
 +     * engine is idle
 +     */
 +    s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS;
 +    s->regs[R_DMA_CHECKSUM] = 0;
 +
 +    /*
 +     * Lower the DMA irq in any case. The IRQ control register could
 +     * have been cleared before disabling the DMA.
 +     */
 +    qemu_irq_lower(s->irq);
 +}
 +
 +/*
 + * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA
 + * can start even if the result of the previous was not collected.
 + */
 +static bool aspeed_smc_dma_in_progress(AspeedSMCState *s)
 +{
 +    return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE &&
 +        !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS);
 +}
 +
 +static void aspeed_smc_dma_done(AspeedSMCState *s)
 +{
 +    s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS;
 +    if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) {
 +        qemu_irq_raise(s->irq);
 +    }
 +}
 +
 +static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint64_t dma_ctrl)
 +{
 +    if (!(dma_ctrl & DMA_CTRL_ENABLE)) {
 +        s->regs[R_DMA_CTRL] = dma_ctrl;
 +
 +        aspeed_smc_dma_stop(s);
 +        return;
 +    }
 +
 +    if (aspeed_smc_dma_in_progress(s)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA in progress\n",  __func__);
 +        return;
 +    }
 +
 +    s->regs[R_DMA_CTRL] = dma_ctrl;
 +
 +    if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) {
 +        aspeed_smc_dma_checksum(s);
 +    } else {
 +        aspeed_smc_dma_rw(s);
 +    }
 +
 +    aspeed_smc_dma_done(s);
 +}
 +
  static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
                               unsigned int size)
  {
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
          }
-         s->regs[index] = 0;
+     } else if (addr == R_DUMMY_DATA) {
-         break;
+         s->regs[addr] = value & 0xff;
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
++    } else if (addr == R_INTR_CTRL) {
-         if ((s->regs[index] & ENET_ECR_ETHEREN) == 0) {
++        s->regs[addr] = value;
-             s->regs[ENET_RDAR] = 0;
++    } else if (s->ctrl->has_dma && addr == R_DMA_CTRL) {
-             s->rx_descriptor = s->regs[ENET_RDSR];
++        aspeed_smc_dma_ctrl(s, value);
--            s->regs[ENET_TDAR] = 0;
++    } else if (s->ctrl->has_dma && addr == R_DMA_DRAM_ADDR) {
--            s->tx_descriptor = s->regs[ENET_TDSR];
++        s->regs[addr] = DMA_DRAM_ADDR(s, value);
-+            s->regs[ENET_TDAR]  = 0;
++    } else if (s->ctrl->has_dma && addr == R_DMA_FLASH_ADDR) {
-+            s->regs[ENET_TDAR1] = 0;
++        s->regs[addr] = DMA_FLASH_ADDR(s, value);
-+            s->regs[ENET_TDAR2] = 0;
++    } else if (s->ctrl->has_dma && addr == R_DMA_LEN) {
-+            s->tx_descriptor[0] = s->regs[ENET_TDSR];
++        s->regs[addr] = DMA_LENGTH(value);
-+            s->tx_descriptor[1] = s->regs[ENET_TDSR1];
+     } else {
-+            s->tx_descriptor[2] = s->regs[ENET_TDSR2];
+         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
-         }
+                       __func__, addr);
-         break;
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_smc_ops = {
-     case ENET_MMFR:
+     .valid.unaligned = true,
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
+ };
-         } else {
-             s->regs[index] = value & ~7;
++
-         }
++/*
--        s->tx_descriptor = s->regs[index];
++ * Initialize the custom address spaces for DMAs
-+        s->tx_descriptor[0] = s->regs[index];
++ */
-+        break;
++static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp)
-+    case ENET_TDSR1:
++{
-+        if (unlikely(single_tx_ring)) {
++    char *name;
-+            qemu_log_mask(LOG_GUEST_ERROR,
++
-+                          "[%s]%s: trying to access TDSR1\n",
++    if (!s->dram_mr) {
-+                          TYPE_IMX_FEC, __func__);
++        error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set");
-+            return;
++        return;
-+        }
++    }
 +
-+        s->regs[index] = value & ~7;
++    name = g_strdup_printf("%s-dma-flash", s->ctrl->name);
-+        s->tx_descriptor[1] = s->regs[index];
++    address_space_init(&s->flash_as, &s->mmio_flash, name);
-+        break;
++    g_free(name);
-+    case ENET_TDSR2:
++
-+        if (unlikely(single_tx_ring)) {
++    name = g_strdup_printf("%s-dma-dram", s->ctrl->name);
-+            qemu_log_mask(LOG_GUEST_ERROR,
++    address_space_init(&s->dram_as, s->dram_mr, name);
-+                          "[%s]%s: trying to access TDSR2\n",
++    g_free(name);
-+                          TYPE_IMX_FEC, __func__);
++}
-+            return;
++
-+        }
+ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
-+
+ {
-+        s->regs[index] = value & ~7;
+     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-+        s->tx_descriptor[2] = s->regs[index];
+@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
-         break;
+         s->num_cs = s->ctrl->max_slaves;
-     case ENET_MRBR:
+     }
-         s->regs[index] = value & 0x00003ff0;
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)
++    /* DMA irq. Keep it first for the initialization in the SoC */
++    sysbus_init_irq(sbd, &s->irq);
- static Property imx_eth_properties[] = {
++
-     DEFINE_NIC_PROPERTIES(IMXFECState, conf),
+     s->spi = ssi_create_bus(dev, "spi");
-+    DEFINE_PROP_UINT32("tx-ring-num", IMXFECState, tx_ring_num, 1),
      /* Setup cs_lines for slaves */
 -    sysbus_init_irq(sbd, &s->irq);
      s->cs_lines = g_new0(qemu_irq, s->num_cs);
      ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
          memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
          offset += fl->size;
      }
 +
 +    /* DMA support */
 +    if (s->ctrl->has_dma) {
 +        aspeed_smc_dma_setup(s, errp);
 +    }
  }
  static const VMStateDescription vmstate_aspeed_smc = {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_smc = {
  static Property aspeed_smc_properties[] = {
      DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
      DEFINE_PROP_UINT64("sdram-base", AspeedSMCState, sdram_base, 0),
 +    DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
 +                     TYPE_MEMORY_REGION, MemoryRegion *),
      DEFINE_PROP_END_OF_LIST(),
  };
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 12/26] imx_fec: Change queue flushing heuristics
+[Qemu-devel] [PULL 06/12] aspeed/smc: Add DMA calibration settings
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Cédric Le Goater <clg@kaod.org>
-In current implementation, packet queue flushing logic seem to suffer
+When doing calibration, the SPI clock rate in the CE0 Control Register
-from a deadlock like scenario if a packet is received by the interface
+and the read delay cycles in the Read Timing Compensation Register are
-before before Rx ring is initialized by Guest's driver. Consider the
+set using bit[11:4] of the DMA Control Register.
 following sequence of events:
-. A QEMU instance is started against a TAP device on Linux
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
-       host, running Linux guest, e. g., something to the effect
+Acked-by: Joel Stanley <joel@jms.id.au>
        of:
        qemu-system-arm \
           -net nic,model=imx.fec,netdev=lan0 \
           netdev tap,id=lan0,ifname=tap0,script=no,downscript=no \
           ... rest of the arguments ...
 . Once QEMU starts, but before guest reaches the point where
        FEC deriver is done initializing the HW, Guest, via TAP
        interface, receives a number of multicast MDNS packets from
        Host (not necessarily true for every OS, but it happens at
        least on Fedora 25)
 . Recieving a packet in such a state results in
        imx_eth_can_receive() returning '0', which in turn causes
        tap_send() to disable corresponding event (tap.c:203)
 . Once Guest's driver reaches the point where it is ready to
        recieve packets it prepares Rx ring descriptors and writes
        ENET_RDAR_RDAR to ENET_RDAR register to indicate to HW that
        more descriptors are ready. And at this points emulation
        layer does this:
             s->regs[index] = ENET_RDAR_RDAR;
                  imx_eth_enable_rx(s);
        which, combined with:
              if (!s->regs[ENET_RDAR]) {
              qemu_flush_queued_packets(qemu_get_queue(s->nic));
           }
        results in Rx queue never being flushed and corresponding
        I/O event beign disabled.
 To prevent the problem, change the code to always flush packet queue
 when ENET_RDAR transitions 0 -> ENET_RDAR_RDAR.
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Cc: Jason Wang <jasowang@redhat.com>
 Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Cc: yurovsky@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Message-id: 20190904070506.1052-7-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/imx_fec.c | 12 ++++++------
+ hw/ssi/aspeed_smc.c | 64 ++++++++++++++++++++++++++++++++++++++++++++-
-file changed, 6 insertions(+), 6 deletions(-)
+file changed, 63 insertions(+), 1 deletion(-)
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
+--- a/hw/ssi/aspeed_smc.c
-+++ b/hw/net/imx_fec.c
++++ b/hw/ssi/aspeed_smc.c
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_do_tx(IMXFECState *s)
+@@ -XXX,XX +XXX,XX @@
  #define   CTRL_CMD_MASK            0xff
  #define   CTRL_DUMMY_HIGH_SHIFT    14
  #define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
 +#define CE_CTRL_CLOCK_FREQ_SHIFT   8
 +#define CE_CTRL_CLOCK_FREQ_MASK    0xf
 +#define CE_CTRL_CLOCK_FREQ(div)                                         \
 +    (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT)
  #define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
  #define   CTRL_CE_STOP_ACTIVE      (1 << 2)
  #define   CTRL_CMD_MODE_MASK       0x3
@@ -XXX,XX +XXX,XX @@
  #define   DMA_CTRL_DELAY_SHIFT  8
  #define   DMA_CTRL_FREQ_MASK    0xf
  #define   DMA_CTRL_FREQ_SHIFT   4
 -#define   DMA_CTRL_MODE         (1 << 3)
 +#define   DMA_CTRL_CALIB        (1 << 3)
  #define   DMA_CTRL_CKSUM        (1 << 2)
  #define   DMA_CTRL_WRITE        (1 << 1)
  #define   DMA_CTRL_ENABLE       (1 << 0)
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
      }
  }
--static void imx_eth_enable_rx(IMXFECState *s)
++static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask)
-+static void imx_eth_enable_rx(IMXFECState *s, bool flush)
++{
- {
++    /* HCLK/1 .. HCLK/16 */
-     IMXFECBufDesc bd;
++    const uint8_t hclk_divisors[] = {
-     bool rx_ring_full;
++        15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_enable_rx(IMXFECState *s)
++    };
++    int i;
-     if (rx_ring_full) {
++
-         FEC_PRINTF("RX buffer full\n");
++    for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) {
--    } else if (!s->regs[ENET_RDAR]) {
++        if (hclk_mask == hclk_divisors[i]) {
-+    } else if (flush) {
++            return i + 1;
-         qemu_flush_queued_packets(qemu_get_queue(s->nic));
++        }
 +    }
 +
 +    qemu_log_mask(LOG_GUEST_ERROR, "invalid HCLK mask %x", hclk_mask);
 +    return 0;
 +}
 +
 +/*
 + * When doing calibration, the SPI clock rate in the CE0 Control
 + * Register and the read delay cycles in the Read Timing Compensation
 + * Register are set using bit[11:4] of the DMA Control Register.
 + */
 +static void aspeed_smc_dma_calibration(AspeedSMCState *s)
 +{
 +    uint8_t delay =
 +        (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
 +    uint8_t hclk_mask =
 +        (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
 +    uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask);
 +    uint32_t hclk_shift = (hclk_div - 1) << 2;
 +    uint8_t cs;
 +
 +    /*
 +     * The Read Timing Compensation Register values apply to all CS on
 +     * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays
 +     */
 +    if (hclk_div && hclk_div < 6) {
 +        s->regs[s->r_timings] &= ~(0xf << hclk_shift);
 +        s->regs[s->r_timings] |= delay << hclk_shift;
 +    }
 +
 +    /*
 +     * TODO: compute the CS from the DMA address and the segment
 +     * registers. This is not really a problem for now because the
 +     * Timing Register values apply to all CS and software uses CS0 to
 +     * do calibration.
 +     */
 +    cs = 0;
 +    s->regs[s->r_ctrl0 + cs] &=
 +        ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT);
 +    s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
 +}
 +
  /*
   * Accumulate the result of the reads to provide a checksum that will
   * be used to validate the read timing settings.
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_checksum(AspeedSMCState *s)
          return;
      }
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
++    if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) {
-         if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
++        aspeed_smc_dma_calibration(s);
-             if (!s->regs[index]) {
++    }
-                 s->regs[index] = ENET_RDAR_RDAR;
++
--                imx_eth_enable_rx(s);
+     while (s->regs[R_DMA_LEN]) {
-+                imx_eth_enable_rx(s, true);
+         data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
-             }
+                                     MEMTXATTRS_UNSPECIFIED, &result);
          } else {
              s->regs[index] = 0;
@@ -XXX,XX +XXX,XX @@ static int imx_eth_can_receive(NetClientState *nc)
      FEC_PRINTF("\n");
 -    return s->regs[ENET_RDAR] ? 1 : 0;
 +    return !!s->regs[ENET_RDAR];
  }
  static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf,
          }
      }
      s->rx_descriptor = addr;
 -    imx_eth_enable_rx(s);
 +    imx_eth_enable_rx(s, false);
      imx_eth_update(s);
      return len;
  }
@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
          }
      }
      s->rx_descriptor = addr;
 -    imx_eth_enable_rx(s);
 +    imx_eth_enable_rx(s, false);
      imx_eth_update(s);
      return len;
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 16/26] imx_fec: Emulate SHIFT16 in ENETx_RACC
+[Qemu-devel] [PULL 07/12] aspeed/smc: Inject errors in DMA checksum
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Cédric Le Goater <clg@kaod.org>
-Needed to support latest Linux kernel driver which relies on that
+Emulate read errors in the DMA Checksum Register for high frequencies
-functionality.
+and optimistic settings of the Read Timing Compensation Register. This
 will help in tuning the SPI timing calibration algorithm. Errors are
 only injected when the property "inject_failure" is set to true as
 suggested by Philippe.
-Cc: Peter Maydell <peter.maydell@linaro.org>
+The values below are those to expect from the first flash device of
-Cc: Jason Wang <jasowang@redhat.com>
+the FMC controller of a palmetto-bmc machine.
-Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Cc: qemu-devel@nongnu.org
+Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
-Cc: qemu-arm@nongnu.org
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Cc: yurovsky@gmail.com
+Reviewed-by: Joel Stanley <joel@jms.id.au>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20190904070506.1052-8-clg@kaod.org
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/net/imx_fec.h |  2 ++
+ include/hw/ssi/aspeed_smc.h |  1 +
- hw/net/imx_fec.c         | 23 +++++++++++++++++++++++
+ hw/ssi/aspeed_smc.c         | 36 ++++++++++++++++++++++++++++++++++++
-files changed, 25 insertions(+)
+files changed, 37 insertions(+)
-diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
+diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/net/imx_fec.h
+--- a/include/hw/ssi/aspeed_smc.h
-+++ b/include/hw/net/imx_fec.h
++++ b/include/hw/ssi/aspeed_smc.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCState {
- #define ENET_TWFR_TFWR_LENGTH  (6)
- #define ENET_TWFR_STRFWD       (1 << 8)
+     uint32_t num_cs;
+     qemu_irq *cs_lines;
-+#define ENET_RACC_SHIFT16      BIT(7)
++    bool inject_failure;
      SSIBus *spi;
 diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/aspeed_smc.c
 +++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_calibration(AspeedSMCState *s)
      s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
  }
 +/*
 + * Emulate read errors in the DMA Checksum Register for high
 + * frequencies and optimistic settings of the Read Timing Compensation
 + * Register. This will help in tuning the SPI timing calibration
 + * algorithm.
 + */
 +static bool aspeed_smc_inject_read_failure(AspeedSMCState *s)
 +{
 +    uint8_t delay =
 +        (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
 +    uint8_t hclk_mask =
 +        (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
 +
- /* Buffer Descriptor.  */
++    /*
- typedef struct {
++     * Typical values of a palmetto-bmc machine.
-     uint16_t length;
++     */
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
++    switch (aspeed_smc_hclk_divisor(hclk_mask)) {
-index XXXXXXX..XXXXXXX 100644
++    case 4 ... 16:
---- a/hw/net/imx_fec.c
++        return false;
-+++ b/hw/net/imx_fec.c
++    case 3: /* at least one HCLK cycle delay */
-@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
++        return (delay & 0x7) < 1;
-     uint8_t *crc_ptr;
++    case 2: /* at least two HCLK cycle delay */
-     unsigned int buf_len;
++        return (delay & 0x7) < 2;
-     size_t size = len;
++    case 1: /* (> 100MHz) is above the max freq of the controller */
-+    bool shift16 = s->regs[ENET_RACC] & ENET_RACC_SHIFT16;
++        return true;
++    default:
-     FEC_PRINTF("len %d\n", (int)size);
++        g_assert_not_reached();
++    }
-@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
++}
-     crc = cpu_to_be32(crc32(~0, buf, size));
++
-     crc_ptr = (uint8_t *) &crc;
+ /*
+  * Accumulate the result of the reads to provide a checksum that will
-+    if (shift16) {
+  * be used to validate the read timing settings.
-+        size += 2;
+@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_checksum(AspeedSMCState *s)
          s->regs[R_DMA_FLASH_ADDR] += 4;
          s->regs[R_DMA_LEN] -= 4;
      }
 +
 +    if (s->inject_failure && aspeed_smc_inject_read_failure(s)) {
 +        s->regs[R_DMA_CHECKSUM] = 0xbadc0de;
 +    }
 +
-     /* Huge frames are truncted.  */
+ }
-     if (size > s->regs[ENET_FTRL]) {
-         size = s->regs[ENET_FTRL];
+ static void aspeed_smc_dma_rw(AspeedSMCState *s)
-@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_smc = {
-             buf_len += size - 4;
-         }
+ static Property aspeed_smc_properties[] = {
-         buf_addr = bd.data;
+     DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
-+
++    DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false),
-+        if (shift16) {
+     DEFINE_PROP_UINT64("sdram-base", AspeedSMCState, sdram_base, 0),
-+            /*
+     DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
-+             * If SHIFT16 bit of ENETx_RACC register is set we need to
+                      TYPE_MEMORY_REGION, MemoryRegion *),
 +             * align the payload to 4-byte boundary.
 +             */
 +            const uint8_t zeros[2] = { 0 };
 +
 +            dma_memory_write(&address_space_memory, buf_addr,
 +                             zeros, sizeof(zeros));
 +
 +            buf_addr += sizeof(zeros);
 +            buf_len  -= sizeof(zeros);
 +
 +            /* We only do this once per Ethernet frame */
 +            shift16 = false;
 +        }
 +
          dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
          buf += buf_len;
          if (size < 4) {
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 21/26] hw/timer/pxa2xx_timer: replace hw_error() -> qemu_log_mask()
+[Qemu-devel] [PULL 08/12] aspeed/smc: Calculate checksum on normal DMA
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Christian Svensson <bluecmd@google.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+This patch adds the missing checksum calculation on normal DMA transfer.
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+According to the datasheet this is how the SMC should behave.
-Message-id: 20180103224208.30291-2-f4bug@amsat.org
 Verified on AST1250 that the hardware matches the behaviour.
 Signed-off-by: Christian Svensson <bluecmd@google.com>
 Reviewed-by: Joel Stanley <joel@jms.id.au>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20190904070506.1052-9-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/pxa2xx_timer.c | 17 +++++++++++++++--
+ hw/ssi/aspeed_smc.c | 1 +
-file changed, 15 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+)
-diff --git a/hw/timer/pxa2xx_timer.c b/hw/timer/pxa2xx_timer.c
+diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/pxa2xx_timer.c
+--- a/hw/ssi/aspeed_smc.c
-+++ b/hw/timer/pxa2xx_timer.c
++++ b/hw/ssi/aspeed_smc.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_rw(AspeedSMCState *s)
- #include "sysemu/sysemu.h"
+         s->regs[R_DMA_FLASH_ADDR] += 4;
- #include "hw/arm/pxa.h"
+         s->regs[R_DMA_DRAM_ADDR] += 4;
- #include "hw/sysbus.h"
+         s->regs[R_DMA_LEN] -= 4;
-+#include "qemu/log.h"
++        s->regs[R_DMA_CHECKSUM] += data;
  #define OSMR0    0x00
  #define OSMR1    0x04
@@ -XXX,XX +XXX,XX @@ static uint64_t pxa2xx_timer_read(void *opaque, hwaddr offset,
      case OSNR:
          return s->snapshot;
      default:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: unknown register 0x%02" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +        break;
      badreg:
 -        hw_error("pxa2xx_timer_read: Bad offset " REG_FMT "\n", offset);
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: incorrect register 0x%02" HWADDR_PRIx "\n",
 +                      __func__, offset);
      }
      return 0;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_timer_write(void *opaque, hwaddr offset,
          }
          break;
      default:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: unknown register 0x%02" HWADDR_PRIx " "
 +                      "(value 0x%08" PRIx64 ")\n",  __func__, offset, value);
 +        break;
      badreg:
 -        hw_error("pxa2xx_timer_write: Bad offset " REG_FMT "\n", offset);
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: incorrect register 0x%02" HWADDR_PRIx " "
 +                      "(value 0x%08" PRIx64 ")\n", __func__, offset, value);
      }
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 14/26] imx_fec: Use ENET_FTRL to determine truncation length
+[Qemu-devel] [PULL 09/12] aspeed/scu: Introduce per-SoC SCU types
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Cédric Le Goater <clg@kaod.org>
-Frame truncation length, TRUNC_FL, is determined by the contents of
+and use a class AspeedSCUClass to define each SoC characteristics.
-ENET_FTRL register, so convert the code to use it instead of a
-hardcoded constant.
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Message-id: 20190904070506.1052-10-clg@kaod.org
 To avoid the case where TRUNC_FL is greater that ENET_MAX_FRAME_SIZE,
 increase the value of the latter to its theoretical maximum of 16K.
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Cc: Jason Wang <jasowang@redhat.com>
 Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Cc: yurovsky@gmail.com
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/net/imx_fec.h | 3 ++-
+ include/hw/misc/aspeed_scu.h | 15 +++++++
- hw/net/imx_fec.c         | 4 ++--
+ hw/arm/aspeed_soc.c          |  3 +-
-files changed, 4 insertions(+), 3 deletions(-)
+ hw/misc/aspeed_scu.c         | 83 ++++++++++++++++++++----------------
+files changed, 64 insertions(+), 37 deletions(-)
-diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
 diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/net/imx_fec.h
+--- a/include/hw/misc/aspeed_scu.h
-+++ b/include/hw/net/imx_fec.h
++++ b/include/hw/misc/aspeed_scu.h
 @@ -XXX,XX +XXX,XX @@
- #define ENET_TCCR3             393
- #define ENET_MAX               400
+ #define TYPE_ASPEED_SCU "aspeed.scu"
+ #define ASPEED_SCU(obj) OBJECT_CHECK(AspeedSCUState, (obj), TYPE_ASPEED_SCU)
--#define ENET_MAX_FRAME_SIZE    2032
++#define TYPE_ASPEED_2400_SCU TYPE_ASPEED_SCU "-ast2400"
++#define TYPE_ASPEED_2500_SCU TYPE_ASPEED_SCU "-ast2500"
- /* EIR and EIMR */
- #define ENET_INT_HB            (1 << 31)
+ #define ASPEED_SCU_NR_REGS (0x1A8 >> 2)
-@@ -XXX,XX +XXX,XX @@
- #define ENET_RCR_NLC           (1 << 30)
+@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
- #define ENET_RCR_GRS           (1 << 31)
+ extern bool is_supported_silicon_rev(uint32_t silicon_rev);
-+#define ENET_MAX_FRAME_SIZE    (1 << ENET_RCR_MAX_FL_LENGTH)
-+
++#define ASPEED_SCU_CLASS(klass) \
- /* TCR */
++     OBJECT_CLASS_CHECK(AspeedSCUClass, (klass), TYPE_ASPEED_SCU)
- #define ENET_TCR_GTS           (1 << 0)
++#define ASPEED_SCU_GET_CLASS(obj) \
- #define ENET_TCR_FDEN          (1 << 2)
++     OBJECT_GET_CLASS(AspeedSCUClass, (obj), TYPE_ASPEED_SCU)
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
++
 +typedef struct  AspeedSCUClass {
 +    SysBusDeviceClass parent_class;
 +
 +    const uint32_t *resets;
 +    uint32_t (*calc_hpll)(AspeedSCUState *s);
 +    uint32_t apb_divider;
 +}  AspeedSCUClass;
 +
  #define ASPEED_SCU_PROT_KEY      0x1688A8A8
  /*
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
+--- a/hw/arm/aspeed_soc.c
-+++ b/hw/net/imx_fec.c
++++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
-     crc_ptr = (uint8_t *) &crc;
+                                 &error_abort, NULL);
      /* Huge frames are truncted.  */
 -    if (size > ENET_MAX_FRAME_SIZE) {
 -        size = ENET_MAX_FRAME_SIZE;
 +    if (size > s->regs[ENET_FTRL]) {
 +        size = s->regs[ENET_FTRL];
          flags |= ENET_BD_TR | ENET_BD_LG;
      }
++    snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
+     sysbus_init_child_obj(obj, "scu", OBJECT(&s->scu), sizeof(s->scu),
+-                          TYPE_ASPEED_SCU);
++                          typename);
+     qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev",
+                          sc->info->silicon_rev);
+     object_property_add_alias(obj, "hw-strap1", OBJECT(&s->scu),
+diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/aspeed_scu.c
++++ b/hw/misc/aspeed_scu.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_get_random(void)
+ static void aspeed_scu_set_apb_freq(AspeedSCUState *s)
+ {
+-    uint32_t apb_divider;
+-
+-    switch (s->silicon_rev) {
+-    case AST2400_A0_SILICON_REV:
+-    case AST2400_A1_SILICON_REV:
+-        apb_divider = 2;
+-        break;
+-    case AST2500_A0_SILICON_REV:
+-    case AST2500_A1_SILICON_REV:
+-        apb_divider = 4;
+-        break;
+-    default:
+-        g_assert_not_reached();
+-    }
++    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(s);
+     s->apb_freq = s->hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
+-        / apb_divider;
++        / asc->apb_divider;
+ }
+ static uint64_t aspeed_scu_read(void *opaque, hwaddr offset, unsigned size)
+@@ -XXX,XX +XXX,XX @@ static const uint32_t hpll_ast2400_freqs[][4] = {
+     { 400, 375, 350, 425 }, /* 25MHz */
+ };
+-static uint32_t aspeed_scu_calc_hpll_ast2400(AspeedSCUState *s)
++static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
+ {
+     uint32_t hpll_reg = s->regs[HPLL_PARAM];
+     uint8_t freq_select;
+@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_calc_hpll_ast2400(AspeedSCUState *s)
+     return hpll_ast2400_freqs[clk_25m_in][freq_select] * 1000000;
+ }
+-static uint32_t aspeed_scu_calc_hpll_ast2500(AspeedSCUState *s)
++static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
+ {
+     uint32_t hpll_reg   = s->regs[HPLL_PARAM];
+     uint32_t multiplier = 1;
+@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_calc_hpll_ast2500(AspeedSCUState *s)
+ static void aspeed_scu_reset(DeviceState *dev)
+ {
+     AspeedSCUState *s = ASPEED_SCU(dev);
+-    const uint32_t *reset;
+-    uint32_t (*calc_hpll)(AspeedSCUState *s);
++    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
+-    switch (s->silicon_rev) {
+-    case AST2400_A0_SILICON_REV:
+-    case AST2400_A1_SILICON_REV:
+-        reset = ast2400_a0_resets;
+-        calc_hpll = aspeed_scu_calc_hpll_ast2400;
+-        break;
+-    case AST2500_A0_SILICON_REV:
+-    case AST2500_A1_SILICON_REV:
+-        reset = ast2500_a1_resets;
+-        calc_hpll = aspeed_scu_calc_hpll_ast2500;
+-        break;
+-    default:
+-        g_assert_not_reached();
+-    }
+-
+-    memcpy(s->regs, reset, sizeof(s->regs));
++    memcpy(s->regs, asc->resets, sizeof(s->regs));
+     s->regs[SILICON_REV] = s->silicon_rev;
+     s->regs[HW_STRAP1] = s->hw_strap1;
+     s->regs[HW_STRAP2] = s->hw_strap2;
+@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_reset(DeviceState *dev)
+      * All registers are set. Now compute the frequencies of the main clocks
+      */
+     s->clkin = aspeed_scu_get_clkin(s);
+-    s->hpll = calc_hpll(s);
++    s->hpll = asc->calc_hpll(s);
+     aspeed_scu_set_apb_freq(s);
+ }
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_scu_info = {
+     .parent = TYPE_SYS_BUS_DEVICE,
+     .instance_size = sizeof(AspeedSCUState),
+     .class_init = aspeed_scu_class_init,
++    .class_size    = sizeof(AspeedSCUClass),
++    .abstract      = true,
++};
++
++static void aspeed_2400_scu_class_init(ObjectClass *klass, void *data)
++{
++    DeviceClass *dc = DEVICE_CLASS(klass);
++    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
++
++    dc->desc = "ASPEED 2400 System Control Unit";
++    asc->resets = ast2400_a0_resets;
++    asc->calc_hpll = aspeed_2400_scu_calc_hpll;
++    asc->apb_divider = 2;
++}
++
++static const TypeInfo aspeed_2400_scu_info = {
++    .name = TYPE_ASPEED_2400_SCU,
++    .parent = TYPE_ASPEED_SCU,
++    .instance_size = sizeof(AspeedSCUState),
++    .class_init = aspeed_2400_scu_class_init,
++};
++
++static void aspeed_2500_scu_class_init(ObjectClass *klass, void *data)
++{
++    DeviceClass *dc = DEVICE_CLASS(klass);
++    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
++
++    dc->desc = "ASPEED 2500 System Control Unit";
++    asc->resets = ast2500_a1_resets;
++    asc->calc_hpll = aspeed_2500_scu_calc_hpll;
++    asc->apb_divider = 4;
++}
++
++static const TypeInfo aspeed_2500_scu_info = {
++    .name = TYPE_ASPEED_2500_SCU,
++    .parent = TYPE_ASPEED_SCU,
++    .instance_size = sizeof(AspeedSCUState),
++    .class_init = aspeed_2500_scu_class_init,
+ };
+ static void aspeed_scu_register_types(void)
+ {
+     type_register_static(&aspeed_scu_info);
++    type_register_static(&aspeed_2400_scu_info);
++    type_register_static(&aspeed_2500_scu_info);
+ }
+ type_init(aspeed_scu_register_types);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 09/26] Virt: ACPI: fix qemu assert due to re-assigned table data address
+[Qemu-devel] [PULL 10/12] aspeed/scu: Introduce a aspeed_scu_get_apb_freq() routine
-From: Zhaoshenglong <zhaoshenglong@huawei.com>
+From: Cédric Le Goater <clg@kaod.org>
-acpi_data_push uses g_array_set_size to resize the memory size. If there
+The APB frequency can be calculated directly when needed from the
-is no enough contiguous memory, the address will be changed. If we use
+HPLL_PARAM and CLK_SEL register values. This removes useless state in
-the old value, it will assert.
+the model.
 qemu-kvm: hw/acpi/bios-linker-loader.c:214: bios_linker_loader_add_checksum:
 Assertion `start_offset < file->blob->len' failed.`
-This issue only happens in building SRAT table now but here we unify the
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
-pattern for other tables as well to avoid possible issues in the future.
+Message-id: 20190904070506.1052-11-clg@kaod.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Zhaoshenglong <zhaoshenglong@huawei.com>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt-acpi-build.c | 18 +++++++++++-------
+ include/hw/misc/aspeed_scu.h |  8 +++-----
-file changed, 11 insertions(+), 7 deletions(-)
+ hw/misc/aspeed_scu.c         | 25 +++++++++----------------
  hw/timer/aspeed_timer.c      |  3 ++-
 files changed, 14 insertions(+), 22 deletions(-)
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
+diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
+--- a/include/hw/misc/aspeed_scu.h
-+++ b/hw/arm/virt-acpi-build.c
++++ b/include/hw/misc/aspeed_scu.h
-@@ -XXX,XX +XXX,XX @@ build_spcr(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
-     AcpiSerialPortConsoleRedirection *spcr;
+     uint32_t hw_strap1;
-     const MemMapEntry *uart_memmap = &vms->memmap[VIRT_UART];
+     uint32_t hw_strap2;
-     int irq = vms->irqmap[VIRT_UART] + ARM_SPI_BASE;
+     uint32_t hw_prot_key;
-+    int spcr_start = table_data->len;
+-
+-    uint32_t clkin;
-     spcr = acpi_data_push(table_data, sizeof(*spcr));
+-    uint32_t hpll;
+-    uint32_t apb_freq;
-@@ -XXX,XX +XXX,XX @@ build_spcr(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+ } AspeedSCUState;
-     spcr->pci_device_id = 0xffff;  /* PCI Device ID: not a PCI device */
-     spcr->pci_vendor_id = 0xffff;  /* PCI Vendor ID: not a PCI device */
+ #define AST2400_A0_SILICON_REV   0x02000303U
+@@ -XXX,XX +XXX,XX @@ typedef struct  AspeedSCUClass {
--    build_header(linker, table_data, (void *)spcr, "SPCR", sizeof(*spcr), 2,
+     SysBusDeviceClass parent_class;
--                 NULL, NULL);
-+    build_header(linker, table_data, (void *)(table_data->data + spcr_start),
+     const uint32_t *resets;
-+                 "SPCR", table_data->len - spcr_start, 2, NULL, NULL);
+-    uint32_t (*calc_hpll)(AspeedSCUState *s);
 +    uint32_t (*calc_hpll)(AspeedSCUState *s, uint32_t hpll_reg);
      uint32_t apb_divider;
  }  AspeedSCUClass;
  #define ASPEED_SCU_PROT_KEY      0x1688A8A8
 +uint32_t aspeed_scu_get_apb_freq(AspeedSCUState *s);
 +
  /*
   * Extracted from Aspeed SDK v00.03.21. Fixes and extra definitions
   * were added.
 diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/aspeed_scu.c
 +++ b/hw/misc/aspeed_scu.c
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_get_random(void)
      return num;
  }
- static void
+-static void aspeed_scu_set_apb_freq(AspeedSCUState *s)
-@@ -XXX,XX +XXX,XX @@ build_srat(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
++uint32_t aspeed_scu_get_apb_freq(AspeedSCUState *s)
-         mem_base += numa_info[i].node_mem;
+ {
      AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(s);
 +    uint32_t hpll = asc->calc_hpll(s, s->regs[HPLL_PARAM]);
 -    s->apb_freq = s->hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
 +    return hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
          / asc->apb_divider;
  }
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
          return;
      case CLK_SEL:
          s->regs[reg] = data;
 -        aspeed_scu_set_apb_freq(s);
          break;
      case HW_STRAP1:
          if (ASPEED_IS_AST2500(s->regs[SILICON_REV])) {
@@ -XXX,XX +XXX,XX @@ static const uint32_t hpll_ast2400_freqs[][4] = {
      { 400, 375, 350, 425 }, /* 25MHz */
  };
 -static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
 +static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s, uint32_t hpll_reg)
  {
 -    uint32_t hpll_reg = s->regs[HPLL_PARAM];
      uint8_t freq_select;
      bool clk_25m_in;
 +    uint32_t clkin = aspeed_scu_get_clkin(s);
      if (hpll_reg & SCU_AST2400_H_PLL_OFF) {
          return 0;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
              multiplier = (2 - od) * ((n + 2) / (d + 1));
          }
 -        return s->clkin * multiplier;
 +        return clkin * multiplier;
      }
--    build_header(linker, table_data, (void *)srat, "SRAT",
+     /* HW strapping */
--                 table_data->len - srat_start, 3, NULL, NULL);
+@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
-+    build_header(linker, table_data, (void *)(table_data->data + srat_start),
+     return hpll_ast2400_freqs[clk_25m_in][freq_select] * 1000000;
 +                 "SRAT", table_data->len - srat_start, 3, NULL, NULL);
  }
- static void
+-static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
-@@ -XXX,XX +XXX,XX @@ build_mcfg(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
++static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s, uint32_t hpll_reg)
-     AcpiTableMcfg *mcfg;
+ {
-     const MemMapEntry *memmap = vms->memmap;
+-    uint32_t hpll_reg   = s->regs[HPLL_PARAM];
-     int len = sizeof(*mcfg) + sizeof(mcfg->allocation[0]);
+     uint32_t multiplier = 1;
-+    int mcfg_start = table_data->len;
++    uint32_t clkin = aspeed_scu_get_clkin(s);
-     mcfg = acpi_data_push(table_data, len);
+     if (hpll_reg & SCU_H_PLL_OFF) {
-     mcfg->allocation[0].address = cpu_to_le64(memmap[VIRT_PCIE_ECAM].base);
+         return 0;
-@@ -XXX,XX +XXX,XX @@ build_mcfg(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
-     mcfg->allocation[0].end_bus_number = (memmap[VIRT_PCIE_ECAM].size
+         multiplier = ((m + 1) / (n + 1)) / (p + 1);
-                                           / PCIE_MMCFG_SIZE_MIN) - 1;
+     }
--    build_header(linker, table_data, (void *)mcfg, "MCFG", len, 1, NULL, NULL);
+-    return s->clkin * multiplier;
-+    build_header(linker, table_data, (void *)(table_data->data + mcfg_start),
++    return clkin * multiplier;
 +                 "MCFG", table_data->len - mcfg_start, 1, NULL, NULL);
  }
- /* GTDT */
+ static void aspeed_scu_reset(DeviceState *dev)
-@@ -XXX,XX +XXX,XX @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_reset(DeviceState *dev)
- static void build_fadt(GArray *table_data, BIOSLinker *linker,
+     s->regs[HW_STRAP1] = s->hw_strap1;
-                        VirtMachineState *vms, unsigned dsdt_tbl_offset)
+     s->regs[HW_STRAP2] = s->hw_strap2;
      s->regs[PROT_KEY] = s->hw_prot_key;
 -
 -    /*
 -     * All registers are set. Now compute the frequencies of the main clocks
 -     */
 -    s->clkin = aspeed_scu_get_clkin(s);
 -    s->hpll = asc->calc_hpll(s);
 -    aspeed_scu_set_apb_freq(s);
  }
  static uint32_t aspeed_silicon_revs[] = {
 diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/aspeed_timer.c
 +++ b/hw/timer/aspeed_timer.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t calculate_rate(struct AspeedTimer *t)
  {
-+    int fadt_start = table_data->len;
+     AspeedTimerCtrlState *s = timer_to_ctrl(t);
-     AcpiFadtDescriptorRev5_1 *fadt = acpi_data_push(table_data, sizeof(*fadt));
-     unsigned xdsdt_entry_offset = (char *)&fadt->x_dsdt - table_data->data;
+-    return timer_external_clock(t) ? TIMER_CLOCK_EXT_HZ : s->scu->apb_freq;
-     uint16_t bootflags;
++    return timer_external_clock(t) ? TIMER_CLOCK_EXT_HZ :
-@@ -XXX,XX +XXX,XX @@ static void build_fadt(GArray *table_data, BIOSLinker *linker,
++        aspeed_scu_get_apb_freq(s->scu);
          ACPI_BUILD_TABLE_FILE, xdsdt_entry_offset, sizeof(fadt->x_dsdt),
          ACPI_BUILD_TABLE_FILE, dsdt_tbl_offset);
 -    build_header(linker, table_data,
 -                 (void *)fadt, "FACP", sizeof(*fadt), 5, NULL, NULL);
 +    build_header(linker, table_data, (void *)(table_data->data + fadt_start),
 +                 "FACP", table_data->len - fadt_start, 5, NULL, NULL);
  }
- /* DSDT */
+ static inline uint32_t calculate_ticks(struct AspeedTimer *t, uint64_t now_ns)
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 10/26] imx_fec: Do not link to netdev
+Deleted patch
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
-Binding to a particular netdev doesn't seem to belong to this layer
-and should probably be done as a part of board or SoC specific code.
-Convert all of the users of this IP block to use
-qdev_set_nic_properties() instead.
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Cc: Jason Wang <jasowang@redhat.com>
-Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Cc: qemu-devel@nongnu.org
-Cc: qemu-arm@nongnu.org
-Cc: yurovsky@gmail.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/fsl-imx6.c | 1 +
- hw/net/imx_fec.c  | 2 --
-files changed, 1 insertion(+), 2 deletions(-)
-diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx6.c
-+++ b/hw/arm/fsl-imx6.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-                                             spi_table[i].irq));
-     }
-+    qdev_set_nic_properties(DEVICE(&s->eth), &nd_table[0]);
-     object_property_set_bool(OBJECT(&s->eth), true, "realized", &err);
-     if (err) {
-         error_propagate(errp, err);
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
-+++ b/hw/net/imx_fec.c
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)
-     qemu_macaddr_default_if_unset(&s->conf.macaddr);
--    s->conf.peers.ncs[0] = nd_table[0].netdev;
--
-     s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf,
-                           object_get_typename(OBJECT(dev)),
-                           DEVICE(dev)->id, s);
---
-.7.4

-[Qemu-devel] [PULL 15/26] imx_fec: Use MIN instead of explicit ternary operator
+Deleted patch
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Cc: Jason Wang <jasowang@redhat.com>
-Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Cc: qemu-devel@nongnu.org
-Cc: qemu-arm@nongnu.org
-Cc: yurovsky@gmail.com
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/net/imx_fec.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
-+++ b/hw/net/imx_fec.c
-@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
-                           TYPE_IMX_FEC, __func__);
-             break;
-         }
--        buf_len = (size <= s->regs[ENET_MRBR]) ? size : s->regs[ENET_MRBR];
-+        buf_len = MIN(size, s->regs[ENET_MRBR]);
-         bd.length = buf_len;
-         size -= buf_len;
---
-.7.4

-[Qemu-devel] [PULL 18/26] imx_fec: Use correct length for packet size
+Deleted patch
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
-Use 'frame_size' instead of 'len' when calling qemu_send_packet(),
-failing to do so results in malformed packets send in case when that
-packed is fragmented into multiple DMA transactions.
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Cc: Jason Wang <jasowang@redhat.com>
-Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Cc: qemu-devel@nongnu.org
-Cc: qemu-arm@nongnu.org
-Cc: yurovsky@gmail.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/net/imx_fec.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
-+++ b/hw/net/imx_fec.c
-@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s, uint32_t index)
-             }
-             /* Last buffer in frame.  */
--            qemu_send_packet(qemu_get_queue(s->nic), s->frame, len);
-+            qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size);
-             ptr = s->frame;
-             frame_size = 0;
---
-.7.4

-[Qemu-devel] [PULL 19/26] imx_fec: Fix a typo in imx_enet_receive()
+[Qemu-devel] [PULL 11/12] atomic_template: fix indentation in GEN_ATOMIC_HELPER
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: "Emilio G. Cota" <cota@braap.org>
-Cc: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Cc: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Emilio G. Cota <cota@braap.org>
-Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Cc: qemu-devel@nongnu.org
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Cc: qemu-arm@nongnu.org
 Cc: yurovsky@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/imx_fec.c | 2 +-
+ accel/tcg/atomic_template.h | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
+--- a/accel/tcg/atomic_template.h
-+++ b/hw/net/imx_fec.c
++++ b/accel/tcg/atomic_template.h
-@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
+@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
-         size += 2;
-     }
+ #define GEN_ATOMIC_HELPER(X)                                        \
+ ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
--    /* Huge frames are truncted.  */
+-                 ABI_TYPE val EXTRA_ARGS)                           \
-+    /* Huge frames are truncated. */
++                        ABI_TYPE val EXTRA_ARGS)                    \
-     if (size > s->regs[ENET_FTRL]) {
+ {                                                                   \
-         size = s->regs[ENET_FTRL];
+     ATOMIC_MMU_DECLS;                                               \
-         flags |= ENET_BD_TR | ENET_BD_LG;
+     DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 20/26] imx_fec: Reserve full FSL_IMX25_FEC_SIZE page for the register file
+Deleted patch
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
-Some i.MX SoCs (e.g. i.MX7) have FEC registers going as far as offset
-x614, so to avoid getting aborts when accessing those on QEMU, extend
-the register file to cover FSL_IMX25_FEC_SIZE(16K) of address space
-instead of just 1K.
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Cc: Jason Wang <jasowang@redhat.com>
-Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Cc: qemu-devel@nongnu.org
-Cc: qemu-arm@nongnu.org
-Cc: yurovsky@gmail.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/fsl-imx25.h | 1 -
- include/hw/net/imx_fec.h   | 1 +
- hw/net/imx_fec.c           | 2 +-
-files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx25.h
-+++ b/include/hw/arm/fsl-imx25.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
- #define FSL_IMX25_UART5_ADDR    0x5002C000
- #define FSL_IMX25_UART5_SIZE    0x4000
- #define FSL_IMX25_FEC_ADDR      0x50038000
--#define FSL_IMX25_FEC_SIZE      0x4000
- #define FSL_IMX25_CCM_ADDR      0x53F80000
- #define FSL_IMX25_CCM_SIZE      0x4000
- #define FSL_IMX25_GPT4_ADDR     0x53F84000
-diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/net/imx_fec.h
-+++ b/include/hw/net/imx_fec.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- #define ENET_TX_RING_NUM       3
-+#define FSL_IMX25_FEC_SIZE      0x4000
- typedef struct IMXFECState {
-     /*< private >*/
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
-+++ b/hw/net/imx_fec.c
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)
-     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-     memory_region_init_io(&s->iomem, OBJECT(dev), &imx_eth_ops, s,
--                          TYPE_IMX_FEC, 0x400);
-+                          TYPE_IMX_FEC, FSL_IMX25_FEC_SIZE);
-     sysbus_init_mmio(sbd, &s->iomem);
-     sysbus_init_irq(sbd, &s->irq[0]);
-     sysbus_init_irq(sbd, &s->irq[1]);
---
-.7.4

-[Qemu-devel] [PULL 23/26] linux-user/arm/nwfpe: Check coprocessor number for FPA emulation
+Deleted patch
-Our copy of the nwfpe code for emulating of the old FPA11 floating
-point unit doesn't check the coprocessor number in the instruction
-when it emulates it.  This means that we might treat some
-instructions which should really UNDEF as being FPA11 instructions by
-accident.
-The kernel's copy of the nwfpe code doesn't make this error; I suspect
-the bug was noticed and fixed as part of the process of mainlining
-the nwfpe code more than a decade ago.
-Add a check that the coprocessor number (which is always in bits
-[11:8] of the instruction) is either 1 or 2, which is where the
-FPA11 lives.
-Reported-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- linux-user/arm/nwfpe/fpa11.c | 9 +++++++++
-file changed, 9 insertions(+)
-diff --git a/linux-user/arm/nwfpe/fpa11.c b/linux-user/arm/nwfpe/fpa11.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/arm/nwfpe/fpa11.c
-+++ b/linux-user/arm/nwfpe/fpa11.c
-@@ -XXX,XX +XXX,XX @@ unsigned int EmulateAll(unsigned int opcode, FPA11* qfpa, CPUARMState* qregs)
-   unsigned int nRc = 0;
- //  unsigned long flags;
-   FPA11 *fpa11;
-+  unsigned int cp;
- //  save_flags(flags); sti();
-+  /* Check that this is really an FPA11 instruction: the coprocessor
-+   * field in bits [11:8] must be 1 or 2.
-+   */
-+  cp = (opcode >> 8) & 0xf;
-+  if (cp != 1 && cp != 2) {
-+    return 0;
-+  }
-+
-   qemufpa=qfpa;
-   user_registers=qregs;
---
-.7.4

-[Qemu-devel] [PULL 24/26] target/arm: Make disas_thumb2_insn() generate its own UNDEF exceptions
+[Qemu-devel] [PULL 12/12] qemu-ga: Convert invocation documentation to rST
-Refactor disas_thumb2_insn() so that it generates the code for raising
+The qemu-ga documentation is currently in qemu-ga.texi in
-an UNDEF exception for invalid insns, rather than returning a flag
+Texinfo format, which we present to the user as:
-which the caller must check to see if it needs to generate the UNDEF
+ * a qemu-ga manpage
-code. This brings the function in to line with the behaviour of
+ * a section of the main qemu-doc HTML documentation
-disas_thumb_insn() and disas_arm_insn().
 Convert the documentation to rST format, and present it to
 the user as:
  * a qemu-ga manpage
  * part of the interop/ Sphinx manual
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
-Message-id: 1513080506-17703-1-git-send-email-peter.maydell@linaro.org
+Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
 Message-id: 20190905131040.8350-1-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 23 ++++++++++-------------
+ Makefile                 |  24 ++++---
-file changed, 10 insertions(+), 13 deletions(-)
+ MAINTAINERS              |   2 +-
  docs/conf.py             |  18 ++---
  docs/interop/conf.py     |   7 ++
  docs/interop/index.rst   |   1 +
  docs/interop/qemu-ga.rst | 133 +++++++++++++++++++++++++++++++++++++
  qemu-doc.texi            |   5 --
  qemu-ga.texi             | 137 ---------------------------------------
 files changed, 166 insertions(+), 161 deletions(-)
  create mode 100644 docs/interop/qemu-ga.rst
  delete mode 100644 qemu-ga.texi
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/Makefile b/Makefile
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/Makefile
-+++ b/target/arm/translate.c
++++ b/Makefile
-@@ -XXX,XX +XXX,XX @@ gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out,
+@@ -XXX,XX +XXX,XX @@ endif
-     return 0;
+ endif
- }
+ ifdef BUILD_DOCS
--/* Translate a 32-bit thumb instruction.  Returns nonzero if the instruction
+-DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 qemu-ga.8
--   is not legal.  */
++DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 docs/interop/qemu-ga.8
--static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
+ DOCS+=docs/interop/qemu-qmp-ref.html docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7
-+/* Translate a 32-bit thumb instruction. */
+ DOCS+=docs/interop/qemu-ga-ref.html docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7
-+static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
+ DOCS+=docs/qemu-block-drivers.7
- {
+@@ -XXX,XX +XXX,XX @@ DESCS=
-     uint32_t imm, shift, offset;
+ endif
-     uint32_t rd, rn, rm, rs;
-@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
+ # Note that we manually filter-out the non-Sphinx documentation which
-                     /* UNPREDICTABLE, unallocated hint or
+-# is currently built into the docs/interop directory in the build tree.
-                      * PLD/PLDW/PLI (literal)
++# is currently built into the docs/interop directory in the build tree,
-                      */
++# and also any sphinx-built manpages.
--                    return 0;
+ define install-manual =
-+                    return;
+ for d in $$(cd $(MANUAL_BUILDDIR) && find $1 -type d); do $(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)/$$d"; done
-                 }
+-for f in $$(cd $(MANUAL_BUILDDIR) && find $1 -type f -a '!' '(' -name 'qemu-*-qapi.*' -o -name 'qemu-*-ref.*' ')' ); do $(INSTALL_DATA) "$(MANUAL_BUILDDIR)/$$f" "$(DESTDIR)$(qemu_docdir)/$$f"; done
-                 if (op1 & 1) {
++for f in $$(cd $(MANUAL_BUILDDIR) && find $1 -type f -a '!' '(' -name '*.[0-9]' -o -name 'qemu-*-qapi.*' -o -name 'qemu-*-ref.*' ')' ); do $(INSTALL_DATA) "$(MANUAL_BUILDDIR)/$$f" "$(DESTDIR)$(qemu_docdir)/$$f"; done
--                    return 0; /* PLD/PLDW/PLI or unallocated hint */
+ endef
-+                    return; /* PLD/PLDW/PLI or unallocated hint */
-                 }
+ # Note that we deliberately do not install the "devel" manual: it is
-                 if ((op2 == 0) || ((op2 & 0x3c) == 0x30)) {
+@@ -XXX,XX +XXX,XX @@ ifdef CONFIG_TRACE_SYSTEMTAP
--                    return 0; /* PLD/PLDW/PLI or unallocated hint */
+     $(INSTALL_DATA) scripts/qemu-trace-stap.1 "$(DESTDIR)$(mandir)/man1"
-+                    return; /* PLD/PLDW/PLI or unallocated hint */
+ endif
-                 }
+ ifneq (,$(findstring qemu-ga,$(TOOLS)))
-                 /* UNDEF space, or an UNPREDICTABLE */
+-    $(INSTALL_DATA) qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
--                return 1;
++    $(INSTALL_DATA) docs/interop/qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
-+                goto illegal_op;
+     $(INSTALL_DATA) docs/interop/qemu-ga-ref.html "$(DESTDIR)$(qemu_docdir)"
-             }
+     $(INSTALL_DATA) docs/interop/qemu-ga-ref.txt "$(DESTDIR)$(qemu_docdir)"
-         }
+     $(INSTALL_DATA) docs/interop/qemu-ga-ref.7 "$(DESTDIR)$(mandir)/man7"
-         memidx = get_mem_index(s);
+@@ -XXX,XX +XXX,XX @@ docs/version.texi: $(SRC_PATH)/VERSION config-host.mak
-@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
+ sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html $(MANUAL_BUILDDIR)/interop/index.html $(MANUAL_BUILDDIR)/specs/index.html
-     default:
-         goto illegal_op;
+ # Canned command to build a single manual
-     }
+-build-manual = $(call quiet-command,sphinx-build $(if $(V),,-q) -W -n -b html -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
--    return 0;
++# Arguments: $1 = manual name, $2 = Sphinx builder ('html' or 'man')
-+    return;
++build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" sphinx-build $(if $(V),,-q) -W -n -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
- illegal_op:
+ # We assume all RST files in the manual's directory are used in it
--    return 1;
+ manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst) $(SRC_PATH)/docs/$1/conf.py $(SRC_PATH)/docs/conf.py
-+    gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
-+                       default_exception_el(s));
+ $(MANUAL_BUILDDIR)/devel/index.html: $(call manual-deps,devel)
- }
+-    $(call build-manual,devel)
++    $(call build-manual,devel,html)
- static void disas_thumb_insn(DisasContext *s, uint32_t insn)
-@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+ $(MANUAL_BUILDDIR)/interop/index.html: $(call manual-deps,interop)
-     if (is_16bit) {
+-    $(call build-manual,interop)
-         disas_thumb_insn(dc, insn);
++    $(call build-manual,interop,html)
-     } else {
--        if (disas_thumb2_insn(dc, insn)) {
+ $(MANUAL_BUILDDIR)/specs/index.html: $(call manual-deps,specs)
--            gen_exception_insn(dc, 4, EXCP_UDEF, syn_uncategorized(),
+-    $(call build-manual,specs)
--                               default_exception_el(dc));
++    $(call build-manual,specs,html)
--        }
++
-+        disas_thumb2_insn(dc, insn);
++$(MANUAL_BUILDDIR)/interop/qemu-ga.8: $(call manual-deps,interop)
-     }
++    $(call build-manual,interop,man)
-     /* Advance the Thumb condexec condition.  */
+ qemu-options.texi: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool
      $(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")
@@ -XXX,XX +XXX,XX @@ qemu.1: qemu-option-trace.texi
  qemu-img.1: qemu-img.texi qemu-option-trace.texi qemu-img-cmds.texi
  fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
  qemu-nbd.8: qemu-nbd.texi qemu-option-trace.texi
 -qemu-ga.8: qemu-ga.texi
  docs/qemu-block-drivers.7: docs/qemu-block-drivers.texi
  docs/qemu-cpu-models.7: docs/qemu-cpu-models.texi
  scripts/qemu-trace-stap.1: scripts/qemu-trace-stap.texi
@@ -XXX,XX +XXX,XX @@ txt: qemu-doc.txt docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
  qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
      qemu-img.texi qemu-nbd.texi qemu-options.texi \
      qemu-tech.texi qemu-option-trace.texi \
 -    qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
 +    qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi \
      qemu-monitor-info.texi docs/qemu-block-drivers.texi \
      docs/qemu-cpu-models.texi docs/security.texi
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ QEMU Guest Agent
  M: Michael Roth <mdroth@linux.vnet.ibm.com>
  S: Maintained
  F: qga/
 -F: qemu-ga.texi
 +F: docs/interop/qemu-ga.rst
  F: scripts/qemu-guest-agent/
  F: tests/test-qga.c
  F: docs/interop/qemu-ga-ref.texi
 diff --git a/docs/conf.py b/docs/conf.py
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/conf.py
 +++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@ todo_include_todos = False
  # with "option::" in the document being processed. Turn that off.
  suppress_warnings = ["ref.option"]
 +# The rst_epilog fragment is effectively included in every rST file.
 +# We use it to define substitutions based on build config that
 +# can then be used in the documentation. The fallback if the
 +# environment variable is not set is for the benefit of readthedocs
 +# style document building; our Makefile always sets the variable.
 +confdir = os.getenv('CONFDIR', "/etc/qemu")
 +rst_epilog = ".. |CONFDIR| replace:: ``" + confdir + "``\n"
 +
  # -- Options for HTML output ----------------------------------------------
  # The theme to use for HTML and HTML Help pages.  See the documentation for
@@ -XXX,XX +XXX,XX @@ latex_documents = [
  # -- Options for manual page output ---------------------------------------
 -
 -# One entry per manual page. List of tuples
 -# (source start file, name, description, authors, manual section).
 -man_pages = [
 -    (master_doc, 'qemu', u'QEMU Documentation',
 -     [author], 1)
 -]
 -
 +# Individual manual/conf.py can override this to create man pages
 +man_pages = []
  # -- Options for Texinfo output -------------------------------------------
 diff --git a/docs/interop/conf.py b/docs/interop/conf.py
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/interop/conf.py
 +++ b/docs/interop/conf.py
@@ -XXX,XX +XXX,XX @@ exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
  # This slightly misuses the 'description', but is the best way to get
  # the manual title to appear in the sidebar.
  html_theme_options['description'] = u'System Emulation Management and Interoperability Guide'
 +
 +# One entry per manual page. List of tuples
 +# (source start file, name, description, authors, manual section).
 +man_pages = [
 +    ('qemu-ga', 'qemu-ga', u'QEMU Guest Agent',
 +     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8)
 +]
 diff --git a/docs/interop/index.rst b/docs/interop/index.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/interop/index.rst
 +++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
     bitmaps
     live-block-operations
     pr-helper
 +   qemu-ga
     vhost-user
     vhost-user-gpu
 diff --git a/docs/interop/qemu-ga.rst b/docs/interop/qemu-ga.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/interop/qemu-ga.rst
@@ -XXX,XX +XXX,XX @@
 +QEMU Guest Agent
 +================
 +
 +Synopsis
 +--------
 +
 +**qemu-ga** [*OPTIONS*]
 +
 +Description
 +-----------
 +
 +The QEMU Guest Agent is a daemon intended to be run within virtual
 +machines. It allows the hypervisor host to perform various operations
 +in the guest, such as:
 +
 +- get information from the guest
 +- set the guest's system time
 +- read/write a file
 +- sync and freeze the filesystems
 +- suspend the guest
 +- reconfigure guest local processors
 +- set user's password
 +- ...
 +
 +qemu-ga will read a system configuration file on startup (located at
 +|CONFDIR|\ ``/qemu-ga.conf`` by default), then parse remaining
 +configuration options on the command line. For the same key, the last
 +option wins, but the lists accumulate (see below for configuration
 +file format).
 +
 +Options
 +-------
 +
 +.. program:: qemu-ga
 +
 +.. option:: -m, --method=METHOD
 +
 +  Transport method: one of ``unix-listen``, ``virtio-serial``, or
 +  ``isa-serial`` (``virtio-serial`` is the default).
 +
 +.. option:: -p, --path=PATH
 +
 +  Device/socket path (the default for virtio-serial is
 +  ``/dev/virtio-ports/org.qemu.guest_agent.0``,
 +  the default for isa-serial is ``/dev/ttyS0``)
 +
 +.. option:: -l, --logfile=PATH
 +
 +  Set log file path (default is stderr).
 +
 +.. option:: -f, --pidfile=PATH
 +
 +  Specify pid file (default is ``/var/run/qemu-ga.pid``).
 +
 +.. option:: -F, --fsfreeze-hook=PATH
 +
 +  Enable fsfreeze hook. Accepts an optional argument that specifies
 +  script to run on freeze/thaw. Script will be called with
 +  'freeze'/'thaw' arguments accordingly (default is
 +  |CONFDIR|\ ``/fsfreeze-hook``). If using -F with an argument, do
 +  not follow -F with a space (for example:
 +  ``-F/var/run/fsfreezehook.sh``).
 +
 +.. option:: -t, --statedir=PATH
 +
 +  Specify the directory to store state information (absolute paths only,
 +  default is ``/var/run``).
 +
 +.. option:: -v, --verbose
 +
 +  Log extra debugging information.
 +
 +.. option:: -V, --version
 +
 +  Print version information and exit.
 +
 +.. option:: -d, --daemon
 +
 +  Daemonize after startup (detach from terminal).
 +
 +.. option:: -b, --blacklist=LIST
 +
 +  Comma-separated list of RPCs to disable (no spaces, ``?`` to list
 +  available RPCs).
 +
 +.. option:: -D, --dump-conf
 +
 +  Dump the configuration in a format compatible with ``qemu-ga.conf``
 +  and exit.
 +
 +.. option:: -h, --help
 +
 +  Display this help and exit.
 +
 +Files
 +-----
 +
 +
 +The syntax of the ``qemu-ga.conf`` configuration file follows the
 +Desktop Entry Specification, here is a quick summary: it consists of
 +groups of key-value pairs, interspersed with comments.
 +
 +::
 +
 +    # qemu-ga configuration sample
 +    [general]
 +    daemonize = 0
 +    pidfile = /var/run/qemu-ga.pid
 +    verbose = 0
 +    method = virtio-serial
 +    path = /dev/virtio-ports/org.qemu.guest_agent.0
 +    statedir = /var/run
 +
 +The list of keys follows the command line options:
 +
 +=============  ===========
 +Key             Key type
 +=============  ===========
 +daemon         boolean
 +method         string
 +path           string
 +logfile        string
 +pidfile        string
 +fsfreeze-hook  string
 +statedir       string
 +verbose        boolean
 +blacklist      string list
 +=============  ===========
 +
 +See also
 +--------
 +
 +:manpage:`qemu(1)`
 diff --git a/qemu-doc.texi b/qemu-doc.texi
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-doc.texi
 +++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@ so should only be used with trusted guest OS.
  @c man end
 -@node QEMU Guest Agent
 -@chapter QEMU Guest Agent invocation
 -
 -@include qemu-ga.texi
 -
  @node QEMU User space emulator
  @chapter QEMU User space emulator
 diff --git a/qemu-ga.texi b/qemu-ga.texi
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/qemu-ga.texi
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -@example
 -@c man begin SYNOPSIS
 -@command{qemu-ga} [@var{OPTIONS}]
 -@c man end
 -@end example
 -
 -@c man begin DESCRIPTION
 -
 -The QEMU Guest Agent is a daemon intended to be run within virtual
 -machines. It allows the hypervisor host to perform various operations
 -in the guest, such as:
 -
 -@itemize
 -@item
 -get information from the guest
 -@item
 -set the guest's system time
 -@item
 -read/write a file
 -@item
 -sync and freeze the filesystems
 -@item
 -suspend the guest
 -@item
 -reconfigure guest local processors
 -@item
 -set user's password
 -@item
 -...
 -@end itemize
 -
 -qemu-ga will read a system configuration file on startup (located at
 -@file{@value{CONFDIR}/qemu-ga.conf} by default), then parse remaining
 -configuration options on the command line. For the same key, the last
 -option wins, but the lists accumulate (see below for configuration
 -file format).
 -
 -@c man end
 -
 -@c man begin OPTIONS
 -@table @option
 -@item -m, --method=@var{method}
 -  Transport method: one of @samp{unix-listen}, @samp{virtio-serial}, or
 -  @samp{isa-serial} (@samp{virtio-serial} is the default).
 -
 -@item -p, --path=@var{path}
 -  Device/socket path (the default for virtio-serial is
 -  @samp{/dev/virtio-ports/org.qemu.guest_agent.0},
 -  the default for isa-serial is @samp{/dev/ttyS0})
 -
 -@item -l, --logfile=@var{path}
 -  Set log file path (default is stderr).
 -
 -@item -f, --pidfile=@var{path}
 -  Specify pid file (default is @samp{/var/run/qemu-ga.pid}).
 -
 -@item -F, --fsfreeze-hook=@var{path}
 -  Enable fsfreeze hook. Accepts an optional argument that specifies
 -  script to run on freeze/thaw. Script will be called with
 -  'freeze'/'thaw' arguments accordingly (default is
 -  @samp{@value{CONFDIR}/fsfreeze-hook}). If using -F with an argument, do
 -  not follow -F with a space (for example:
 -  @samp{-F/var/run/fsfreezehook.sh}).
 -
 -@item -t, --statedir=@var{path}
 -  Specify the directory to store state information (absolute paths only,
 -  default is @samp{/var/run}).
 -
 -@item -v, --verbose
 -  Log extra debugging information.
 -
 -@item -V, --version
 -  Print version information and exit.
 -
 -@item -d, --daemon
 -  Daemonize after startup (detach from terminal).
 -
 -@item -b, --blacklist=@var{list}
 -  Comma-separated list of RPCs to disable (no spaces, @samp{?} to list
 -  available RPCs).
 -
 -@item -D, --dump-conf
 -  Dump the configuration in a format compatible with @file{qemu-ga.conf}
 -  and exit.
 -
 -@item -h, --help
 -  Display this help and exit.
 -@end table
 -
 -@c man end
 -
 -@c man begin FILES
 -
 -The syntax of the @file{qemu-ga.conf} configuration file follows the
 -Desktop Entry Specification, here is a quick summary: it consists of
 -groups of key-value pairs, interspersed with comments.
 -
 -@example
 -# qemu-ga configuration sample
 -[general]
 -daemonize = 0
 -pidfile = /var/run/qemu-ga.pid
 -verbose = 0
 -method = virtio-serial
 -path = /dev/virtio-ports/org.qemu.guest_agent.0
 -statedir = /var/run
 -@end example
 -
 -The list of keys follows the command line options:
 -@table @option
 -@item daemon= boolean
 -@item method= string
 -@item path= string
 -@item logfile= string
 -@item pidfile= string
 -@item fsfreeze-hook= string
 -@item statedir= string
 -@item verbose= boolean
 -@item blacklist= string list
 -@end table
 -
 -@c man end
 -
 -@ignore
 -
 -@setfilename qemu-ga
 -@settitle QEMU Guest Agent
 -
 -@c man begin AUTHOR
 -Michael Roth <mdroth@linux.vnet.ibm.com>
 -@c man end
 -
 -@c man begin SEEALSO
 -qemu(1)
 -@c man end
 -
 -@end ignore
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 25/26] hw/intc/arm_gicv3: Make reserved register addresses RAZ/WI
+Deleted patch
-The GICv3 specification says that reserved register addresses
-should RAZ/WI. This means we need to return MEMTX_OK, not MEMTX_ERROR,
-because now that we support generating external aborts the
-latter will cause an abort on new board models.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1513183941-24300-2-git-send-email-peter.maydell@linaro.org
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
----
- hw/intc/arm_gicv3_dist.c       | 13 +++++++++++++
- hw/intc/arm_gicv3_its_common.c |  8 +++-----
- hw/intc/arm_gicv3_redist.c     | 13 +++++++++++++
-files changed, 29 insertions(+), 5 deletions(-)
-diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_dist.c
-+++ b/hw/intc/arm_gicv3_dist.c
-@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_dist_read(void *opaque, hwaddr offset, uint64_t *data,
-                       "%s: invalid guest read at offset " TARGET_FMT_plx
-                       "size %u\n", __func__, offset, size);
-         trace_gicv3_dist_badread(offset, size, attrs.secure);
-+        /* The spec requires that reserved registers are RAZ/WI;
-+         * so use MEMTX_ERROR returns from leaf functions as a way to
-+         * trigger the guest-error logging but don't return it to
-+         * the caller, or we'll cause a spurious guest data abort.
-+         */
-+        r = MEMTX_OK;
-+        *data = 0;
-     } else {
-         trace_gicv3_dist_read(offset, *data, size, attrs.secure);
-     }
-@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_dist_write(void *opaque, hwaddr offset, uint64_t data,
-                       "%s: invalid guest write at offset " TARGET_FMT_plx
-                       "size %u\n", __func__, offset, size);
-         trace_gicv3_dist_badwrite(offset, data, size, attrs.secure);
-+        /* The spec requires that reserved registers are RAZ/WI;
-+         * so use MEMTX_ERROR returns from leaf functions as a way to
-+         * trigger the guest-error logging but don't return it to
-+         * the caller, or we'll cause a spurious guest data abort.
-+         */
-+        r = MEMTX_OK;
-     } else {
-         trace_gicv3_dist_write(offset, data, size, attrs.secure);
-     }
-diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its_common.c
-+++ b/hw/intc/arm_gicv3_its_common.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_trans_read(void *opaque, hwaddr offset,
-                                         MemTxAttrs attrs)
- {
-     qemu_log_mask(LOG_GUEST_ERROR, "ITS read at offset 0x%"PRIx64"\n", offset);
--    return MEMTX_ERROR;
-+    *data = 0;
-+    return MEMTX_OK;
- }
- static MemTxResult gicv3_its_trans_write(void *opaque, hwaddr offset,
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_trans_write(void *opaque, hwaddr offset,
-         if (ret <= 0) {
-             qemu_log_mask(LOG_GUEST_ERROR,
-                           "ITS: Error sending MSI: %s\n", strerror(-ret));
--            return MEMTX_DECODE_ERROR;
-         }
--
--        return MEMTX_OK;
-     } else {
-         qemu_log_mask(LOG_GUEST_ERROR,
-                       "ITS write at bad offset 0x%"PRIx64"\n", offset);
--        return MEMTX_DECODE_ERROR;
-     }
-+    return MEMTX_OK;
- }
- static const MemoryRegionOps gicv3_its_trans_ops = {
-diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_redist.c
-+++ b/hw/intc/arm_gicv3_redist.c
-@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_read(void *opaque, hwaddr offset, uint64_t *data,
-                       "size %u\n", __func__, offset, size);
-         trace_gicv3_redist_badread(gicv3_redist_affid(cs), offset,
-                                    size, attrs.secure);
-+        /* The spec requires that reserved registers are RAZ/WI;
-+         * so use MEMTX_ERROR returns from leaf functions as a way to
-+         * trigger the guest-error logging but don't return it to
-+         * the caller, or we'll cause a spurious guest data abort.
-+         */
-+        r = MEMTX_OK;
-+        *data = 0;
-     } else {
-         trace_gicv3_redist_read(gicv3_redist_affid(cs), offset, *data,
-                                 size, attrs.secure);
-@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
-                       "size %u\n", __func__, offset, size);
-         trace_gicv3_redist_badwrite(gicv3_redist_affid(cs), offset, data,
-                                     size, attrs.secure);
-+        /* The spec requires that reserved registers are RAZ/WI;
-+         * so use MEMTX_ERROR returns from leaf functions as a way to
-+         * trigger the guest-error logging but don't return it to
-+         * the caller, or we'll cause a spurious guest data abort.
-+         */
-+        r = MEMTX_OK;
-     } else {
-         trace_gicv3_redist_write(gicv3_redist_affid(cs), offset, data,
-                                  size, attrs.secure);
---
-.7.4

-[Qemu-devel] [PULL 26/26] hw/intc/arm_gic: reserved register addresses are RAZ/WI
+Deleted patch
-The GICv2 specification says that reserved register addresses
-must RAZ/WI; now that we implement external abort handling
-for Arm CPUs this means we must return MEMTX_OK rather than
-MEMTX_ERROR, to avoid generating a spurious guest data abort.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1513183941-24300-3-git-send-email-peter.maydell@linaro.org
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
----
- hw/intc/arm_gic.c | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
-+++ b/hw/intc/arm_gic.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_read(GICState *s, int cpu, int offset,
-     default:
-         qemu_log_mask(LOG_GUEST_ERROR,
-                       "gic_cpu_read: Bad offset %x\n", (int)offset);
--        return MEMTX_ERROR;
-+        *data = 0;
-+        break;
-     }
-     return MEMTX_OK;
- }
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_write(GICState *s, int cpu, int offset,
-     default:
-         qemu_log_mask(LOG_GUEST_ERROR,
-                       "gic_cpu_write: Bad offset %x\n", (int)offset);
--        return MEMTX_ERROR;
-+        return MEMTX_OK;
-     }
-     gic_update(s);
-     return MEMTX_OK;
---
-.7.4

ARM queue, various patches accumulated over the Christmas break.

-- PMM

The following changes since commit 612061b277915fadd80631eb7a6926f48a110c44:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-01-10' into staging (2018-01-11 11:52:40 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180111

for you to fetch changes up to 0cf09852015e47a5fbb974ff7ac320366afd21ee:

hw/intc/arm_gic: reserved register addresses are RAZ/WI (2018-01-11 13:25:40 +0000)

----------------------------------------------------------------
target-arm queue:
 * add aarch64_be linux-user target
 * Virt: ACPI: fix qemu assert due to re-assigned table data address
 * imx_fec: various bug fixes and cleanups
 * hw/timer/pxa2xx_timer: replace hw_error() -> qemu_log_mask()
 * hw/sd/pxa2xx_mmci: add read/write() trace events
 * linux-user/arm/nwfpe: Check coprocessor number for FPA emulation
 * target/arm: Make disas_thumb2_insn() generate its own UNDEF exceptions
 * hw/intc/arm_gicv3: Make reserved register addresses RAZ/WI
 * hw/intc/arm_gic: reserved register addresses are RAZ/WI

----------------------------------------------------------------
Andrey Smirnov (11):
      imx_fec: Do not link to netdev
      imx_fec: Refactor imx_eth_enable_rx()
      imx_fec: Change queue flushing heuristics
      imx_fec: Move Tx frame buffer away from the stack
      imx_fec: Use ENET_FTRL to determine truncation length
      imx_fec: Use MIN instead of explicit ternary operator
      imx_fec: Emulate SHIFT16 in ENETx_RACC
      imx_fec: Add support for multiple Tx DMA rings
      imx_fec: Use correct length for packet size
      imx_fec: Fix a typo in imx_enet_receive()
      imx_fec: Reserve full FSL_IMX25_FEC_SIZE page for the register file

Michael Weiser (8):
      linux-user: Add support for big-endian aarch64
      linux-user: Add separate aarch64_be uname
      linux-user: Fix endianess of aarch64 signal trampoline
      configure: Add aarch64_be-linux-user target
      linux-user: Add aarch64_be magic numbers to qemu-binfmt-conf.sh
      linux-user: Separate binfmt arm CPU families
      linux-user: Activate armeb handler registration
      target/arm: Fix stlxp for aarch64_be

Peter Maydell (4):
      linux-user/arm/nwfpe: Check coprocessor number for FPA emulation
      target/arm: Make disas_thumb2_insn() generate its own UNDEF exceptions
      hw/intc/arm_gicv3: Make reserved register addresses RAZ/WI
      hw/intc/arm_gic: reserved register addresses are RAZ/WI

Philippe Mathieu-Daudé (2):
      hw/timer/pxa2xx_timer: replace hw_error() -> qemu_log_mask()
      hw/sd/pxa2xx_mmci: add read/write() trace events

Zhaoshenglong (1):
      Virt: ACPI: fix qemu assert due to re-assigned table data address

From: Michael Weiser <michael.weiser@gmx.de>

Enable big-endian mode for data accesses on aarch64 for big-endian linux
user mode. Activate it for all exception levels as documented by ARM:
Set the SCTLR EE bit for ELs 1 through 3. Additionally set bit E0E in
EL1 to enable it in EL0 as well.

Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20171220212308.12614-2-michael.weiser@gmx.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/main.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/linux-user/main.c b/linux-user/main.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
         }
         env->pc = regs->pc;
         env->xregs[31] = regs->sp;
+#ifdef TARGET_WORDS_BIGENDIAN
+        env->cp15.sctlr_el[1] |= SCTLR_E0E;
+        for (i = 1; i < 4; ++i) {
+            env->cp15.sctlr_el[i] |= SCTLR_EE;
+        }
+#endif
     }
 #elif defined(TARGET_ARM)
     {
-- 
2.7.4

From: Michael Weiser <michael.weiser@gmx.de>

Make big-endian aarch64 systems identify as aarch64_be as expected by
big-endian userland and toolchains.

Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-id: 20171220212308.12614-3-michael.weiser@gmx.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/aarch64/target_syscall.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/linux-user/aarch64/target_syscall.h b/linux-user/aarch64/target_syscall.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/aarch64/target_syscall.h
+++ b/linux-user/aarch64/target_syscall.h
@@ -XXX,XX +XXX,XX @@ struct target_pt_regs {
     uint64_t        pstate;
 };
 
+#if defined(TARGET_WORDS_BIGENDIAN)
+#define UNAME_MACHINE "aarch64_be"
+#else
 #define UNAME_MACHINE "aarch64"
+#endif
 #define UNAME_MINIMUM_RELEASE "3.8.0"
 #define TARGET_CLONE_BACKWARDS
 #define TARGET_MINSIGSTKSZ       2048
-- 
2.7.4

From: Michael Weiser <michael.weiser@gmx.de>

Since for aarch64 the signal trampoline is synthesized directly into the
signal frame we need to make sure the instructions end up little-endian.
Otherwise the wrong endianness will cause a SIGILL upon return from the
signal handler on big-endian targets.

Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20171220212308.12614-4-michael.weiser@gmx.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/signal.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/linux-user/signal.c b/linux-user/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -XXX,XX +XXX,XX @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
     if (ka->sa_flags & TARGET_SA_RESTORER) {
         return_addr = ka->sa_restorer;
     } else {
-        /* mov x8,#__NR_rt_sigreturn; svc #0 */
-        __put_user(0xd2801168, &frame->tramp[0]);
-        __put_user(0xd4000001, &frame->tramp[1]);
+        /*
+         * mov x8,#__NR_rt_sigreturn; svc #0
+         * Since these are instructions they need to be put as little-endian
+         * regardless of target default or current CPU endianness.
+         */
+        __put_user_e(0xd2801168, &frame->tramp[0], le);
+        __put_user_e(0xd4000001, &frame->tramp[1], le);
         return_addr = frame_addr + offsetof(struct target_rt_sigframe, tramp);
     }
     env->xregs[0] = usig;
-- 
2.7.4

From: Michael Weiser <michael.weiser@gmx.de>

Add target aarch64_be-linux-user. This allows a qemu-aarch64_be binary
to be built that will run big-endian aarch64 binaries.

Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-id: 20171220212308.12614-5-michael.weiser@gmx.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure                                 | 5 +++--
 default-configs/aarch64_be-linux-user.mak | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)
 create mode 100644 default-configs/aarch64_be-linux-user.mak

From: Michael Weiser <michael.weiser@gmx.de>

As we now have a linux-user aarch64_be target, we can add it to the list
of supported targets in qemu-binfmt-conf.sh

Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-id: 20171220212308.12614-6-michael.weiser@gmx.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 scripts/qemu-binfmt-conf.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
index XXXXXXX..XXXXXXX 100755
--- a/scripts/qemu-binfmt-conf.sh
+++ b/scripts/qemu-binfmt-conf.sh
@@ -XXX,XX +XXX,XX @@
 
 qemu_target_list="i386 i486 alpha arm sparc32plus ppc ppc64 ppc64le m68k \
 mips mipsel mipsn32 mipsn32el mips64 mips64el \
-sh4 sh4eb s390x aarch64 hppa"
+sh4 sh4eb s390x aarch64 aarch64_be hppa"
 
 i386_magic='\x7fELF\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x03\x00'
 i386_mask='\xff\xff\xff\xff\xff\xfe\xfe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'
@@ -XXX,XX +XXX,XX @@ aarch64_magic='\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x
 aarch64_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'
 aarch64_family=arm
 
+aarch64_be_magic='\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7'
+aarch64_be_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
+aarch64_be_family=arm
+
 hppa_magic='\x7f\x45\x4c\x46\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x0f'
 hppa_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
 hppa_family=hppa
-- 
2.7.4

From: Michael Weiser <michael.weiser@gmx.de>

Give big-endian arm and aarch64 CPUs their own family in
qemu-binfmt-conf.sh to make sure we register qemu-user for binaries of
the opposite endianness on arm and aarch64. Apart from the family
assignments of the magic values, qemu_get_family() needs to be able to
distinguish the two and recognise aarch64{,_be} as well.

Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-id: 20171220212308.12614-7-michael.weiser@gmx.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 scripts/qemu-binfmt-conf.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
index XXXXXXX..XXXXXXX 100755
--- a/scripts/qemu-binfmt-conf.sh
+++ b/scripts/qemu-binfmt-conf.sh
@@ -XXX,XX +XXX,XX @@ arm_family=arm
 
 armeb_magic='\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x28'
 armeb_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
-armeb_family=arm
+armeb_family=armeb
 
 sparc_magic='\x7fELF\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x02'
 sparc_mask='\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
@@ -XXX,XX +XXX,XX @@ aarch64_family=arm
 
 aarch64_be_magic='\x7fELF\x02\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7'
 aarch64_be_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
-aarch64_be_family=arm
+aarch64_be_family=armeb
 
 hppa_magic='\x7f\x45\x4c\x46\x01\x02\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x0f'
 hppa_mask='\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff'
@@ -XXX,XX +XXX,XX @@ qemu_get_family() {
     ppc64el|ppc64le)
         echo "ppcle"
         ;;
-    arm|armel|armhf|arm64|armv[4-9]*)
+    arm|armel|armhf|arm64|armv[4-9]*l|aarch64)
         echo "arm"
         ;;
+    armeb|armv[4-9]*b|aarch64_be)
+        echo "armeb"
+        ;;
     sparc*)
         echo "sparc"
         ;;
-- 
2.7.4

From: Michael Weiser <michael.weiser@gmx.de>

armeb is missing from the target list in qemu-binfmt-conf.sh. Add it so
the handler for those binaries gets registered by the script.

Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-id: 20171220212308.12614-8-michael.weiser@gmx.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 scripts/qemu-binfmt-conf.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/qemu-binfmt-conf.sh b/scripts/qemu-binfmt-conf.sh
index XXXXXXX..XXXXXXX 100755
--- a/scripts/qemu-binfmt-conf.sh
+++ b/scripts/qemu-binfmt-conf.sh
@@ -XXX,XX +XXX,XX @@
 # enable automatic i386/ARM/M68K/MIPS/SPARC/PPC/s390/HPPA
 # program execution by the kernel
 
-qemu_target_list="i386 i486 alpha arm sparc32plus ppc ppc64 ppc64le m68k \
+qemu_target_list="i386 i486 alpha arm armeb sparc32plus ppc ppc64 ppc64le m68k \
 mips mipsel mipsn32 mipsn32el mips64 mips64el \
 sh4 sh4eb s390x aarch64 aarch64_be hppa"
 
-- 
2.7.4

From: Michael Weiser <michael.weiser@gmx.de>

ldxp loads two consecutive doublewords from memory regardless of CPU
endianness. On store, stlxp currently assumes to work with a 128bit
value and consequently switches order in big-endian mode. With this
change it packs the doublewords in reverse order in anticipation of the
128bit big-endian store operation interposing them so they end up in
memory in the right order. This makes it work for both MTTCG and !MTTCG.
It effectively implements the ARM ARM STLXP operation pseudo-code:

data = if BigEndian() then el1:el2 else el2:el1;

With this change an aarch64_be Linux 4.14.4 kernel succeeds to boot up
in system emulation mode.

Signed-off-by: Michael Weiser <michael.weiser@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_paired_cmpxchg64_be(CPUARMState *env, uint64_t addr,
     Int128 oldv, cmpv, newv;
     bool success;
 
-    cmpv = int128_make128(env->exclusive_val, env->exclusive_high);
-    newv = int128_make128(new_lo, new_hi);
+    /* high and low need to be switched here because this is not actually a
+     * 128bit store but two doublewords stored consecutively
+     */
+    cmpv = int128_make128(env->exclusive_high, env->exclusive_val);
+    newv = int128_make128(new_hi, new_lo);
 
     if (parallel) {
 #ifndef CONFIG_ATOMIC128
-- 
2.7.4

From: Zhaoshenglong <zhaoshenglong@huawei.com>

acpi_data_push uses g_array_set_size to resize the memory size. If there
is no enough contiguous memory, the address will be changed. If we use
the old value, it will assert.
qemu-kvm: hw/acpi/bios-linker-loader.c:214: bios_linker_loader_add_checksum:
Assertion `start_offset < file->blob->len' failed.`

This issue only happens in building SRAT table now but here we unify the
pattern for other tables as well to avoid possible issues in the future.

Signed-off-by: Zhaoshenglong <zhaoshenglong@huawei.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_spcr(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     AcpiSerialPortConsoleRedirection *spcr;
     const MemMapEntry *uart_memmap = &vms->memmap[VIRT_UART];
     int irq = vms->irqmap[VIRT_UART] + ARM_SPI_BASE;
+    int spcr_start = table_data->len;
 
     spcr = acpi_data_push(table_data, sizeof(*spcr));
 
@@ -XXX,XX +XXX,XX @@ build_spcr(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     spcr->pci_device_id = 0xffff;  /* PCI Device ID: not a PCI device */
     spcr->pci_vendor_id = 0xffff;  /* PCI Vendor ID: not a PCI device */
 
-    build_header(linker, table_data, (void *)spcr, "SPCR", sizeof(*spcr), 2,
-                 NULL, NULL);
+    build_header(linker, table_data, (void *)(table_data->data + spcr_start),
+                 "SPCR", table_data->len - spcr_start, 2, NULL, NULL);
 }
 
 static void
@@ -XXX,XX +XXX,XX @@ build_srat(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         mem_base += numa_info[i].node_mem;
     }
 
-    build_header(linker, table_data, (void *)srat, "SRAT",
-                 table_data->len - srat_start, 3, NULL, NULL);
+    build_header(linker, table_data, (void *)(table_data->data + srat_start),
+                 "SRAT", table_data->len - srat_start, 3, NULL, NULL);
 }
 
 static void
@@ -XXX,XX +XXX,XX @@ build_mcfg(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     AcpiTableMcfg *mcfg;
     const MemMapEntry *memmap = vms->memmap;
     int len = sizeof(*mcfg) + sizeof(mcfg->allocation[0]);
+    int mcfg_start = table_data->len;
 
     mcfg = acpi_data_push(table_data, len);
     mcfg->allocation[0].address = cpu_to_le64(memmap[VIRT_PCIE_ECAM].base);
@@ -XXX,XX +XXX,XX @@ build_mcfg(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     mcfg->allocation[0].end_bus_number = (memmap[VIRT_PCIE_ECAM].size
                                           / PCIE_MMCFG_SIZE_MIN) - 1;
 
-    build_header(linker, table_data, (void *)mcfg, "MCFG", len, 1, NULL, NULL);
+    build_header(linker, table_data, (void *)(table_data->data + mcfg_start),
+                 "MCFG", table_data->len - mcfg_start, 1, NULL, NULL);
 }
 
 /* GTDT */
@@ -XXX,XX +XXX,XX @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 static void build_fadt(GArray *table_data, BIOSLinker *linker,
                        VirtMachineState *vms, unsigned dsdt_tbl_offset)
 {
+    int fadt_start = table_data->len;
     AcpiFadtDescriptorRev5_1 *fadt = acpi_data_push(table_data, sizeof(*fadt));
     unsigned xdsdt_entry_offset = (char *)&fadt->x_dsdt - table_data->data;
     uint16_t bootflags;
@@ -XXX,XX +XXX,XX @@ static void build_fadt(GArray *table_data, BIOSLinker *linker,
         ACPI_BUILD_TABLE_FILE, xdsdt_entry_offset, sizeof(fadt->x_dsdt),
         ACPI_BUILD_TABLE_FILE, dsdt_tbl_offset);
 
-    build_header(linker, table_data,
-                 (void *)fadt, "FACP", sizeof(*fadt), 5, NULL, NULL);
+    build_header(linker, table_data, (void *)(table_data->data + fadt_start),
+                 "FACP", table_data->len - fadt_start, 5, NULL, NULL);
 }
 
 /* DSDT */
-- 
2.7.4

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Binding to a particular netdev doesn't seem to belong to this layer
and should probably be done as a part of board or SoC specific code.

Convert all of the users of this IP block to use
qdev_set_nic_properties() instead.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx6.c | 1 +
 hw/net/imx_fec.c  | 2 --
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                             spi_table[i].irq));
     }
 
+    qdev_set_nic_properties(DEVICE(&s->eth), &nd_table[0]);
     object_property_set_bool(OBJECT(&s->eth), true, "realized", &err);
     if (err) {
         error_propagate(errp, err);
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)
 
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
-    s->conf.peers.ncs[0] = nd_table[0].netdev;
-
     s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf,
                           object_get_typename(OBJECT(dev)),
                           DEVICE(dev)->id, s);
-- 
2.7.4

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Refactor imx_eth_enable_rx() to have more meaningfull variable name
than 'tmp' and to reduce number of logical negations done.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/imx_fec.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_eth_do_tx(IMXFECState *s)
 static void imx_eth_enable_rx(IMXFECState *s)
 {
     IMXFECBufDesc bd;
-    bool tmp;
+    bool rx_ring_full;
 
     imx_fec_read_bd(&bd, s->rx_descriptor);
 
-    tmp = ((bd.flags & ENET_BD_E) != 0);
+    rx_ring_full = !(bd.flags & ENET_BD_E);
 
-    if (!tmp) {
+    if (rx_ring_full) {
         FEC_PRINTF("RX buffer full\n");
     } else if (!s->regs[ENET_RDAR]) {
         qemu_flush_queued_packets(qemu_get_queue(s->nic));
     }
 
-    s->regs[ENET_RDAR] = tmp ? ENET_RDAR_RDAR : 0;
+    s->regs[ENET_RDAR] = rx_ring_full ? 0 : ENET_RDAR_RDAR;
 }
 
 static void imx_eth_reset(DeviceState *d)
-- 
2.7.4

From: Andrey Smirnov <andrew.smirnov@gmail.com>

In current implementation, packet queue flushing logic seem to suffer
from a deadlock like scenario if a packet is received by the interface
before before Rx ring is initialized by Guest's driver. Consider the
following sequence of events:

1. A QEMU instance is started against a TAP device on Linux
	   host, running Linux guest, e. g., something to the effect
	   of:

qemu-system-arm \
	      -net nic,model=imx.fec,netdev=lan0 \
	      netdev tap,id=lan0,ifname=tap0,script=no,downscript=no \
	      ... rest of the arguments ...

2. Once QEMU starts, but before guest reaches the point where
	   FEC deriver is done initializing the HW, Guest, via TAP
	   interface, receives a number of multicast MDNS packets from
	   Host (not necessarily true for every OS, but it happens at
	   least on Fedora 25)

3. Recieving a packet in such a state results in
	   imx_eth_can_receive() returning '0', which in turn causes
	   tap_send() to disable corresponding event (tap.c:203)

4. Once Guest's driver reaches the point where it is ready to
	   recieve packets it prepares Rx ring descriptors and writes
	   ENET_RDAR_RDAR to ENET_RDAR register to indicate to HW that
	   more descriptors are ready. And at this points emulation
	   layer does this:

s->regs[index] = ENET_RDAR_RDAR;
                 imx_eth_enable_rx(s);

which, combined with:

if (!s->regs[ENET_RDAR]) {
		     qemu_flush_queued_packets(qemu_get_queue(s->nic));
		  }

results in Rx queue never being flushed and corresponding
	   I/O event beign disabled.

To prevent the problem, change the code to always flush packet queue
when ENET_RDAR transitions 0 -> ENET_RDAR_RDAR.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/imx_fec.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_eth_do_tx(IMXFECState *s)
     }
 }
 
-static void imx_eth_enable_rx(IMXFECState *s)
+static void imx_eth_enable_rx(IMXFECState *s, bool flush)
 {
     IMXFECBufDesc bd;
     bool rx_ring_full;
@@ -XXX,XX +XXX,XX @@ static void imx_eth_enable_rx(IMXFECState *s)
 
     if (rx_ring_full) {
         FEC_PRINTF("RX buffer full\n");
-    } else if (!s->regs[ENET_RDAR]) {
+    } else if (flush) {
         qemu_flush_queued_packets(qemu_get_queue(s->nic));
     }
 
@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
         if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
             if (!s->regs[index]) {
                 s->regs[index] = ENET_RDAR_RDAR;
-                imx_eth_enable_rx(s);
+                imx_eth_enable_rx(s, true);
             }
         } else {
             s->regs[index] = 0;
@@ -XXX,XX +XXX,XX @@ static int imx_eth_can_receive(NetClientState *nc)
 
     FEC_PRINTF("\n");
 
-    return s->regs[ENET_RDAR] ? 1 : 0;
+    return !!s->regs[ENET_RDAR];
 }
 
 static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf,
         }
     }
     s->rx_descriptor = addr;
-    imx_eth_enable_rx(s);
+    imx_eth_enable_rx(s, false);
     imx_eth_update(s);
     return len;
 }
@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
         }
     }
     s->rx_descriptor = addr;
-    imx_eth_enable_rx(s);
+    imx_eth_enable_rx(s, false);
     imx_eth_update(s);
     return len;
 }
-- 
2.7.4

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Make Tx frame assembly buffer to be a paort of IMXFECState structure
to avoid a concern about having large data buffer on the stack.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/imx_fec.h |  3 +++
 hw/net/imx_fec.c         | 22 +++++++++++-----------
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/imx_fec.h
+++ b/include/hw/net/imx_fec.h
@@ -XXX,XX +XXX,XX @@ typedef struct IMXFECState {
     uint32_t phy_int_mask;
 
     bool is_fec;
+
+    /* Buffer used to assemble a Tx frame */
+    uint8_t frame[ENET_MAX_FRAME_SIZE];
 } IMXFECState;
 
 #endif
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_eth_update(IMXFECState *s)
 static void imx_fec_do_tx(IMXFECState *s)
 {
     int frame_size = 0, descnt = 0;
-    uint8_t frame[ENET_MAX_FRAME_SIZE];
-    uint8_t *ptr = frame;
+    uint8_t *ptr = s->frame;
     uint32_t addr = s->tx_descriptor;
 
     while (descnt++ < IMX_MAX_DESC) {
@@ -XXX,XX +XXX,XX @@ static void imx_fec_do_tx(IMXFECState *s)
         frame_size += len;
         if (bd.flags & ENET_BD_L) {
             /* Last buffer in frame.  */
-            qemu_send_packet(qemu_get_queue(s->nic), frame, frame_size);
-            ptr = frame;
+            qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size);
+            ptr = s->frame;
             frame_size = 0;
             s->regs[ENET_EIR] |= ENET_INT_TXF;
         }
@@ -XXX,XX +XXX,XX @@ static void imx_fec_do_tx(IMXFECState *s)
 static void imx_enet_do_tx(IMXFECState *s)
 {
     int frame_size = 0, descnt = 0;
-    uint8_t frame[ENET_MAX_FRAME_SIZE];
-    uint8_t *ptr = frame;
+    uint8_t *ptr = s->frame;
     uint32_t addr = s->tx_descriptor;
 
     while (descnt++ < IMX_MAX_DESC) {
@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s)
         frame_size += len;
         if (bd.flags & ENET_BD_L) {
             if (bd.option & ENET_BD_PINS) {
-                struct ip_header *ip_hd = PKT_GET_IP_HDR(frame);
+                struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame);
                 if (IP_HEADER_VERSION(ip_hd) == 4) {
-                    net_checksum_calculate(frame, frame_size);
+                    net_checksum_calculate(s->frame, frame_size);
                 }
             }
             if (bd.option & ENET_BD_IINS) {
-                struct ip_header *ip_hd = PKT_GET_IP_HDR(frame);
+                struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame);
                 /* We compute checksum only for IPv4 frames */
                 if (IP_HEADER_VERSION(ip_hd) == 4) {
                     uint16_t csum;
@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s)
                 }
             }
             /* Last buffer in frame.  */
-            qemu_send_packet(qemu_get_queue(s->nic), frame, len);
-            ptr = frame;
+
+            qemu_send_packet(qemu_get_queue(s->nic), s->frame, len);
+            ptr = s->frame;
+
             frame_size = 0;
             if (bd.option & ENET_BD_TX_INT) {
                 s->regs[ENET_EIR] |= ENET_INT_TXF;
-- 
2.7.4

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Frame truncation length, TRUNC_FL, is determined by the contents of
ENET_FTRL register, so convert the code to use it instead of a
hardcoded constant.

To avoid the case where TRUNC_FL is greater that ENET_MAX_FRAME_SIZE,
increase the value of the latter to its theoretical maximum of 16K.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/imx_fec.h | 3 ++-
 hw/net/imx_fec.c         | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/imx_fec.h
+++ b/include/hw/net/imx_fec.h
@@ -XXX,XX +XXX,XX @@
 #define ENET_TCCR3             393
 #define ENET_MAX               400
 
-#define ENET_MAX_FRAME_SIZE    2032
 
 /* EIR and EIMR */
 #define ENET_INT_HB            (1 << 31)
@@ -XXX,XX +XXX,XX @@
 #define ENET_RCR_NLC           (1 << 30)
 #define ENET_RCR_GRS           (1 << 31)
 
+#define ENET_MAX_FRAME_SIZE    (1 << ENET_RCR_MAX_FL_LENGTH)
+
 /* TCR */
 #define ENET_TCR_GTS           (1 << 0)
 #define ENET_TCR_FDEN          (1 << 2)
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
     crc_ptr = (uint8_t *) &crc;
 
     /* Huge frames are truncted.  */
-    if (size > ENET_MAX_FRAME_SIZE) {
-        size = ENET_MAX_FRAME_SIZE;
+    if (size > s->regs[ENET_FTRL]) {
+        size = s->regs[ENET_FTRL];
         flags |= ENET_BD_TR | ENET_BD_LG;
     }
 
-- 
2.7.4

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Needed to support latest Linux kernel driver which relies on that
functionality.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/imx_fec.h |  2 ++
 hw/net/imx_fec.c         | 23 +++++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/imx_fec.h
+++ b/include/hw/net/imx_fec.h
@@ -XXX,XX +XXX,XX @@
 #define ENET_TWFR_TFWR_LENGTH  (6)
 #define ENET_TWFR_STRFWD       (1 << 8)
 
+#define ENET_RACC_SHIFT16      BIT(7)
+
 /* Buffer Descriptor.  */
 typedef struct {
     uint16_t length;
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
     uint8_t *crc_ptr;
     unsigned int buf_len;
     size_t size = len;
+    bool shift16 = s->regs[ENET_RACC] & ENET_RACC_SHIFT16;
 
     FEC_PRINTF("len %d\n", (int)size);
 
@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
     crc = cpu_to_be32(crc32(~0, buf, size));
     crc_ptr = (uint8_t *) &crc;
 
+    if (shift16) {
+        size += 2;
+    }
+
     /* Huge frames are truncted.  */
     if (size > s->regs[ENET_FTRL]) {
         size = s->regs[ENET_FTRL];
@@ -XXX,XX +XXX,XX @@ static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
             buf_len += size - 4;
         }
         buf_addr = bd.data;
+
+        if (shift16) {
+            /*
+             * If SHIFT16 bit of ENETx_RACC register is set we need to
+             * align the payload to 4-byte boundary.
+             */
+            const uint8_t zeros[2] = { 0 };
+
+            dma_memory_write(&address_space_memory, buf_addr,
+                             zeros, sizeof(zeros));
+
+            buf_addr += sizeof(zeros);
+            buf_len  -= sizeof(zeros);
+
+            /* We only do this once per Ethernet frame */
+            shift16 = false;
+        }
+
         dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
         buf += buf_len;
         if (size < 4) {
-- 
2.7.4

From: Andrey Smirnov <andrew.smirnov@gmail.com>

More recent version of the IP block support more than one Tx DMA ring,
so add the code implementing that feature.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/imx_fec.h |  18 ++++++-
 hw/net/imx_fec.c         | 133 ++++++++++++++++++++++++++++++++++++++++-------
 2 files changed, 130 insertions(+), 21 deletions(-)

diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/imx_fec.h
+++ b/include/hw/net/imx_fec.h
@@ -XXX,XX +XXX,XX @@
 #define ENET_TFWR              81
 #define ENET_FRBR              83
 #define ENET_FRSR              84
+#define ENET_TDSR1             89
+#define ENET_TDSR2             92
 #define ENET_RDSR              96
 #define ENET_TDSR              97
 #define ENET_MRBR              98
@@ -XXX,XX +XXX,XX @@
 #define ENET_FTRL              108
 #define ENET_TACC              112
 #define ENET_RACC              113
+#define ENET_TDAR1             121
+#define ENET_TDAR2             123
 #define ENET_MIIGSK_CFGR       192
 #define ENET_MIIGSK_ENR        194
 #define ENET_ATCR              256
@@ -XXX,XX +XXX,XX @@
 #define ENET_INT_WAKEUP        (1 << 17)
 #define ENET_INT_TS_AVAIL      (1 << 16)
 #define ENET_INT_TS_TIMER      (1 << 15)
+#define ENET_INT_TXF2          (1 <<  7)
+#define ENET_INT_TXB2          (1 <<  6)
+#define ENET_INT_TXF1          (1 <<  3)
+#define ENET_INT_TXB1          (1 <<  2)
 
 #define ENET_INT_MAC           (ENET_INT_HB | ENET_INT_BABR | ENET_INT_BABT | \
                                 ENET_INT_GRA | ENET_INT_TXF | ENET_INT_TXB | \
                                 ENET_INT_RXF | ENET_INT_RXB | ENET_INT_MII | \
                                 ENET_INT_EBERR | ENET_INT_LC | ENET_INT_RL | \
                                 ENET_INT_UN | ENET_INT_PLR | ENET_INT_WAKEUP | \
-                                ENET_INT_TS_AVAIL)
+                                ENET_INT_TS_AVAIL | ENET_INT_TXF1 | \
+                                ENET_INT_TXB1 | ENET_INT_TXF2 | ENET_INT_TXB2)
 
 /* RDAR */
 #define ENET_RDAR_RDAR         (1 << 24)
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 #define ENET_BD_BDU            (1 << 31)
 
+#define ENET_TX_RING_NUM       3
+
+
 typedef struct IMXFECState {
     /*< private >*/
     SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct IMXFECState {
 
     uint32_t regs[ENET_MAX];
     uint32_t rx_descriptor;
-    uint32_t tx_descriptor;
+
+    uint32_t tx_descriptor[ENET_TX_RING_NUM];
+    uint32_t tx_ring_num;
 
     uint32_t phy_status;
     uint32_t phy_control;
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_eth_reg_name(IMXFECState *s, uint32_t index)
     }
 }
 
+/*
+ * Versions of this device with more than one TX descriptor save the
+ * 2nd and 3rd descriptors in a subsection, to maintain migration
+ * compatibility with previous versions of the device that only
+ * supported a single descriptor.
+ */
+static bool imx_eth_is_multi_tx_ring(void *opaque)
+{
+    IMXFECState *s = IMX_FEC(opaque);
+
+    return s->tx_ring_num > 1;
+}
+
+static const VMStateDescription vmstate_imx_eth_txdescs = {
+    .name = "imx.fec/txdescs",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = imx_eth_is_multi_tx_ring,
+    .fields = (VMStateField[]) {
+         VMSTATE_UINT32(tx_descriptor[1], IMXFECState),
+         VMSTATE_UINT32(tx_descriptor[2], IMXFECState),
+         VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_imx_eth = {
     .name = TYPE_IMX_FEC,
     .version_id = 2,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_eth = {
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX),
         VMSTATE_UINT32(rx_descriptor, IMXFECState),
-        VMSTATE_UINT32(tx_descriptor, IMXFECState),
-
+        VMSTATE_UINT32(tx_descriptor[0], IMXFECState),
         VMSTATE_UINT32(phy_status, IMXFECState),
         VMSTATE_UINT32(phy_control, IMXFECState),
         VMSTATE_UINT32(phy_advertise, IMXFECState),
         VMSTATE_UINT32(phy_int, IMXFECState),
         VMSTATE_UINT32(phy_int_mask, IMXFECState),
         VMSTATE_END_OF_LIST()
-    }
+    },
+    .subsections = (const VMStateDescription * []) {
+        &vmstate_imx_eth_txdescs,
+        NULL
+    },
 };
 
 #define PHY_INT_ENERGYON            (1 << 7)
@@ -XXX,XX +XXX,XX @@ static void imx_fec_do_tx(IMXFECState *s)
 {
     int frame_size = 0, descnt = 0;
     uint8_t *ptr = s->frame;
-    uint32_t addr = s->tx_descriptor;
+    uint32_t addr = s->tx_descriptor[0];
 
     while (descnt++ < IMX_MAX_DESC) {
         IMXFECBufDesc bd;
@@ -XXX,XX +XXX,XX @@ static void imx_fec_do_tx(IMXFECState *s)
         }
     }
 
-    s->tx_descriptor = addr;
+    s->tx_descriptor[0] = addr;
 
     imx_eth_update(s);
 }
 
-static void imx_enet_do_tx(IMXFECState *s)
+static void imx_enet_do_tx(IMXFECState *s, uint32_t index)
 {
     int frame_size = 0, descnt = 0;
+
     uint8_t *ptr = s->frame;
-    uint32_t addr = s->tx_descriptor;
+    uint32_t addr, int_txb, int_txf, tdsr;
+    size_t ring;
+
+    switch (index) {
+    case ENET_TDAR:
+        ring    = 0;
+        int_txb = ENET_INT_TXB;
+        int_txf = ENET_INT_TXF;
+        tdsr    = ENET_TDSR;
+        break;
+    case ENET_TDAR1:
+        ring    = 1;
+        int_txb = ENET_INT_TXB1;
+        int_txf = ENET_INT_TXF1;
+        tdsr    = ENET_TDSR1;
+        break;
+    case ENET_TDAR2:
+        ring    = 2;
+        int_txb = ENET_INT_TXB2;
+        int_txf = ENET_INT_TXF2;
+        tdsr    = ENET_TDSR2;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: bogus value for index %x\n",
+                      __func__, index);
+        abort();
+        break;
+    }
+
+    addr = s->tx_descriptor[ring];
 
     while (descnt++ < IMX_MAX_DESC) {
         IMXENETBufDesc bd;
@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s)
 
             frame_size = 0;
             if (bd.option & ENET_BD_TX_INT) {
-                s->regs[ENET_EIR] |= ENET_INT_TXF;
+                s->regs[ENET_EIR] |= int_txf;
             }
         }
         if (bd.option & ENET_BD_TX_INT) {
-            s->regs[ENET_EIR] |= ENET_INT_TXB;
+            s->regs[ENET_EIR] |= int_txb;
         }
         bd.flags &= ~ENET_BD_R;
         /* Write back the modified descriptor.  */
         imx_enet_write_bd(&bd, addr);
         /* Advance to the next descriptor.  */
         if ((bd.flags & ENET_BD_W) != 0) {
-            addr = s->regs[ENET_TDSR];
+            addr = s->regs[tdsr];
         } else {
             addr += sizeof(bd);
         }
     }
 
-    s->tx_descriptor = addr;
+    s->tx_descriptor[ring] = addr;
 
     imx_eth_update(s);
 }
 
-static void imx_eth_do_tx(IMXFECState *s)
+static void imx_eth_do_tx(IMXFECState *s, uint32_t index)
 {
     if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) {
-        imx_enet_do_tx(s);
+        imx_enet_do_tx(s, index);
     } else {
         imx_fec_do_tx(s);
     }
@@ -XXX,XX +XXX,XX @@ static void imx_eth_reset(DeviceState *d)
     }
 
     s->rx_descriptor = 0;
-    s->tx_descriptor = 0;
+    memset(s->tx_descriptor, 0, sizeof(s->tx_descriptor));
 
     /* We also reset the PHY */
     phy_reset(s);
@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
                            unsigned size)
 {
     IMXFECState *s = IMX_FEC(opaque);
+    const bool single_tx_ring = !imx_eth_is_multi_tx_ring(s);
     uint32_t index = offset >> 2;
 
     FEC_PRINTF("reg[%s] <= 0x%" PRIx32 "\n", imx_eth_reg_name(s, index),
@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
             s->regs[index] = 0;
         }
         break;
-    case ENET_TDAR:
+    case ENET_TDAR1:    /* FALLTHROUGH */
+    case ENET_TDAR2:    /* FALLTHROUGH */
+        if (unlikely(single_tx_ring)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "[%s]%s: trying to access TDAR2 or TDAR1\n",
+                          TYPE_IMX_FEC, __func__);
+            return;
+        }
+    case ENET_TDAR:     /* FALLTHROUGH */
         if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
             s->regs[index] = ENET_TDAR_TDAR;
-            imx_eth_do_tx(s);
+            imx_eth_do_tx(s, index);
         }
         s->regs[index] = 0;
         break;
@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
         if ((s->regs[index] & ENET_ECR_ETHEREN) == 0) {
             s->regs[ENET_RDAR] = 0;
             s->rx_descriptor = s->regs[ENET_RDSR];
-            s->regs[ENET_TDAR] = 0;
-            s->tx_descriptor = s->regs[ENET_TDSR];
+            s->regs[ENET_TDAR]  = 0;
+            s->regs[ENET_TDAR1] = 0;
+            s->regs[ENET_TDAR2] = 0;
+            s->tx_descriptor[0] = s->regs[ENET_TDSR];
+            s->tx_descriptor[1] = s->regs[ENET_TDSR1];
+            s->tx_descriptor[2] = s->regs[ENET_TDSR2];
         }
         break;
     case ENET_MMFR:
@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
         } else {
             s->regs[index] = value & ~7;
         }
-        s->tx_descriptor = s->regs[index];
+        s->tx_descriptor[0] = s->regs[index];
+        break;
+    case ENET_TDSR1:
+        if (unlikely(single_tx_ring)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "[%s]%s: trying to access TDSR1\n",
+                          TYPE_IMX_FEC, __func__);
+            return;
+        }
+
+        s->regs[index] = value & ~7;
+        s->tx_descriptor[1] = s->regs[index];
+        break;
+    case ENET_TDSR2:
+        if (unlikely(single_tx_ring)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "[%s]%s: trying to access TDSR2\n",
+                          TYPE_IMX_FEC, __func__);
+            return;
+        }
+
+        s->regs[index] = value & ~7;
+        s->tx_descriptor[2] = s->regs[index];
         break;
     case ENET_MRBR:
         s->regs[index] = value & 0x00003ff0;
@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)
 
 static Property imx_eth_properties[] = {
     DEFINE_NIC_PROPERTIES(IMXFECState, conf),
+    DEFINE_PROP_UINT32("tx-ring-num", IMXFECState, tx_ring_num, 1),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.7.4

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Use 'frame_size' instead of 'len' when calling qemu_send_packet(),
failing to do so results in malformed packets send in case when that
packed is fragmented into multiple DMA transactions.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/imx_fec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_enet_do_tx(IMXFECState *s, uint32_t index)
             }
             /* Last buffer in frame.  */
 
-            qemu_send_packet(qemu_get_queue(s->nic), s->frame, len);
+            qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size);
             ptr = s->frame;
 
             frame_size = 0;
-- 
2.7.4

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Some i.MX SoCs (e.g. i.MX7) have FEC registers going as far as offset
0x614, so to avoid getting aborts when accessing those on QEMU, extend
the register file to cover FSL_IMX25_FEC_SIZE(16K) of address space
instead of just 1K.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: yurovsky@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx25.h | 1 -
 include/hw/net/imx_fec.h   | 1 +
 hw/net/imx_fec.c           | 2 +-
 3 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
 #define FSL_IMX25_UART5_ADDR    0x5002C000
 #define FSL_IMX25_UART5_SIZE    0x4000
 #define FSL_IMX25_FEC_ADDR      0x50038000
-#define FSL_IMX25_FEC_SIZE      0x4000
 #define FSL_IMX25_CCM_ADDR      0x53F80000
 #define FSL_IMX25_CCM_SIZE      0x4000
 #define FSL_IMX25_GPT4_ADDR     0x53F84000
diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/imx_fec.h
+++ b/include/hw/net/imx_fec.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 #define ENET_TX_RING_NUM       3
 
+#define FSL_IMX25_FEC_SIZE      0x4000
 
 typedef struct IMXFECState {
     /*< private >*/
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
     memory_region_init_io(&s->iomem, OBJECT(dev), &imx_eth_ops, s,
-                          TYPE_IMX_FEC, 0x400);
+                          TYPE_IMX_FEC, FSL_IMX25_FEC_SIZE);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->irq[0]);
     sysbus_init_irq(sbd, &s->irq[1]);
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180103224208.30291-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/pxa2xx_timer.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/hw/timer/pxa2xx_timer.c b/hw/timer/pxa2xx_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/pxa2xx_timer.c
+++ b/hw/timer/pxa2xx_timer.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/arm/pxa.h"
 #include "hw/sysbus.h"
+#include "qemu/log.h"
 
 #define OSMR0	0x00
 #define OSMR1	0x04
@@ -XXX,XX +XXX,XX @@ static uint64_t pxa2xx_timer_read(void *opaque, hwaddr offset,
     case OSNR:
         return s->snapshot;
     default:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: unknown register 0x%02" HWADDR_PRIx "\n",
+                      __func__, offset);
+        break;
     badreg:
-        hw_error("pxa2xx_timer_read: Bad offset " REG_FMT "\n", offset);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: incorrect register 0x%02" HWADDR_PRIx "\n",
+                      __func__, offset);
     }
 
     return 0;
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_timer_write(void *opaque, hwaddr offset,
         }
         break;
     default:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: unknown register 0x%02" HWADDR_PRIx " "
+                      "(value 0x%08" PRIx64 ")\n",  __func__, offset, value);
+        break;
     badreg:
-        hw_error("pxa2xx_timer_write: Bad offset " REG_FMT "\n", offset);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: incorrect register 0x%02" HWADDR_PRIx " "
+                      "(value 0x%08" PRIx64 ")\n", __func__, offset, value);
     }
 }
 
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180104000156.30932-1-f4bug@amsat.org
[PMM: add missing include]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/pxa2xx_mmci.c | 78 ++++++++++++++++++++++++++++++++++-------------------
 hw/sd/trace-events  |  4 +++
 2 files changed, 54 insertions(+), 28 deletions(-)

diff --git a/hw/sd/pxa2xx_mmci.c b/hw/sd/pxa2xx_mmci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/pxa2xx_mmci.c
+++ b/hw/sd/pxa2xx_mmci.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev.h"
 #include "hw/qdev-properties.h"
 #include "qemu/error-report.h"
+#include "qemu/log.h"
+#include "trace.h"
 
 #define TYPE_PXA2XX_MMCI "pxa2xx-mmci"
 #define PXA2XX_MMCI(obj) OBJECT_CHECK(PXA2xxMMCIState, (obj), TYPE_PXA2XX_MMCI)
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_mmci_wakequeues(PXA2xxMMCIState *s)
 static uint64_t pxa2xx_mmci_read(void *opaque, hwaddr offset, unsigned size)
 {
     PXA2xxMMCIState *s = (PXA2xxMMCIState *) opaque;
-    uint32_t ret;
+    uint32_t ret = 0;
 
     switch (offset) {
     case MMC_STRPCL:
-        return 0;
+        break;
     case MMC_STAT:
-        return s->status;
+        ret = s->status;
+        break;
     case MMC_CLKRT:
-        return s->clkrt;
+        ret = s->clkrt;
+        break;
     case MMC_SPI:
-        return s->spi;
+        ret = s->spi;
+        break;
     case MMC_CMDAT:
-        return s->cmdat;
+        ret = s->cmdat;
+        break;
     case MMC_RESTO:
-        return s->resp_tout;
+        ret = s->resp_tout;
+        break;
     case MMC_RDTO:
-        return s->read_tout;
+        ret = s->read_tout;
+        break;
     case MMC_BLKLEN:
-        return s->blklen;
+        ret = s->blklen;
+        break;
     case MMC_NUMBLK:
-        return s->numblk;
+        ret = s->numblk;
+        break;
     case MMC_PRTBUF:
-        return 0;
+        break;
     case MMC_I_MASK:
-        return s->intmask;
+        ret = s->intmask;
+        break;
     case MMC_I_REG:
-        return s->intreq;
+        ret = s->intreq;
+        break;
     case MMC_CMD:
-        return s->cmd | 0x40;
+        ret = s->cmd | 0x40;
+        break;
     case MMC_ARGH:
-        return s->arg >> 16;
+        ret = s->arg >> 16;
+        break;
     case MMC_ARGL:
-        return s->arg & 0xffff;
+        ret = s->arg & 0xffff;
+        break;
     case MMC_RES:
-        if (s->resp_len < 9)
-            return s->resp_fifo[s->resp_len ++];
-        return 0;
+        ret = (s->resp_len < 9) ? s->resp_fifo[s->resp_len++] : 0;
+        break;
     case MMC_RXFIFO:
-        ret = 0;
         while (size-- && s->rx_len) {
             ret |= s->rx_fifo[s->rx_start++] << (size << 3);
             s->rx_start &= 0x1f;
@@ -XXX,XX +XXX,XX @@ static uint64_t pxa2xx_mmci_read(void *opaque, hwaddr offset, unsigned size)
         }
         s->intreq &= ~INT_RXFIFO_REQ;
         pxa2xx_mmci_fifo_update(s);
-        return ret;
+        break;
     case MMC_RDWAIT:
-        return 0;
+        break;
     case MMC_BLKS_REM:
-        return s->numblk;
+        ret = s->numblk;
+        break;
     default:
-        hw_error("%s: Bad offset " REG_FMT "\n", __FUNCTION__, offset);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: incorrect register 0x%02" HWADDR_PRIx "\n",
+                      __func__, offset);
     }
+    trace_pxa2xx_mmci_read(size, offset, ret);
 
-    return 0;
+    return ret;
 }
 
 static void pxa2xx_mmci_write(void *opaque,
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_mmci_write(void *opaque,
 {
     PXA2xxMMCIState *s = (PXA2xxMMCIState *) opaque;
 
+    trace_pxa2xx_mmci_write(size, offset, value);
     switch (offset) {
     case MMC_STRPCL:
         if (value & STRPCL_STRT_CLK) {
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_mmci_write(void *opaque,
 
     case MMC_SPI:
         s->spi = value & 0xf;
-        if (value & SPI_SPI_MODE)
-            printf("%s: attempted to use card in SPI mode\n", __FUNCTION__);
+        if (value & SPI_SPI_MODE) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: attempted to use card in SPI mode\n", __func__);
+        }
         break;
 
     case MMC_CMDAT:
@@ -XXX,XX +XXX,XX @@ static void pxa2xx_mmci_write(void *opaque,
         break;
 
     default:
-        hw_error("%s: Bad offset " REG_FMT "\n", __FUNCTION__, offset);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: incorrect reg 0x%02" HWADDR_PRIx " "
+                      "(value 0x%08" PRIx64 ")\n", __func__, offset, value);
     }
 }
 
diff --git a/hw/sd/trace-events b/hw/sd/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/trace-events
+++ b/hw/sd/trace-events
@@ -XXX,XX +XXX,XX @@
 # hw/sd/milkymist-memcard.c
 milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 milkymist_memcard_memory_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
+
+# hw/sd/pxa2xx_mmci.c
+pxa2xx_mmci_read(uint8_t size, uint32_t addr, uint32_t value) "size %d addr 0x%02x value 0x%08x"
+pxa2xx_mmci_write(uint8_t size, uint32_t addr, uint32_t value) "size %d addr 0x%02x value 0x%08x"
-- 
2.7.4

Our copy of the nwfpe code for emulating of the old FPA11 floating
point unit doesn't check the coprocessor number in the instruction
when it emulates it.  This means that we might treat some
instructions which should really UNDEF as being FPA11 instructions by
accident.

The kernel's copy of the nwfpe code doesn't make this error; I suspect
the bug was noticed and fixed as part of the process of mainlining
the nwfpe code more than a decade ago.

Add a check that the coprocessor number (which is always in bits
[11:8] of the instruction) is either 1 or 2, which is where the
FPA11 lives.

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/arm/nwfpe/fpa11.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/linux-user/arm/nwfpe/fpa11.c b/linux-user/arm/nwfpe/fpa11.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/nwfpe/fpa11.c
+++ b/linux-user/arm/nwfpe/fpa11.c
@@ -XXX,XX +XXX,XX @@ unsigned int EmulateAll(unsigned int opcode, FPA11* qfpa, CPUARMState* qregs)
   unsigned int nRc = 0;
 //  unsigned long flags;
   FPA11 *fpa11;
+  unsigned int cp;
 //  save_flags(flags); sti();
 
+  /* Check that this is really an FPA11 instruction: the coprocessor
+   * field in bits [11:8] must be 1 or 2.
+   */
+  cp = (opcode >> 8) & 0xf;
+  if (cp != 1 && cp != 2) {
+    return 0;
+  }
+
   qemufpa=qfpa;
   user_registers=qregs;
 
-- 
2.7.4

Refactor disas_thumb2_insn() so that it generates the code for raising
an UNDEF exception for invalid insns, rather than returning a flag
which the caller must check to see if it needs to generate the UNDEF
code. This brings the function in to line with the behaviour of
disas_thumb_insn() and disas_arm_insn().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1513080506-17703-1-git-send-email-peter.maydell@linaro.org
---
 target/arm/translate.c | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out,
     return 0;
 }
 
-/* Translate a 32-bit thumb instruction.  Returns nonzero if the instruction
-   is not legal.  */
-static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
+/* Translate a 32-bit thumb instruction. */
+static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
 {
     uint32_t imm, shift, offset;
     uint32_t rd, rn, rm, rs;
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
                     /* UNPREDICTABLE, unallocated hint or
                      * PLD/PLDW/PLI (literal)
                      */
-                    return 0;
+                    return;
                 }
                 if (op1 & 1) {
-                    return 0; /* PLD/PLDW/PLI or unallocated hint */
+                    return; /* PLD/PLDW/PLI or unallocated hint */
                 }
                 if ((op2 == 0) || ((op2 & 0x3c) == 0x30)) {
-                    return 0; /* PLD/PLDW/PLI or unallocated hint */
+                    return; /* PLD/PLDW/PLI or unallocated hint */
                 }
                 /* UNDEF space, or an UNPREDICTABLE */
-                return 1;
+                goto illegal_op;
             }
         }
         memidx = get_mem_index(s);
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
     default:
         goto illegal_op;
     }
-    return 0;
+    return;
 illegal_op:
-    return 1;
+    gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
+                       default_exception_el(s));
 }
 
 static void disas_thumb_insn(DisasContext *s, uint32_t insn)
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     if (is_16bit) {
         disas_thumb_insn(dc, insn);
     } else {
-        if (disas_thumb2_insn(dc, insn)) {
-            gen_exception_insn(dc, 4, EXCP_UDEF, syn_uncategorized(),
-                               default_exception_el(dc));
-        }
+        disas_thumb2_insn(dc, insn);
     }
 
     /* Advance the Thumb condexec condition.  */
-- 
2.7.4

The GICv3 specification says that reserved register addresses
should RAZ/WI. This means we need to return MEMTX_OK, not MEMTX_ERROR,
because now that we support generating external aborts the
latter will cause an abort on new board models.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1513183941-24300-2-git-send-email-peter.maydell@linaro.org
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
---
 hw/intc/arm_gicv3_dist.c       | 13 +++++++++++++
 hw/intc/arm_gicv3_its_common.c |  8 +++-----
 hw/intc/arm_gicv3_redist.c     | 13 +++++++++++++
 3 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_dist_read(void *opaque, hwaddr offset, uint64_t *data,
                       "%s: invalid guest read at offset " TARGET_FMT_plx
                       "size %u\n", __func__, offset, size);
         trace_gicv3_dist_badread(offset, size, attrs.secure);
+        /* The spec requires that reserved registers are RAZ/WI;
+         * so use MEMTX_ERROR returns from leaf functions as a way to
+         * trigger the guest-error logging but don't return it to
+         * the caller, or we'll cause a spurious guest data abort.
+         */
+        r = MEMTX_OK;
+        *data = 0;
     } else {
         trace_gicv3_dist_read(offset, *data, size, attrs.secure);
     }
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_dist_write(void *opaque, hwaddr offset, uint64_t data,
                       "%s: invalid guest write at offset " TARGET_FMT_plx
                       "size %u\n", __func__, offset, size);
         trace_gicv3_dist_badwrite(offset, data, size, attrs.secure);
+        /* The spec requires that reserved registers are RAZ/WI;
+         * so use MEMTX_ERROR returns from leaf functions as a way to
+         * trigger the guest-error logging but don't return it to
+         * the caller, or we'll cause a spurious guest data abort.
+         */
+        r = MEMTX_OK;
     } else {
         trace_gicv3_dist_write(offset, data, size, attrs.secure);
     }
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_trans_read(void *opaque, hwaddr offset,
                                         MemTxAttrs attrs)
 {
     qemu_log_mask(LOG_GUEST_ERROR, "ITS read at offset 0x%"PRIx64"\n", offset);
-    return MEMTX_ERROR;
+    *data = 0;
+    return MEMTX_OK;
 }
 
 static MemTxResult gicv3_its_trans_write(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_trans_write(void *opaque, hwaddr offset,
         if (ret <= 0) {
             qemu_log_mask(LOG_GUEST_ERROR,
                           "ITS: Error sending MSI: %s\n", strerror(-ret));
-            return MEMTX_DECODE_ERROR;
         }
-
-        return MEMTX_OK;
     } else {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "ITS write at bad offset 0x%"PRIx64"\n", offset);
-        return MEMTX_DECODE_ERROR;
     }
+    return MEMTX_OK;
 }
 
 static const MemoryRegionOps gicv3_its_trans_ops = {
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_read(void *opaque, hwaddr offset, uint64_t *data,
                       "size %u\n", __func__, offset, size);
         trace_gicv3_redist_badread(gicv3_redist_affid(cs), offset,
                                    size, attrs.secure);
+        /* The spec requires that reserved registers are RAZ/WI;
+         * so use MEMTX_ERROR returns from leaf functions as a way to
+         * trigger the guest-error logging but don't return it to
+         * the caller, or we'll cause a spurious guest data abort.
+         */
+        r = MEMTX_OK;
+        *data = 0;
     } else {
         trace_gicv3_redist_read(gicv3_redist_affid(cs), offset, *data,
                                 size, attrs.secure);
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
                       "size %u\n", __func__, offset, size);
         trace_gicv3_redist_badwrite(gicv3_redist_affid(cs), offset, data,
                                     size, attrs.secure);
+        /* The spec requires that reserved registers are RAZ/WI;
+         * so use MEMTX_ERROR returns from leaf functions as a way to
+         * trigger the guest-error logging but don't return it to
+         * the caller, or we'll cause a spurious guest data abort.
+         */
+        r = MEMTX_OK;
     } else {
         trace_gicv3_redist_write(gicv3_redist_affid(cs), offset, data,
                                  size, attrs.secure);
-- 
2.7.4

The GICv2 specification says that reserved register addresses
must RAZ/WI; now that we implement external abort handling
for Arm CPUs this means we must return MEMTX_OK rather than
MEMTX_ERROR, to avoid generating a spurious guest data abort.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1513183941-24300-3-git-send-email-peter.maydell@linaro.org
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
---
 hw/intc/arm_gic.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_read(GICState *s, int cpu, int offset,
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "gic_cpu_read: Bad offset %x\n", (int)offset);
-        return MEMTX_ERROR;
+        *data = 0;
+        break;
     }
     return MEMTX_OK;
 }
@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_write(GICState *s, int cpu, int offset,
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "gic_cpu_write: Bad offset %x\n", (int)offset);
-        return MEMTX_ERROR;
+        return MEMTX_OK;
     }
     gic_update(s);
     return MEMTX_OK;
-- 
2.7.4

target-arm queue: mostly aspeed changes from Cédric.

thanks
-- PMM

The following changes since commit 85182c96de61f0b600bbe834d5a23e713162e892:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20190912a' into staging (2019-09-13 14:37:48 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190913

for you to fetch changes up to 27a296fce9821e3608d537756cffa6e43a46df3b:

qemu-ga: Convert invocation documentation to rST (2019-09-13 16:05:01 +0100)

----------------------------------------------------------------
target-arm queue:
 * aspeed: add a GPIO controller to the SoC
 * aspeed: Various refactorings
 * aspeed: Improve DMA controller modelling
 * atomic_template: fix indentation in GEN_ATOMIC_HELPER
 * qemu-ga: Convert invocation documentation to rST

----------------------------------------------------------------
Christian Svensson (1):
      aspeed/smc: Calculate checksum on normal DMA

Cédric Le Goater (7):
      aspeed: Remove unused SoC definitions
      aspeed: Use consistent typenames
      aspeed/smc: Add support for DMAs
      aspeed/smc: Add DMA calibration settings
      aspeed/smc: Inject errors in DMA checksum
      aspeed/scu: Introduce per-SoC SCU types
      aspeed/scu: Introduce a aspeed_scu_get_apb_freq() routine

Emilio G. Cota (1):
      atomic_template: fix indentation in GEN_ATOMIC_HELPER

Peter Maydell (1):
      qemu-ga: Convert invocation documentation to rST

Rashmica Gupta (2):
      hw/gpio: Add basic Aspeed GPIO model for AST2400 and AST2500
      aspeed: add a GPIO controller to the SoC

From: Rashmica Gupta <rashmica.g@gmail.com>

GPIO pins are arranged in groups of 8 pins labeled A,B,..,Y,Z,AA,AB,AC.
(Note that the ast2400 controller only goes up to group AB).
A set has four groups (except set AC which only has one) and is
referred to by the groups it is composed of (eg ABCD,EFGH,...,YZAAAB).
Each set is accessed and controlled by a bank of 14 registers.

These registers operate on a per pin level where each bit in the register
corresponds to a pin, except for the command source registers. The command
source registers operate on a per group level where bits 24, 16, 8 and 0
correspond to each group in the set.

eg. registers for set ABCD:
 |D7...D0|C7...C0|B7...B0|A7...A0| <- GPIOs
 |31...24|23...16|15....8|7.....0| <- bit position

Note that there are a couple of groups that only have 4 pins.

There are two ways that this model deviates from the behaviour of the
actual controller:
(1) The only control source driving the GPIO pins in the model is the ARM
model (as there currently aren't models for the LPC or Coprocessor).

(2) None of the registers in the model are reset tolerant (needs
integration with the watchdog).

Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
Tested-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-2-clg@kaod.org
[clg: fixed missing header files
      made use of HWADDR_PRIx to fix compilation on windows ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/Makefile.objs         |   1 +
 include/hw/gpio/aspeed_gpio.h | 100 ++++
 hw/gpio/aspeed_gpio.c         | 884 ++++++++++++++++++++++++++++++++++
 3 files changed, 985 insertions(+)
 create mode 100644 include/hw/gpio/aspeed_gpio.h
 create mode 100644 hw/gpio/aspeed_gpio.c

diff --git a/hw/gpio/Makefile.objs b/hw/gpio/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Makefile.objs
+++ b/hw/gpio/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_OMAP) += omap_gpio.o
 obj-$(CONFIG_IMX) += imx_gpio.o
 obj-$(CONFIG_RASPI) += bcm2835_gpio.o
 obj-$(CONFIG_NRF51_SOC) += nrf51_gpio.o
+obj-$(CONFIG_ASPEED_SOC) += aspeed_gpio.o
diff --git a/include/hw/gpio/aspeed_gpio.h b/include/hw/gpio/aspeed_gpio.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/gpio/aspeed_gpio.h
@@ -XXX,XX +XXX,XX @@
+/*
+ *  ASPEED GPIO Controller
+ *
+ *  Copyright (C) 2017-2018 IBM Corp.
+ *
+ * This code is licensed under the GPL version 2 or later.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#ifndef ASPEED_GPIO_H
+#define ASPEED_GPIO_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_ASPEED_GPIO "aspeed.gpio"
+#define ASPEED_GPIO(obj) OBJECT_CHECK(AspeedGPIOState, (obj), TYPE_ASPEED_GPIO)
+#define ASPEED_GPIO_CLASS(klass) \
+     OBJECT_CLASS_CHECK(AspeedGPIOClass, (klass), TYPE_ASPEED_GPIO)
+#define ASPEED_GPIO_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(AspeedGPIOClass, (obj), TYPE_ASPEED_GPIO)
+
+#define ASPEED_GPIO_MAX_NR_SETS 8
+#define ASPEED_REGS_PER_BANK 14
+#define ASPEED_GPIO_MAX_NR_REGS (ASPEED_REGS_PER_BANK * ASPEED_GPIO_MAX_NR_SETS)
+#define ASPEED_GPIO_NR_PINS 228
+#define ASPEED_GROUPS_PER_SET 4
+#define ASPEED_GPIO_NR_DEBOUNCE_REGS 3
+#define ASPEED_CHARS_PER_GROUP_LABEL 4
+
+typedef struct GPIOSets GPIOSets;
+
+typedef struct GPIOSetProperties {
+    uint32_t input;
+    uint32_t output;
+    char group_label[ASPEED_GROUPS_PER_SET][ASPEED_CHARS_PER_GROUP_LABEL];
+} GPIOSetProperties;
+
+enum GPIORegType {
+    gpio_not_a_reg,
+    gpio_reg_data_value,
+    gpio_reg_direction,
+    gpio_reg_int_enable,
+    gpio_reg_int_sens_0,
+    gpio_reg_int_sens_1,
+    gpio_reg_int_sens_2,
+    gpio_reg_int_status,
+    gpio_reg_reset_tolerant,
+    gpio_reg_debounce_1,
+    gpio_reg_debounce_2,
+    gpio_reg_cmd_source_0,
+    gpio_reg_cmd_source_1,
+    gpio_reg_data_read,
+    gpio_reg_input_mask,
+};
+
+typedef struct AspeedGPIOReg {
+    uint16_t set_idx;
+    enum GPIORegType type;
+ } AspeedGPIOReg;
+
+typedef struct  AspeedGPIOClass {
+    SysBusDevice parent_obj;
+    const GPIOSetProperties *props;
+    uint32_t nr_gpio_pins;
+    uint32_t nr_gpio_sets;
+    uint32_t gap;
+    const AspeedGPIOReg *reg_table;
+}  AspeedGPIOClass;
+
+typedef struct AspeedGPIOState {
+    /* <private> */
+    SysBusDevice parent;
+
+    /*< public >*/
+    MemoryRegion iomem;
+    int pending;
+    qemu_irq irq;
+    qemu_irq gpios[ASPEED_GPIO_NR_PINS];
+
+/* Parallel GPIO Registers */
+    uint32_t debounce_regs[ASPEED_GPIO_NR_DEBOUNCE_REGS];
+    struct GPIOSets {
+        uint32_t data_value; /* Reflects pin values */
+        uint32_t data_read; /* Contains last value written to data value */
+        uint32_t direction;
+        uint32_t int_enable;
+        uint32_t int_sens_0;
+        uint32_t int_sens_1;
+        uint32_t int_sens_2;
+        uint32_t int_status;
+        uint32_t reset_tol;
+        uint32_t cmd_source_0;
+        uint32_t cmd_source_1;
+        uint32_t debounce_1;
+        uint32_t debounce_2;
+        uint32_t input_mask;
+    } sets[ASPEED_GPIO_MAX_NR_SETS];
+} AspeedGPIOState;
+
+#endif /* _ASPEED_GPIO_H_ */
diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@
+/*
+ *  ASPEED GPIO Controller
+ *
+ *  Copyright (C) 2017-2019 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <assert.h>
+
+#include "qemu/osdep.h"
+#include "qemu/host-utils.h"
+#include "qemu/log.h"
+#include "hw/gpio/aspeed_gpio.h"
+#include "include/hw/misc/aspeed_scu.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+#include "hw/irq.h"
+#include "migration/vmstate.h"
+
+#define GPIOS_PER_REG 32
+#define GPIOS_PER_SET GPIOS_PER_REG
+#define GPIO_PIN_GAP_SIZE 4
+#define GPIOS_PER_GROUP 8
+#define GPIO_GROUP_SHIFT 3
+
+/* GPIO Source Types */
+#define ASPEED_CMD_SRC_MASK         0x01010101
+#define ASPEED_SOURCE_ARM           0
+#define ASPEED_SOURCE_LPC           1
+#define ASPEED_SOURCE_COPROCESSOR   2
+#define ASPEED_SOURCE_RESERVED      3
+
+/* GPIO Interrupt Triggers */
+/*
+ *  For each set of gpios there are three sensitivity registers that control
+ *  the interrupt trigger mode.
+ *
+ *  | 2 | 1 | 0 | trigger mode
+ *  -----------------------------
+ *  | 0 | 0 | 0 | falling-edge
+ *  | 0 | 0 | 1 | rising-edge
+ *  | 0 | 1 | 0 | level-low
+ *  | 0 | 1 | 1 | level-high
+ *  | 1 | X | X | dual-edge
+ */
+#define ASPEED_FALLING_EDGE 0
+#define ASPEED_RISING_EDGE  1
+#define ASPEED_LEVEL_LOW    2
+#define ASPEED_LEVEL_HIGH   3
+#define ASPEED_DUAL_EDGE    4
+
+/* GPIO Register Address Offsets */
+#define GPIO_ABCD_DATA_VALUE       (0x000 >> 2)
+#define GPIO_ABCD_DIRECTION        (0x004 >> 2)
+#define GPIO_ABCD_INT_ENABLE       (0x008 >> 2)
+#define GPIO_ABCD_INT_SENS_0       (0x00C >> 2)
+#define GPIO_ABCD_INT_SENS_1       (0x010 >> 2)
+#define GPIO_ABCD_INT_SENS_2       (0x014 >> 2)
+#define GPIO_ABCD_INT_STATUS       (0x018 >> 2)
+#define GPIO_ABCD_RESET_TOLERANT   (0x01C >> 2)
+#define GPIO_EFGH_DATA_VALUE       (0x020 >> 2)
+#define GPIO_EFGH_DIRECTION        (0x024 >> 2)
+#define GPIO_EFGH_INT_ENABLE       (0x028 >> 2)
+#define GPIO_EFGH_INT_SENS_0       (0x02C >> 2)
+#define GPIO_EFGH_INT_SENS_1       (0x030 >> 2)
+#define GPIO_EFGH_INT_SENS_2       (0x034 >> 2)
+#define GPIO_EFGH_INT_STATUS       (0x038 >> 2)
+#define GPIO_EFGH_RESET_TOLERANT   (0x03C >> 2)
+#define GPIO_ABCD_DEBOUNCE_1       (0x040 >> 2)
+#define GPIO_ABCD_DEBOUNCE_2       (0x044 >> 2)
+#define GPIO_EFGH_DEBOUNCE_1       (0x048 >> 2)
+#define GPIO_EFGH_DEBOUNCE_2       (0x04C >> 2)
+#define GPIO_DEBOUNCE_TIME_1       (0x050 >> 2)
+#define GPIO_DEBOUNCE_TIME_2       (0x054 >> 2)
+#define GPIO_DEBOUNCE_TIME_3       (0x058 >> 2)
+#define GPIO_ABCD_COMMAND_SRC_0    (0x060 >> 2)
+#define GPIO_ABCD_COMMAND_SRC_1    (0x064 >> 2)
+#define GPIO_EFGH_COMMAND_SRC_0    (0x068 >> 2)
+#define GPIO_EFGH_COMMAND_SRC_1    (0x06C >> 2)
+#define GPIO_IJKL_DATA_VALUE       (0x070 >> 2)
+#define GPIO_IJKL_DIRECTION        (0x074 >> 2)
+#define GPIO_MNOP_DATA_VALUE       (0x078 >> 2)
+#define GPIO_MNOP_DIRECTION        (0x07C >> 2)
+#define GPIO_QRST_DATA_VALUE       (0x080 >> 2)
+#define GPIO_QRST_DIRECTION        (0x084 >> 2)
+#define GPIO_UVWX_DATA_VALUE       (0x088 >> 2)
+#define GPIO_UVWX_DIRECTION        (0x08C >> 2)
+#define GPIO_IJKL_COMMAND_SRC_0    (0x090 >> 2)
+#define GPIO_IJKL_COMMAND_SRC_1    (0x094 >> 2)
+#define GPIO_IJKL_INT_ENABLE       (0x098 >> 2)
+#define GPIO_IJKL_INT_SENS_0       (0x09C >> 2)
+#define GPIO_IJKL_INT_SENS_1       (0x0A0 >> 2)
+#define GPIO_IJKL_INT_SENS_2       (0x0A4 >> 2)
+#define GPIO_IJKL_INT_STATUS       (0x0A8 >> 2)
+#define GPIO_IJKL_RESET_TOLERANT   (0x0AC >> 2)
+#define GPIO_IJKL_DEBOUNCE_1       (0x0B0 >> 2)
+#define GPIO_IJKL_DEBOUNCE_2       (0x0B4 >> 2)
+#define GPIO_IJKL_INPUT_MASK       (0x0B8 >> 2)
+#define GPIO_ABCD_DATA_READ        (0x0C0 >> 2)
+#define GPIO_EFGH_DATA_READ        (0x0C4 >> 2)
+#define GPIO_IJKL_DATA_READ        (0x0C8 >> 2)
+#define GPIO_MNOP_DATA_READ        (0x0CC >> 2)
+#define GPIO_QRST_DATA_READ        (0x0D0 >> 2)
+#define GPIO_UVWX_DATA_READ        (0x0D4 >> 2)
+#define GPIO_YZAAAB_DATA_READ      (0x0D8 >> 2)
+#define GPIO_AC_DATA_READ          (0x0DC >> 2)
+#define GPIO_MNOP_COMMAND_SRC_0    (0x0E0 >> 2)
+#define GPIO_MNOP_COMMAND_SRC_1    (0x0E4 >> 2)
+#define GPIO_MNOP_INT_ENABLE       (0x0E8 >> 2)
+#define GPIO_MNOP_INT_SENS_0       (0x0EC >> 2)
+#define GPIO_MNOP_INT_SENS_1       (0x0F0 >> 2)
+#define GPIO_MNOP_INT_SENS_2       (0x0F4 >> 2)
+#define GPIO_MNOP_INT_STATUS       (0x0F8 >> 2)
+#define GPIO_MNOP_RESET_TOLERANT   (0x0FC >> 2)
+#define GPIO_MNOP_DEBOUNCE_1       (0x100 >> 2)
+#define GPIO_MNOP_DEBOUNCE_2       (0x104 >> 2)
+#define GPIO_MNOP_INPUT_MASK       (0x108 >> 2)
+#define GPIO_QRST_COMMAND_SRC_0    (0x110 >> 2)
+#define GPIO_QRST_COMMAND_SRC_1    (0x114 >> 2)
+#define GPIO_QRST_INT_ENABLE       (0x118 >> 2)
+#define GPIO_QRST_INT_SENS_0       (0x11C >> 2)
+#define GPIO_QRST_INT_SENS_1       (0x120 >> 2)
+#define GPIO_QRST_INT_SENS_2       (0x124 >> 2)
+#define GPIO_QRST_INT_STATUS       (0x128 >> 2)
+#define GPIO_QRST_RESET_TOLERANT   (0x12C >> 2)
+#define GPIO_QRST_DEBOUNCE_1       (0x130 >> 2)
+#define GPIO_QRST_DEBOUNCE_2       (0x134 >> 2)
+#define GPIO_QRST_INPUT_MASK       (0x138 >> 2)
+#define GPIO_UVWX_COMMAND_SRC_0    (0x140 >> 2)
+#define GPIO_UVWX_COMMAND_SRC_1    (0x144 >> 2)
+#define GPIO_UVWX_INT_ENABLE       (0x148 >> 2)
+#define GPIO_UVWX_INT_SENS_0       (0x14C >> 2)
+#define GPIO_UVWX_INT_SENS_1       (0x150 >> 2)
+#define GPIO_UVWX_INT_SENS_2       (0x154 >> 2)
+#define GPIO_UVWX_INT_STATUS       (0x158 >> 2)
+#define GPIO_UVWX_RESET_TOLERANT   (0x15C >> 2)
+#define GPIO_UVWX_DEBOUNCE_1       (0x160 >> 2)
+#define GPIO_UVWX_DEBOUNCE_2       (0x164 >> 2)
+#define GPIO_UVWX_INPUT_MASK       (0x168 >> 2)
+#define GPIO_YZAAAB_COMMAND_SRC_0  (0x170 >> 2)
+#define GPIO_YZAAAB_COMMAND_SRC_1  (0x174 >> 2)
+#define GPIO_YZAAAB_INT_ENABLE     (0x178 >> 2)
+#define GPIO_YZAAAB_INT_SENS_0     (0x17C >> 2)
+#define GPIO_YZAAAB_INT_SENS_1     (0x180 >> 2)
+#define GPIO_YZAAAB_INT_SENS_2     (0x184 >> 2)
+#define GPIO_YZAAAB_INT_STATUS     (0x188 >> 2)
+#define GPIO_YZAAAB_RESET_TOLERANT (0x18C >> 2)
+#define GPIO_YZAAAB_DEBOUNCE_1     (0x190 >> 2)
+#define GPIO_YZAAAB_DEBOUNCE_2     (0x194 >> 2)
+#define GPIO_YZAAAB_INPUT_MASK     (0x198 >> 2)
+#define GPIO_AC_COMMAND_SRC_0      (0x1A0 >> 2)
+#define GPIO_AC_COMMAND_SRC_1      (0x1A4 >> 2)
+#define GPIO_AC_INT_ENABLE         (0x1A8 >> 2)
+#define GPIO_AC_INT_SENS_0         (0x1AC >> 2)
+#define GPIO_AC_INT_SENS_1         (0x1B0 >> 2)
+#define GPIO_AC_INT_SENS_2         (0x1B4 >> 2)
+#define GPIO_AC_INT_STATUS         (0x1B8 >> 2)
+#define GPIO_AC_RESET_TOLERANT     (0x1BC >> 2)
+#define GPIO_AC_DEBOUNCE_1         (0x1C0 >> 2)
+#define GPIO_AC_DEBOUNCE_2         (0x1C4 >> 2)
+#define GPIO_AC_INPUT_MASK         (0x1C8 >> 2)
+#define GPIO_ABCD_INPUT_MASK       (0x1D0 >> 2)
+#define GPIO_EFGH_INPUT_MASK       (0x1D4 >> 2)
+#define GPIO_YZAAAB_DATA_VALUE     (0x1E0 >> 2)
+#define GPIO_YZAAAB_DIRECTION      (0x1E4 >> 2)
+#define GPIO_AC_DATA_VALUE         (0x1E8 >> 2)
+#define GPIO_AC_DIRECTION          (0x1EC >> 2)
+#define GPIO_3_6V_MEM_SIZE         0x1F0
+#define GPIO_3_6V_REG_ARRAY_SIZE   (GPIO_3_6V_MEM_SIZE >> 2)
+
+static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
+{
+    uint32_t falling_edge = 0, rising_edge = 0;
+    uint32_t int_trigger = extract32(regs->int_sens_0, gpio, 1)
+                           | extract32(regs->int_sens_1, gpio, 1) << 1
+                           | extract32(regs->int_sens_2, gpio, 1) << 2;
+    uint32_t gpio_curr_high = extract32(regs->data_value, gpio, 1);
+    uint32_t gpio_int_enabled = extract32(regs->int_enable, gpio, 1);
+
+    if (!gpio_int_enabled) {
+        return 0;
+    }
+
+    /* Detect edges */
+    if (gpio_curr_high && !gpio_prev_high) {
+        rising_edge = 1;
+    } else if (!gpio_curr_high && gpio_prev_high) {
+        falling_edge = 1;
+    }
+
+    if (((int_trigger == ASPEED_FALLING_EDGE)  && falling_edge)  ||
+        ((int_trigger == ASPEED_RISING_EDGE)  && rising_edge)    ||
+        ((int_trigger == ASPEED_LEVEL_LOW)  && !gpio_curr_high)  ||
+        ((int_trigger == ASPEED_LEVEL_HIGH)  && gpio_curr_high)  ||
+        ((int_trigger >= ASPEED_DUAL_EDGE)  && (rising_edge || falling_edge)))
+    {
+        regs->int_status = deposit32(regs->int_status, gpio, 1, 1);
+        return 1;
+    }
+    return 0;
+}
+
+#define nested_struct_index(ta, pa, m, tb, pb) \
+        (pb - ((tb *)(((char *)pa) + offsetof(ta, m))))
+
+static ptrdiff_t aspeed_gpio_set_idx(AspeedGPIOState *s, GPIOSets *regs)
+{
+    return nested_struct_index(AspeedGPIOState, s, sets, GPIOSets, regs);
+}
+
+static void aspeed_gpio_update(AspeedGPIOState *s, GPIOSets *regs,
+                               uint32_t value)
+{
+    uint32_t input_mask = regs->input_mask;
+    uint32_t direction = regs->direction;
+    uint32_t old = regs->data_value;
+    uint32_t new = value;
+    uint32_t diff;
+    int gpio;
+
+    diff = old ^ new;
+    if (diff) {
+        for (gpio = 0; gpio < GPIOS_PER_REG; gpio++) {
+            uint32_t mask = 1 << gpio;
+
+            /* If the gpio needs to be updated... */
+            if (!(diff & mask)) {
+                continue;
+            }
+
+            /* ...and we're output or not input-masked... */
+            if (!(direction & mask) && (input_mask & mask)) {
+                continue;
+            }
+
+            /* ...then update the state. */
+            if (mask & new) {
+                regs->data_value |= mask;
+            } else {
+                regs->data_value &= ~mask;
+            }
+
+            /* If the gpio is set to output... */
+            if (direction & mask) {
+                /* ...trigger the line-state IRQ */
+                ptrdiff_t set = aspeed_gpio_set_idx(s, regs);
+                size_t offset = set * GPIOS_PER_SET + gpio;
+                qemu_set_irq(s->gpios[offset], !!(new & mask));
+            } else {
+                /* ...otherwise if we meet the line's current IRQ policy... */
+                if (aspeed_evaluate_irq(regs, old & mask, gpio)) {
+                    /* ...trigger the VIC IRQ */
+                    s->pending++;
+                }
+            }
+        }
+    }
+    qemu_set_irq(s->irq, !!(s->pending));
+}
+
+static uint32_t aspeed_adjust_pin(AspeedGPIOState *s, uint32_t pin)
+{
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    /*
+     * The 2500 has a 4 pin gap in group AB and the 2400 has a 4 pin
+     * gap in group Y (and only four pins in AB but this is the last group so
+     * it doesn't matter).
+     */
+    if (agc->gap && pin >= agc->gap) {
+        pin += GPIO_PIN_GAP_SIZE;
+    }
+
+    return pin;
+}
+
+static bool aspeed_gpio_get_pin_level(AspeedGPIOState *s, uint32_t set_idx,
+                                      uint32_t pin)
+{
+    uint32_t reg_val;
+    uint32_t pin_mask = 1 << pin;
+
+    reg_val = s->sets[set_idx].data_value;
+
+    return !!(reg_val & pin_mask);
+}
+
+static void aspeed_gpio_set_pin_level(AspeedGPIOState *s, uint32_t set_idx,
+                                      uint32_t pin, bool level)
+{
+    uint32_t value = s->sets[set_idx].data_value;
+    uint32_t pin_mask = 1 << pin;
+
+    if (level) {
+        value |= pin_mask;
+    } else {
+        value &= !pin_mask;
+    }
+
+    aspeed_gpio_update(s, &s->sets[set_idx], value);
+}
+
+/*
+ *  | src_1 | src_2 |  source     |
+ *  |-----------------------------|
+ *  |   0   |   0   |  ARM        |
+ *  |   0   |   1   |  LPC        |
+ *  |   1   |   0   |  Coprocessor|
+ *  |   1   |   1   |  Reserved   |
+ *
+ *  Once the source of a set is programmed, corresponding bits in the
+ *  data_value, direction, interrupt [enable, sens[0-2]], reset_tol and
+ *  debounce registers can only be written by the source.
+ *
+ *  Source is ARM by default
+ *  only bits 24, 16, 8, and 0 can be set
+ *
+ *  we don't currently have a model for the LPC or Coprocessor
+ */
+static uint32_t update_value_control_source(GPIOSets *regs, uint32_t old_value,
+                                            uint32_t value)
+{
+    int i;
+    int cmd_source;
+
+    /* assume the source is always ARM for now */
+    int source = ASPEED_SOURCE_ARM;
+
+    uint32_t new_value = 0;
+
+    /* for each group in set */
+    for (i = 0; i < GPIOS_PER_REG; i += GPIOS_PER_GROUP) {
+        cmd_source = extract32(regs->cmd_source_0, i, 1)
+                | (extract32(regs->cmd_source_1, i, 1) << 1);
+
+        if (source == cmd_source) {
+            new_value |= (0xff << i) & value;
+        } else {
+            new_value |= (0xff << i) & old_value;
+        }
+    }
+    return new_value;
+}
+
+static const AspeedGPIOReg aspeed_3_6v_gpios[GPIO_3_6V_REG_ARRAY_SIZE] = {
+    /* Set ABCD */
+    [GPIO_ABCD_DATA_VALUE] =     { 0, gpio_reg_data_value },
+    [GPIO_ABCD_DIRECTION] =      { 0, gpio_reg_direction },
+    [GPIO_ABCD_INT_ENABLE] =     { 0, gpio_reg_int_enable },
+    [GPIO_ABCD_INT_SENS_0] =     { 0, gpio_reg_int_sens_0 },
+    [GPIO_ABCD_INT_SENS_1] =     { 0, gpio_reg_int_sens_1 },
+    [GPIO_ABCD_INT_SENS_2] =     { 0, gpio_reg_int_sens_2 },
+    [GPIO_ABCD_INT_STATUS] =     { 0, gpio_reg_int_status },
+    [GPIO_ABCD_RESET_TOLERANT] = { 0, gpio_reg_reset_tolerant },
+    [GPIO_ABCD_DEBOUNCE_1] =     { 0, gpio_reg_debounce_1 },
+    [GPIO_ABCD_DEBOUNCE_2] =     { 0, gpio_reg_debounce_2 },
+    [GPIO_ABCD_COMMAND_SRC_0] =  { 0, gpio_reg_cmd_source_0 },
+    [GPIO_ABCD_COMMAND_SRC_1] =  { 0, gpio_reg_cmd_source_1 },
+    [GPIO_ABCD_DATA_READ] =      { 0, gpio_reg_data_read },
+    [GPIO_ABCD_INPUT_MASK] =     { 0, gpio_reg_input_mask },
+    /* Set EFGH */
+    [GPIO_EFGH_DATA_VALUE] =     { 1, gpio_reg_data_value },
+    [GPIO_EFGH_DIRECTION] =      { 1, gpio_reg_direction },
+    [GPIO_EFGH_INT_ENABLE] =     { 1, gpio_reg_int_enable },
+    [GPIO_EFGH_INT_SENS_0] =     { 1, gpio_reg_int_sens_0 },
+    [GPIO_EFGH_INT_SENS_1] =     { 1, gpio_reg_int_sens_1 },
+    [GPIO_EFGH_INT_SENS_2] =     { 1, gpio_reg_int_sens_2 },
+    [GPIO_EFGH_INT_STATUS] =     { 1, gpio_reg_int_status },
+    [GPIO_EFGH_RESET_TOLERANT] = { 1, gpio_reg_reset_tolerant },
+    [GPIO_EFGH_DEBOUNCE_1] =     { 1, gpio_reg_debounce_1 },
+    [GPIO_EFGH_DEBOUNCE_2] =     { 1, gpio_reg_debounce_2 },
+    [GPIO_EFGH_COMMAND_SRC_0] =  { 1, gpio_reg_cmd_source_0 },
+    [GPIO_EFGH_COMMAND_SRC_1] =  { 1, gpio_reg_cmd_source_1 },
+    [GPIO_EFGH_DATA_READ] =      { 1, gpio_reg_data_read },
+    [GPIO_EFGH_INPUT_MASK] =     { 1, gpio_reg_input_mask },
+    /* Set IJKL */
+    [GPIO_IJKL_DATA_VALUE] =     { 2, gpio_reg_data_value },
+    [GPIO_IJKL_DIRECTION] =      { 2, gpio_reg_direction },
+    [GPIO_IJKL_INT_ENABLE] =     { 2, gpio_reg_int_enable },
+    [GPIO_IJKL_INT_SENS_0] =     { 2, gpio_reg_int_sens_0 },
+    [GPIO_IJKL_INT_SENS_1] =     { 2, gpio_reg_int_sens_1 },
+    [GPIO_IJKL_INT_SENS_2] =     { 2, gpio_reg_int_sens_2 },
+    [GPIO_IJKL_INT_STATUS] =     { 2, gpio_reg_int_status },
+    [GPIO_IJKL_RESET_TOLERANT] = { 2, gpio_reg_reset_tolerant },
+    [GPIO_IJKL_DEBOUNCE_1] =     { 2, gpio_reg_debounce_1 },
+    [GPIO_IJKL_DEBOUNCE_2] =     { 2, gpio_reg_debounce_2 },
+    [GPIO_IJKL_COMMAND_SRC_0] =  { 2, gpio_reg_cmd_source_0 },
+    [GPIO_IJKL_COMMAND_SRC_1] =  { 2, gpio_reg_cmd_source_1 },
+    [GPIO_IJKL_DATA_READ] =      { 2, gpio_reg_data_read },
+    [GPIO_IJKL_INPUT_MASK] =     { 2, gpio_reg_input_mask },
+    /* Set MNOP */
+    [GPIO_MNOP_DATA_VALUE] =     { 3, gpio_reg_data_value },
+    [GPIO_MNOP_DIRECTION] =      { 3, gpio_reg_direction },
+    [GPIO_MNOP_INT_ENABLE] =     { 3, gpio_reg_int_enable },
+    [GPIO_MNOP_INT_SENS_0] =     { 3, gpio_reg_int_sens_0 },
+    [GPIO_MNOP_INT_SENS_1] =     { 3, gpio_reg_int_sens_1 },
+    [GPIO_MNOP_INT_SENS_2] =     { 3, gpio_reg_int_sens_2 },
+    [GPIO_MNOP_INT_STATUS] =     { 3, gpio_reg_int_status },
+    [GPIO_MNOP_RESET_TOLERANT] = { 3, gpio_reg_reset_tolerant },
+    [GPIO_MNOP_DEBOUNCE_1] =     { 3, gpio_reg_debounce_1 },
+    [GPIO_MNOP_DEBOUNCE_2] =     { 3, gpio_reg_debounce_2 },
+    [GPIO_MNOP_COMMAND_SRC_0] =  { 3, gpio_reg_cmd_source_0 },
+    [GPIO_MNOP_COMMAND_SRC_1] =  { 3, gpio_reg_cmd_source_1 },
+    [GPIO_MNOP_DATA_READ] =      { 3, gpio_reg_data_read },
+    [GPIO_MNOP_INPUT_MASK] =     { 3, gpio_reg_input_mask },
+    /* Set QRST */
+    [GPIO_QRST_DATA_VALUE] =     { 4, gpio_reg_data_value },
+    [GPIO_QRST_DIRECTION] =      { 4, gpio_reg_direction },
+    [GPIO_QRST_INT_ENABLE] =     { 4, gpio_reg_int_enable },
+    [GPIO_QRST_INT_SENS_0] =     { 4, gpio_reg_int_sens_0 },
+    [GPIO_QRST_INT_SENS_1] =     { 4, gpio_reg_int_sens_1 },
+    [GPIO_QRST_INT_SENS_2] =     { 4, gpio_reg_int_sens_2 },
+    [GPIO_QRST_INT_STATUS] =     { 4, gpio_reg_int_status },
+    [GPIO_QRST_RESET_TOLERANT] = { 4, gpio_reg_reset_tolerant },
+    [GPIO_QRST_DEBOUNCE_1] =     { 4, gpio_reg_debounce_1 },
+    [GPIO_QRST_DEBOUNCE_2] =     { 4, gpio_reg_debounce_2 },
+    [GPIO_QRST_COMMAND_SRC_0] =  { 4, gpio_reg_cmd_source_0 },
+    [GPIO_QRST_COMMAND_SRC_1] =  { 4, gpio_reg_cmd_source_1 },
+    [GPIO_QRST_DATA_READ] =      { 4, gpio_reg_data_read },
+    [GPIO_QRST_INPUT_MASK] =     { 4, gpio_reg_input_mask },
+    /* Set UVWX */
+    [GPIO_UVWX_DATA_VALUE] =     { 5, gpio_reg_data_value },
+    [GPIO_UVWX_DIRECTION] =      { 5, gpio_reg_direction },
+    [GPIO_UVWX_INT_ENABLE] =     { 5, gpio_reg_int_enable },
+    [GPIO_UVWX_INT_SENS_0] =     { 5, gpio_reg_int_sens_0 },
+    [GPIO_UVWX_INT_SENS_1] =     { 5, gpio_reg_int_sens_1 },
+    [GPIO_UVWX_INT_SENS_2] =     { 5, gpio_reg_int_sens_2 },
+    [GPIO_UVWX_INT_STATUS] =     { 5, gpio_reg_int_status },
+    [GPIO_UVWX_RESET_TOLERANT] = { 5, gpio_reg_reset_tolerant },
+    [GPIO_UVWX_DEBOUNCE_1] =     { 5, gpio_reg_debounce_1 },
+    [GPIO_UVWX_DEBOUNCE_2] =     { 5, gpio_reg_debounce_2 },
+    [GPIO_UVWX_COMMAND_SRC_0] =  { 5, gpio_reg_cmd_source_0 },
+    [GPIO_UVWX_COMMAND_SRC_1] =  { 5, gpio_reg_cmd_source_1 },
+    [GPIO_UVWX_DATA_READ] =      { 5, gpio_reg_data_read },
+    [GPIO_UVWX_INPUT_MASK] =     { 5, gpio_reg_input_mask },
+    /* Set YZAAAB */
+    [GPIO_YZAAAB_DATA_VALUE] =     { 6, gpio_reg_data_value },
+    [GPIO_YZAAAB_DIRECTION] =      { 6, gpio_reg_direction },
+    [GPIO_YZAAAB_INT_ENABLE] =     { 6, gpio_reg_int_enable },
+    [GPIO_YZAAAB_INT_SENS_0] =     { 6, gpio_reg_int_sens_0 },
+    [GPIO_YZAAAB_INT_SENS_1] =     { 6, gpio_reg_int_sens_1 },
+    [GPIO_YZAAAB_INT_SENS_2] =     { 6, gpio_reg_int_sens_2 },
+    [GPIO_YZAAAB_INT_STATUS] =     { 6, gpio_reg_int_status },
+    [GPIO_YZAAAB_RESET_TOLERANT] = { 6, gpio_reg_reset_tolerant },
+    [GPIO_YZAAAB_DEBOUNCE_1] =     { 6, gpio_reg_debounce_1 },
+    [GPIO_YZAAAB_DEBOUNCE_2] =     { 6, gpio_reg_debounce_2 },
+    [GPIO_YZAAAB_COMMAND_SRC_0] =  { 6, gpio_reg_cmd_source_0 },
+    [GPIO_YZAAAB_COMMAND_SRC_1] =  { 6, gpio_reg_cmd_source_1 },
+    [GPIO_YZAAAB_DATA_READ] =      { 6, gpio_reg_data_read },
+    [GPIO_YZAAAB_INPUT_MASK] =     { 6, gpio_reg_input_mask },
+    /* Set AC  (ast2500 only) */
+    [GPIO_AC_DATA_VALUE] =         { 7, gpio_reg_data_value },
+    [GPIO_AC_DIRECTION] =          { 7, gpio_reg_direction },
+    [GPIO_AC_INT_ENABLE] =         { 7, gpio_reg_int_enable },
+    [GPIO_AC_INT_SENS_0] =         { 7, gpio_reg_int_sens_0 },
+    [GPIO_AC_INT_SENS_1] =         { 7, gpio_reg_int_sens_1 },
+    [GPIO_AC_INT_SENS_2] =         { 7, gpio_reg_int_sens_2 },
+    [GPIO_AC_INT_STATUS] =         { 7, gpio_reg_int_status },
+    [GPIO_AC_RESET_TOLERANT] =     { 7, gpio_reg_reset_tolerant },
+    [GPIO_AC_DEBOUNCE_1] =         { 7, gpio_reg_debounce_1 },
+    [GPIO_AC_DEBOUNCE_2] =         { 7, gpio_reg_debounce_2 },
+    [GPIO_AC_COMMAND_SRC_0] =      { 7, gpio_reg_cmd_source_0 },
+    [GPIO_AC_COMMAND_SRC_1] =      { 7, gpio_reg_cmd_source_1 },
+    [GPIO_AC_DATA_READ] =          { 7, gpio_reg_data_read },
+    [GPIO_AC_INPUT_MASK] =         { 7, gpio_reg_input_mask },
+};
+
+static uint64_t aspeed_gpio_read(void *opaque, hwaddr offset, uint32_t size)
+{
+    AspeedGPIOState *s = ASPEED_GPIO(opaque);
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    uint64_t idx = -1;
+    const AspeedGPIOReg *reg;
+    GPIOSets *set;
+
+    idx = offset >> 2;
+    if (idx >= GPIO_DEBOUNCE_TIME_1 && idx <= GPIO_DEBOUNCE_TIME_3) {
+        idx -= GPIO_DEBOUNCE_TIME_1;
+        return (uint64_t) s->debounce_regs[idx];
+    }
+
+    reg = &agc->reg_table[idx];
+    if (reg->set_idx >= agc->nr_gpio_sets) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: no getter for offset 0x%"
+                      HWADDR_PRIx"\n", __func__, offset);
+        return 0;
+    }
+
+    set = &s->sets[reg->set_idx];
+    switch (reg->type) {
+    case gpio_reg_data_value:
+        return set->data_value;
+    case gpio_reg_direction:
+        return set->direction;
+    case gpio_reg_int_enable:
+        return set->int_enable;
+    case gpio_reg_int_sens_0:
+        return set->int_sens_0;
+    case gpio_reg_int_sens_1:
+        return set->int_sens_1;
+    case gpio_reg_int_sens_2:
+        return set->int_sens_2;
+    case gpio_reg_int_status:
+        return set->int_status;
+    case gpio_reg_reset_tolerant:
+        return set->reset_tol;
+    case gpio_reg_debounce_1:
+        return set->debounce_1;
+    case gpio_reg_debounce_2:
+        return set->debounce_2;
+    case gpio_reg_cmd_source_0:
+        return set->cmd_source_0;
+    case gpio_reg_cmd_source_1:
+        return set->cmd_source_1;
+    case gpio_reg_data_read:
+        return set->data_read;
+    case gpio_reg_input_mask:
+        return set->input_mask;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: no getter for offset 0x%"
+                      HWADDR_PRIx"\n", __func__, offset);
+        return 0;
+    };
+}
+
+static void aspeed_gpio_write(void *opaque, hwaddr offset, uint64_t data,
+                              uint32_t size)
+{
+    AspeedGPIOState *s = ASPEED_GPIO(opaque);
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    const GPIOSetProperties *props;
+    uint64_t idx = -1;
+    const AspeedGPIOReg *reg;
+    GPIOSets *set;
+    uint32_t cleared;
+
+    idx = offset >> 2;
+    if (idx >= GPIO_DEBOUNCE_TIME_1 && idx <= GPIO_DEBOUNCE_TIME_3) {
+        idx -= GPIO_DEBOUNCE_TIME_1;
+        s->debounce_regs[idx] = (uint32_t) data;
+        return;
+    }
+
+    reg = &agc->reg_table[idx];
+    if (reg->set_idx >= agc->nr_gpio_sets) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: no setter for offset 0x%"
+                      HWADDR_PRIx"\n", __func__, offset);
+        return;
+    }
+
+    set = &s->sets[reg->set_idx];
+    props = &agc->props[reg->set_idx];
+
+    switch (reg->type) {
+    case gpio_reg_data_value:
+        data &= props->output;
+        data = update_value_control_source(set, set->data_value, data);
+        set->data_read = data;
+        aspeed_gpio_update(s, set, data);
+        return;
+    case gpio_reg_direction:
+        /*
+         *   where data is the value attempted to be written to the pin:
+         *    pin type      | input mask | output mask | expected value
+         *    ------------------------------------------------------------
+         *   bidirectional  |   1       |   1        |  data
+         *   input only     |   1       |   0        |   0
+         *   output only    |   0       |   1        |   1
+         *   no pin / gap   |   0       |   0        |   0
+         *
+         *  which is captured by:
+         *  data = ( data | ~input) & output;
+         */
+        data = (data | ~props->input) & props->output;
+        set->direction = update_value_control_source(set, set->direction, data);
+        break;
+    case gpio_reg_int_enable:
+        set->int_enable = update_value_control_source(set, set->int_enable,
+                                                      data);
+        break;
+    case gpio_reg_int_sens_0:
+        set->int_sens_0 = update_value_control_source(set, set->int_sens_0,
+                                                      data);
+        break;
+    case gpio_reg_int_sens_1:
+        set->int_sens_1 = update_value_control_source(set, set->int_sens_1,
+                                                      data);
+        break;
+    case gpio_reg_int_sens_2:
+        set->int_sens_2 = update_value_control_source(set, set->int_sens_2,
+                                                      data);
+        break;
+    case gpio_reg_int_status:
+        cleared = ctpop32(data & set->int_status);
+        if (s->pending && cleared) {
+            assert(s->pending >= cleared);
+            s->pending -= cleared;
+        }
+        set->int_status &= ~data;
+        break;
+    case gpio_reg_reset_tolerant:
+        set->reset_tol = update_value_control_source(set, set->reset_tol,
+                                                     data);
+        return;
+    case gpio_reg_debounce_1:
+        set->debounce_1 = update_value_control_source(set, set->debounce_1,
+                                                      data);
+        return;
+    case gpio_reg_debounce_2:
+        set->debounce_2 = update_value_control_source(set, set->debounce_2,
+                                                      data);
+        return;
+    case gpio_reg_cmd_source_0:
+        set->cmd_source_0 = data & ASPEED_CMD_SRC_MASK;
+        return;
+    case gpio_reg_cmd_source_1:
+        set->cmd_source_1 = data & ASPEED_CMD_SRC_MASK;
+        return;
+    case gpio_reg_data_read:
+        /* Read only register */
+        return;
+    case gpio_reg_input_mask:
+        /*
+         * feeds into interrupt generation
+         * 0: read from data value reg will be updated
+         * 1: read from data value reg will not be updated
+         */
+         set->input_mask = data & props->input;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: no setter for offset 0x%"
+                      HWADDR_PRIx"\n", __func__, offset);
+        return;
+    }
+    aspeed_gpio_update(s, set, set->data_value);
+    return;
+}
+
+static int get_set_idx(AspeedGPIOState *s, const char *group, int *group_idx)
+{
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    int set_idx, g_idx = *group_idx;
+
+    for (set_idx = 0; set_idx < agc->nr_gpio_sets; set_idx++) {
+        const GPIOSetProperties *set_props = &agc->props[set_idx];
+        for (g_idx = 0; g_idx < ASPEED_GROUPS_PER_SET; g_idx++) {
+            if (!strncmp(group, set_props->group_label[g_idx], strlen(group))) {
+                *group_idx = g_idx;
+                return set_idx;
+            }
+        }
+    }
+    return -1;
+}
+
+static void aspeed_gpio_get_pin(Object *obj, Visitor *v, const char *name,
+                                void *opaque, Error **errp)
+{
+    int pin = 0xfff;
+    bool level = true;
+    char group[3];
+    AspeedGPIOState *s = ASPEED_GPIO(obj);
+    int set_idx, group_idx = 0;
+
+    if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
+        error_setg(errp, "%s: error reading %s", __func__, name);
+        return;
+    }
+    set_idx = get_set_idx(s, group, &group_idx);
+    if (set_idx == -1) {
+        error_setg(errp, "%s: invalid group %s", __func__, group);
+        return;
+    }
+    pin =  pin + group_idx * GPIOS_PER_GROUP;
+    level = aspeed_gpio_get_pin_level(s, set_idx, pin);
+    visit_type_bool(v, name, &level, errp);
+}
+
+static void aspeed_gpio_set_pin(Object *obj, Visitor *v, const char *name,
+                               void *opaque, Error **errp)
+{
+    Error *local_err = NULL;
+    bool level;
+    int pin = 0xfff;
+    char group[3];
+    AspeedGPIOState *s = ASPEED_GPIO(obj);
+    int set_idx, group_idx = 0;
+
+    visit_type_bool(v, name, &level, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+    if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
+        error_setg(errp, "%s: error reading %s", __func__, name);
+        return;
+    }
+    set_idx = get_set_idx(s, group, &group_idx);
+    if (set_idx == -1) {
+        error_setg(errp, "%s: invalid group %s", __func__, group);
+        return;
+    }
+    pin =  pin + group_idx * GPIOS_PER_GROUP;
+    aspeed_gpio_set_pin_level(s, set_idx, pin, level);
+}
+
+/****************** Setup functions ******************/
+static const GPIOSetProperties ast2400_set_props[] = {
+    [0] = {0xffffffff,  0xffffffff,  {"A", "B", "C", "D"} },
+    [1] = {0xffffffff,  0xffffffff,  {"E", "F", "G", "H"} },
+    [2] = {0xffffffff,  0xffffffff,  {"I", "J", "K", "L"} },
+    [3] = {0xffffffff,  0xffffffff,  {"M", "N", "O", "P"} },
+    [4] = {0xffffffff,  0xffffffff,  {"Q", "R", "S", "T"} },
+    [5] = {0xffffffff,  0x0000ffff,  {"U", "V", "W", "X"} },
+    [6] = {0x0000000f,  0x0fffff0f,  {"Y", "Z", "AA", "AB"} },
+};
+
+static const GPIOSetProperties ast2500_set_props[] = {
+    [0] = {0xffffffff,  0xffffffff,  {"A", "B", "C", "D"} },
+    [1] = {0xffffffff,  0xffffffff,  {"E", "F", "G", "H"} },
+    [2] = {0xffffffff,  0xffffffff,  {"I", "J", "K", "L"} },
+    [3] = {0xffffffff,  0xffffffff,  {"M", "N", "O", "P"} },
+    [4] = {0xffffffff,  0xffffffff,  {"Q", "R", "S", "T"} },
+    [5] = {0xffffffff,  0x0000ffff,  {"U", "V", "W", "X"} },
+    [6] = {0xffffff0f,  0x0fffff0f,  {"Y", "Z", "AA", "AB"} },
+    [7] = {0x000000ff,  0x000000ff,  {"AC"} },
+};
+
+static const MemoryRegionOps aspeed_gpio_ops = {
+    .read       = aspeed_gpio_read,
+    .write      = aspeed_gpio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+};
+
+static void aspeed_gpio_reset(DeviceState *dev)
+{
+    AspeedGPIOState *s = ASPEED_GPIO(dev);
+
+    /* TODO: respect the reset tolerance registers */
+    memset(s->sets, 0, sizeof(s->sets));
+}
+
+static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
+{
+    AspeedGPIOState *s = ASPEED_GPIO(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    int pin;
+
+    /* Interrupt parent line */
+    sysbus_init_irq(sbd, &s->irq);
+
+    /* Individual GPIOs */
+    for (pin = 0; pin < agc->nr_gpio_pins; pin++) {
+        sysbus_init_irq(sbd, &s->gpios[pin]);
+    }
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
+            TYPE_ASPEED_GPIO, GPIO_3_6V_MEM_SIZE);
+
+    sysbus_init_mmio(sbd, &s->iomem);
+}
+
+static void aspeed_gpio_init(Object *obj)
+{
+    AspeedGPIOState *s = ASPEED_GPIO(obj);
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    int pin;
+
+    for (pin = 0; pin < agc->nr_gpio_pins; pin++) {
+        char *name;
+        int set_idx = pin / GPIOS_PER_SET;
+        int pin_idx = aspeed_adjust_pin(s, pin) - (set_idx * GPIOS_PER_SET);
+        int group_idx = pin_idx >> GPIO_GROUP_SHIFT;
+        const GPIOSetProperties *props = &agc->props[set_idx];
+
+        name = g_strdup_printf("gpio%s%d", props->group_label[group_idx],
+                               pin_idx % GPIOS_PER_GROUP);
+        object_property_add(obj, name, "bool", aspeed_gpio_get_pin,
+                            aspeed_gpio_set_pin, NULL, NULL, NULL);
+    }
+}
+
+static const VMStateDescription vmstate_gpio_regs = {
+    .name = TYPE_ASPEED_GPIO"/regs",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(data_value,   GPIOSets),
+        VMSTATE_UINT32(data_read,    GPIOSets),
+        VMSTATE_UINT32(direction,    GPIOSets),
+        VMSTATE_UINT32(int_enable,   GPIOSets),
+        VMSTATE_UINT32(int_sens_0,   GPIOSets),
+        VMSTATE_UINT32(int_sens_1,   GPIOSets),
+        VMSTATE_UINT32(int_sens_2,   GPIOSets),
+        VMSTATE_UINT32(int_status,   GPIOSets),
+        VMSTATE_UINT32(reset_tol,    GPIOSets),
+        VMSTATE_UINT32(cmd_source_0, GPIOSets),
+        VMSTATE_UINT32(cmd_source_1, GPIOSets),
+        VMSTATE_UINT32(debounce_1,   GPIOSets),
+        VMSTATE_UINT32(debounce_2,   GPIOSets),
+        VMSTATE_UINT32(input_mask,   GPIOSets),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static const VMStateDescription vmstate_aspeed_gpio = {
+    .name = TYPE_ASPEED_GPIO,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_STRUCT_ARRAY(sets, AspeedGPIOState, ASPEED_GPIO_MAX_NR_SETS,
+                             1, vmstate_gpio_regs, GPIOSets),
+        VMSTATE_UINT32_ARRAY(debounce_regs, AspeedGPIOState,
+                             ASPEED_GPIO_NR_DEBOUNCE_REGS),
+        VMSTATE_END_OF_LIST(),
+   }
+};
+
+static void aspeed_gpio_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = aspeed_gpio_realize;
+    dc->reset = aspeed_gpio_reset;
+    dc->desc = "Aspeed GPIO Controller";
+    dc->vmsd = &vmstate_aspeed_gpio;
+}
+
+static void aspeed_gpio_ast2400_class_init(ObjectClass *klass, void *data)
+{
+    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
+
+    agc->props = ast2400_set_props;
+    agc->nr_gpio_pins = 216;
+    agc->nr_gpio_sets = 7;
+    agc->gap = 196;
+    agc->reg_table = aspeed_3_6v_gpios;
+}
+
+static void aspeed_gpio_2500_class_init(ObjectClass *klass, void *data)
+{
+    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
+
+    agc->props = ast2500_set_props;
+    agc->nr_gpio_pins = 228;
+    agc->nr_gpio_sets = 8;
+    agc->gap = 220;
+    agc->reg_table = aspeed_3_6v_gpios;
+}
+
+static const TypeInfo aspeed_gpio_info = {
+    .name           = TYPE_ASPEED_GPIO,
+    .parent         = TYPE_SYS_BUS_DEVICE,
+    .instance_size  = sizeof(AspeedGPIOState),
+    .class_size     = sizeof(AspeedGPIOClass),
+    .class_init     = aspeed_gpio_class_init,
+    .abstract       = true,
+};
+
+static const TypeInfo aspeed_gpio_ast2400_info = {
+    .name           = TYPE_ASPEED_GPIO "-ast2400",
+    .parent         = TYPE_ASPEED_GPIO,
+    .class_init     = aspeed_gpio_ast2400_class_init,
+    .instance_init  = aspeed_gpio_init,
+};
+
+static const TypeInfo aspeed_gpio_ast2500_info = {
+    .name           = TYPE_ASPEED_GPIO "-ast2500",
+    .parent         = TYPE_ASPEED_GPIO,
+    .class_init     = aspeed_gpio_2500_class_init,
+    .instance_init  = aspeed_gpio_init,
+};
+
+static void aspeed_gpio_register_types(void)
+{
+    type_register_static(&aspeed_gpio_info);
+    type_register_static(&aspeed_gpio_ast2400_info);
+    type_register_static(&aspeed_gpio_ast2500_info);
+}
+
+type_init(aspeed_gpio_register_types);
-- 
2.20.1

From: Rashmica Gupta <rashmica.g@gmail.com>

Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-3-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |  3 +++
 hw/arm/aspeed_soc.c         | 17 +++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/watchdog/wdt_aspeed.h"
 #include "hw/net/ftgmac100.h"
 #include "target/arm/cpu.h"
+#include "hw/gpio/aspeed_gpio.h"
 
 #define ASPEED_SPIS_NUM  2
 #define ASPEED_WDTS_NUM  3
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
     AspeedSDMCState sdmc;
     AspeedWDTState wdt[ASPEED_WDTS_NUM];
     FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
+    AspeedGPIOState gpio;
 } AspeedSoCState;
 
 #define TYPE_ASPEED_SOC "aspeed-soc"
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
     int spis_num;
     const char *fmc_typename;
     const char **spi_typename;
+    const char *gpio_typename;
     int wdts_num;
     const int *irqmap;
     const hwaddr *memmap;
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spis_num     = 1,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .gpio_typename = "aspeed.gpio-ast2400",
         .wdts_num     = 2,
         .irqmap       = aspeed_soc_ast2400_irqmap,
         .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spis_num     = 1,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .gpio_typename = "aspeed.gpio-ast2400",
         .wdts_num     = 2,
         .irqmap       = aspeed_soc_ast2400_irqmap,
         .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spis_num     = 1,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .gpio_typename = "aspeed.gpio-ast2400",
         .wdts_num     = 2,
         .irqmap       = aspeed_soc_ast2400_irqmap,
         .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spis_num     = 2,
         .fmc_typename = "aspeed.smc.ast2500-fmc",
         .spi_typename = aspeed_soc_ast2500_typenames,
+        .gpio_typename = "aspeed.gpio-ast2500",
         .wdts_num     = 3,
         .irqmap       = aspeed_soc_ast2500_irqmap,
         .memmap       = aspeed_soc_ast2500_memmap,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
 
     sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
                           TYPE_ASPEED_XDMA);
+
+    sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
+                          sc->info->gpio_typename);
 }
 
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
                     sc->info->memmap[ASPEED_XDMA]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
                        aspeed_soc_get_irq(s, ASPEED_XDMA));
+
+    /* GPIO */
+    object_property_set_bool(OBJECT(&s->gpio), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->info->memmap[ASPEED_GPIO]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
+                       aspeed_soc_get_irq(s, ASPEED_GPIO));
 }
 static Property aspeed_soc_properties[] = {
     DEFINE_PROP_UINT32("num-cpus", AspeedSoCState, num_cpus, 0),
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

There are no QEMU Aspeed machines using the SoCs "ast2400-a0" or
"ast2400".

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-4-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed_soc.c | 26 --------------------------
 1 file changed, 26 deletions(-)

diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const char *aspeed_soc_ast2500_typenames[] = {
 
 static const AspeedSoCInfo aspeed_socs[] = {
     {
-        .name         = "ast2400-a0",
-        .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
-        .silicon_rev  = AST2400_A0_SILICON_REV,
-        .sram_size    = 0x8000,
-        .spis_num     = 1,
-        .fmc_typename = "aspeed.smc.fmc",
-        .spi_typename = aspeed_soc_ast2400_typenames,
-        .gpio_typename = "aspeed.gpio-ast2400",
-        .wdts_num     = 2,
-        .irqmap       = aspeed_soc_ast2400_irqmap,
-        .memmap       = aspeed_soc_ast2400_memmap,
-        .num_cpus     = 1,
-    }, {
         .name         = "ast2400-a1",
         .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
         .silicon_rev  = AST2400_A1_SILICON_REV,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .irqmap       = aspeed_soc_ast2400_irqmap,
         .memmap       = aspeed_soc_ast2400_memmap,
         .num_cpus     = 1,
-    }, {
-        .name         = "ast2400",
-        .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
-        .silicon_rev  = AST2400_A0_SILICON_REV,
-        .sram_size    = 0x8000,
-        .spis_num     = 1,
-        .fmc_typename = "aspeed.smc.fmc",
-        .spi_typename = aspeed_soc_ast2400_typenames,
-        .gpio_typename = "aspeed.gpio-ast2400",
-        .wdts_num     = 2,
-        .irqmap       = aspeed_soc_ast2400_irqmap,
-        .memmap       = aspeed_soc_ast2400_memmap,
-        .num_cpus     = 1,
     }, {
         .name         = "ast2500-a1",
         .cpu_type     = ARM_CPU_TYPE_NAME("arm1176"),
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

Improve the naming of the different controller models to ease their
generation when initializing the SoC. The rename of the SMC types is
breaking migration compatibility.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-5-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |  3 ---
 hw/arm/aspeed_soc.c         | 25 ++++++++++++-------------
 hw/ssi/aspeed_smc.c         | 12 ++++++------
 3 files changed, 18 insertions(+), 22 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
     uint32_t silicon_rev;
     uint64_t sram_size;
     int spis_num;
-    const char *fmc_typename;
-    const char **spi_typename;
-    const char *gpio_typename;
     int wdts_num;
     const int *irqmap;
     const hwaddr *memmap;
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2400_irqmap[] = {
 
 #define aspeed_soc_ast2500_irqmap aspeed_soc_ast2400_irqmap
 
-static const char *aspeed_soc_ast2400_typenames[] = { "aspeed.smc.spi" };
-static const char *aspeed_soc_ast2500_typenames[] = {
-    "aspeed.smc.ast2500-spi1", "aspeed.smc.ast2500-spi2" };
-
 static const AspeedSoCInfo aspeed_socs[] = {
     {
         .name         = "ast2400-a1",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .silicon_rev  = AST2400_A1_SILICON_REV,
         .sram_size    = 0x8000,
         .spis_num     = 1,
-        .fmc_typename = "aspeed.smc.fmc",
-        .spi_typename = aspeed_soc_ast2400_typenames,
-        .gpio_typename = "aspeed.gpio-ast2400",
         .wdts_num     = 2,
         .irqmap       = aspeed_soc_ast2400_irqmap,
         .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .silicon_rev  = AST2500_A1_SILICON_REV,
         .sram_size    = 0x9000,
         .spis_num     = 2,
-        .fmc_typename = "aspeed.smc.ast2500-fmc",
-        .spi_typename = aspeed_soc_ast2500_typenames,
-        .gpio_typename = "aspeed.gpio-ast2500",
         .wdts_num     = 3,
         .irqmap       = aspeed_soc_ast2500_irqmap,
         .memmap       = aspeed_soc_ast2500_memmap,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     AspeedSoCState *s = ASPEED_SOC(obj);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     int i;
+    char socname[8];
+    char typename[64];
+
+    if (sscanf(sc->info->name, "%7s", socname) != 1) {
+        g_assert_not_reached();
+    }
 
     for (i = 0; i < sc->info->num_cpus; i++) {
         object_initialize_child(obj, "cpu[*]", OBJECT(&s->cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     sysbus_init_child_obj(obj, "i2c", OBJECT(&s->i2c), sizeof(s->i2c),
                           TYPE_ASPEED_I2C);
 
+    snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
     sysbus_init_child_obj(obj, "fmc", OBJECT(&s->fmc), sizeof(s->fmc),
-                          sc->info->fmc_typename);
+                          typename);
     object_property_add_alias(obj, "num-cs", OBJECT(&s->fmc), "num-cs",
                               &error_abort);
 
     for (i = 0; i < sc->info->spis_num; i++) {
+        snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
         sysbus_init_child_obj(obj, "spi[*]", OBJECT(&s->spi[i]),
-                              sizeof(s->spi[i]), sc->info->spi_typename[i]);
+                              sizeof(s->spi[i]), typename);
     }
 
     sysbus_init_child_obj(obj, "sdmc", OBJECT(&s->sdmc), sizeof(s->sdmc),
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
                           TYPE_ASPEED_XDMA);
 
+    snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
     sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
-                          sc->info->gpio_typename);
+                          typename);
 }
 
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSegments aspeed_segments_ast2500_spi2[] = {
 
 static const AspeedSMCController controllers[] = {
     {
-        .name              = "aspeed.smc.smc",
+        .name              = "aspeed.smc-ast2400",
         .r_conf            = R_CONF,
         .r_ce_ctrl         = R_CE_CTRL,
         .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .has_dma           = false,
         .nregs             = ASPEED_SMC_R_SMC_MAX,
     }, {
-        .name              = "aspeed.smc.fmc",
+        .name              = "aspeed.fmc-ast2400",
         .r_conf            = R_CONF,
         .r_ce_ctrl         = R_CE_CTRL,
         .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .has_dma           = true,
         .nregs             = ASPEED_SMC_R_MAX,
     }, {
-        .name              = "aspeed.smc.spi",
+        .name              = "aspeed.spi1-ast2400",
         .r_conf            = R_SPI_CONF,
         .r_ce_ctrl         = 0xff,
         .r_ctrl0           = R_SPI_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .has_dma           = false,
         .nregs             = ASPEED_SMC_R_SPI_MAX,
     }, {
-        .name              = "aspeed.smc.ast2500-fmc",
+        .name              = "aspeed.fmc-ast2500",
         .r_conf            = R_CONF,
         .r_ce_ctrl         = R_CE_CTRL,
         .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .has_dma           = true,
         .nregs             = ASPEED_SMC_R_MAX,
     }, {
-        .name              = "aspeed.smc.ast2500-spi1",
+        .name              = "aspeed.spi1-ast2500",
         .r_conf            = R_CONF,
         .r_ce_ctrl         = R_CE_CTRL,
         .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .has_dma           = false,
         .nregs             = ASPEED_SMC_R_MAX,
     }, {
-        .name              = "aspeed.smc.ast2500-spi2",
+        .name              = "aspeed.spi2-ast2500",
         .r_conf            = R_CONF,
         .r_ce_ctrl         = R_CE_CTRL,
         .r_ctrl0           = R_CTRL0,
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

The FMC controller on the Aspeed SoCs support DMA to access the flash
modules. It can operate in a normal mode, to copy to or from the flash
module mapping window, or in a checksum calculation mode, to evaluate
the best clock settings for reads.

The model introduces two custom address spaces for DMAs: one for the
AHB window of the FMC flash devices and one for the DRAM. The latter
is populated using a "dram" link set from the machine with the RAM
container region.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190904070506.1052-6-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/ssi/aspeed_smc.h |   6 +
 hw/arm/aspeed.c             |   2 +
 hw/arm/aspeed_soc.c         |   2 +
 hw/ssi/aspeed_smc.c         | 222 +++++++++++++++++++++++++++++++++++-
 4 files changed, 226 insertions(+), 6 deletions(-)

diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ssi/aspeed_smc.h
+++ b/include/hw/ssi/aspeed_smc.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCController {
     hwaddr flash_window_base;
     uint32_t flash_window_size;
     bool has_dma;
+    hwaddr dma_flash_mask;
+    hwaddr dma_dram_mask;
     uint32_t nregs;
 } AspeedSMCController;
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCState {
     /* for DMA support */
     uint64_t sdram_base;
 
+    AddressSpace flash_as;
+    MemoryRegion *dram_mr;
+    AddressSpace dram_as;
+
     AspeedSMCFlash *flashes;
 
     uint8_t snoop_index;
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
                             &error_abort);
     object_property_set_int(OBJECT(&bmc->soc), machine->smp.cpus, "num-cpus",
                             &error_abort);
+    object_property_set_link(OBJECT(&bmc->soc), OBJECT(&bmc->ram_container),
+                             "dram", &error_abort);
     if (machine->kernel_filename) {
         /*
          * When booting with a -kernel command line there is no u-boot
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                           typename);
     object_property_add_alias(obj, "num-cs", OBJECT(&s->fmc), "num-cs",
                               &error_abort);
+    object_property_add_alias(obj, "dram", OBJECT(&s->fmc), "dram",
+                              &error_abort);
 
     for (i = 0; i < sc->info->spis_num; i++) {
         snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "qemu/error-report.h"
+#include "qapi/error.h"
+#include "exec/address-spaces.h"
 
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@
 #define   DMA_CTRL_FREQ_SHIFT   4
 #define   DMA_CTRL_MODE         (1 << 3)
 #define   DMA_CTRL_CKSUM        (1 << 2)
-#define   DMA_CTRL_DIR          (1 << 1)
-#define   DMA_CTRL_EN           (1 << 0)
+#define   DMA_CTRL_WRITE        (1 << 1)
+#define   DMA_CTRL_ENABLE       (1 << 0)
 
 /* DMA Flash Side Address */
 #define R_DMA_FLASH_ADDR  (0x84 / 4)
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_SOC_SPI_FLASH_BASE   0x30000000
 #define ASPEED_SOC_SPI2_FLASH_BASE  0x38000000
 
+/*
+ * DMA DRAM addresses should be 4 bytes aligned and the valid address
+ * range is 0x40000000 - 0x5FFFFFFF (AST2400)
+ *          0x80000000 - 0xBFFFFFFF (AST2500)
+ *
+ * DMA flash addresses should be 4 bytes aligned and the valid address
+ * range is 0x20000000 - 0x2FFFFFFF.
+ *
+ * DMA length is from 4 bytes to 32MB
+ *   0: 4 bytes
+ *   0x7FFFFF: 32M bytes
+ */
+#define DMA_DRAM_ADDR(s, val)   ((s)->sdram_base | \
+                                 ((val) & (s)->ctrl->dma_dram_mask))
+#define DMA_FLASH_ADDR(s, val)  ((s)->ctrl->flash_window_base | \
+                                ((val) & (s)->ctrl->dma_flash_mask))
+#define DMA_LENGTH(val)         ((val) & 0x01FFFFFC)
+
 /* Flash opcodes. */
 #define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
 
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
         .flash_window_size = 0x10000000,
         .has_dma           = true,
+        .dma_flash_mask    = 0x0FFFFFFC,
+        .dma_dram_mask     = 0x1FFFFFFC,
         .nregs             = ASPEED_SMC_R_MAX,
     }, {
         .name              = "aspeed.spi1-ast2400",
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
         .flash_window_size = 0x10000000,
         .has_dma           = true,
+        .dma_flash_mask    = 0x0FFFFFFC,
+        .dma_dram_mask     = 0x3FFFFFFC,
         .nregs             = ASPEED_SMC_R_MAX,
     }, {
         .name              = "aspeed.spi1-ast2500",
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reset(DeviceState *d)
 
     memset(s->regs, 0, sizeof s->regs);
 
-    /* Pretend DMA is done (u-boot initialization) */
-    s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS;
-
     /* Unselect all slaves */
     for (i = 0; i < s->num_cs; ++i) {
         s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
         addr == s->r_ce_ctrl ||
         addr == R_INTR_CTRL ||
         addr == R_DUMMY_DATA ||
+        (s->ctrl->has_dma && addr == R_DMA_CTRL) ||
+        (s->ctrl->has_dma && addr == R_DMA_FLASH_ADDR) ||
+        (s->ctrl->has_dma && addr == R_DMA_DRAM_ADDR) ||
+        (s->ctrl->has_dma && addr == R_DMA_LEN) ||
+        (s->ctrl->has_dma && addr == R_DMA_CHECKSUM) ||
         (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) ||
         (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->ctrl->max_slaves)) {
         return s->regs[addr];
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
     }
 }
 
+/*
+ * Accumulate the result of the reads to provide a checksum that will
+ * be used to validate the read timing settings.
+ */
+static void aspeed_smc_dma_checksum(AspeedSMCState *s)
+{
+    MemTxResult result;
+    uint32_t data;
+
+    if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid direction for DMA checksum\n",  __func__);
+        return;
+    }
+
+    while (s->regs[R_DMA_LEN]) {
+        data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
+                                    MEMTXATTRS_UNSPECIFIED, &result);
+        if (result != MEMTX_OK) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash read failed @%08x\n",
+                          __func__, s->regs[R_DMA_FLASH_ADDR]);
+            return;
+        }
+
+        /*
+         * When the DMA is on-going, the DMA registers are updated
+         * with the current working addresses and length.
+         */
+        s->regs[R_DMA_CHECKSUM] += data;
+        s->regs[R_DMA_FLASH_ADDR] += 4;
+        s->regs[R_DMA_LEN] -= 4;
+    }
+}
+
+static void aspeed_smc_dma_rw(AspeedSMCState *s)
+{
+    MemTxResult result;
+    uint32_t data;
+
+    while (s->regs[R_DMA_LEN]) {
+        if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
+            data = address_space_ldl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
+                                        MEMTXATTRS_UNSPECIFIED, &result);
+            if (result != MEMTX_OK) {
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n",
+                              __func__, s->regs[R_DMA_DRAM_ADDR]);
+                return;
+            }
+
+            address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
+                                 data, MEMTXATTRS_UNSPECIFIED, &result);
+            if (result != MEMTX_OK) {
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash write failed @%08x\n",
+                              __func__, s->regs[R_DMA_FLASH_ADDR]);
+                return;
+            }
+        } else {
+            data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
+                                        MEMTXATTRS_UNSPECIFIED, &result);
+            if (result != MEMTX_OK) {
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash read failed @%08x\n",
+                              __func__, s->regs[R_DMA_FLASH_ADDR]);
+                return;
+            }
+
+            address_space_stl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
+                                 data, MEMTXATTRS_UNSPECIFIED, &result);
+            if (result != MEMTX_OK) {
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n",
+                              __func__, s->regs[R_DMA_DRAM_ADDR]);
+                return;
+            }
+        }
+
+        /*
+         * When the DMA is on-going, the DMA registers are updated
+         * with the current working addresses and length.
+         */
+        s->regs[R_DMA_FLASH_ADDR] += 4;
+        s->regs[R_DMA_DRAM_ADDR] += 4;
+        s->regs[R_DMA_LEN] -= 4;
+    }
+}
+
+static void aspeed_smc_dma_stop(AspeedSMCState *s)
+{
+    /*
+     * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the
+     * engine is idle
+     */
+    s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS;
+    s->regs[R_DMA_CHECKSUM] = 0;
+
+    /*
+     * Lower the DMA irq in any case. The IRQ control register could
+     * have been cleared before disabling the DMA.
+     */
+    qemu_irq_lower(s->irq);
+}
+
+/*
+ * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA
+ * can start even if the result of the previous was not collected.
+ */
+static bool aspeed_smc_dma_in_progress(AspeedSMCState *s)
+{
+    return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE &&
+        !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS);
+}
+
+static void aspeed_smc_dma_done(AspeedSMCState *s)
+{
+    s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS;
+    if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) {
+        qemu_irq_raise(s->irq);
+    }
+}
+
+static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint64_t dma_ctrl)
+{
+    if (!(dma_ctrl & DMA_CTRL_ENABLE)) {
+        s->regs[R_DMA_CTRL] = dma_ctrl;
+
+        aspeed_smc_dma_stop(s);
+        return;
+    }
+
+    if (aspeed_smc_dma_in_progress(s)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA in progress\n",  __func__);
+        return;
+    }
+
+    s->regs[R_DMA_CTRL] = dma_ctrl;
+
+    if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) {
+        aspeed_smc_dma_checksum(s);
+    } else {
+        aspeed_smc_dma_rw(s);
+    }
+
+    aspeed_smc_dma_done(s);
+}
+
 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
                              unsigned int size)
 {
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
         }
     } else if (addr == R_DUMMY_DATA) {
         s->regs[addr] = value & 0xff;
+    } else if (addr == R_INTR_CTRL) {
+        s->regs[addr] = value;
+    } else if (s->ctrl->has_dma && addr == R_DMA_CTRL) {
+        aspeed_smc_dma_ctrl(s, value);
+    } else if (s->ctrl->has_dma && addr == R_DMA_DRAM_ADDR) {
+        s->regs[addr] = DMA_DRAM_ADDR(s, value);
+    } else if (s->ctrl->has_dma && addr == R_DMA_FLASH_ADDR) {
+        s->regs[addr] = DMA_FLASH_ADDR(s, value);
+    } else if (s->ctrl->has_dma && addr == R_DMA_LEN) {
+        s->regs[addr] = DMA_LENGTH(value);
     } else {
         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
                       __func__, addr);
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_smc_ops = {
     .valid.unaligned = true,
 };
 
+
+/*
+ * Initialize the custom address spaces for DMAs
+ */
+static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp)
+{
+    char *name;
+
+    if (!s->dram_mr) {
+        error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set");
+        return;
+    }
+
+    name = g_strdup_printf("%s-dma-flash", s->ctrl->name);
+    address_space_init(&s->flash_as, &s->mmio_flash, name);
+    g_free(name);
+
+    name = g_strdup_printf("%s-dma-dram", s->ctrl->name);
+    address_space_init(&s->dram_as, s->dram_mr, name);
+    g_free(name);
+}
+
 static void aspeed_smc_realize(DeviceState *dev, Error **errp)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
         s->num_cs = s->ctrl->max_slaves;
     }
 
+    /* DMA irq. Keep it first for the initialization in the SoC */
+    sysbus_init_irq(sbd, &s->irq);
+
     s->spi = ssi_create_bus(dev, "spi");
 
     /* Setup cs_lines for slaves */
-    sysbus_init_irq(sbd, &s->irq);
     s->cs_lines = g_new0(qemu_irq, s->num_cs);
     ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
         memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
         offset += fl->size;
     }
+
+    /* DMA support */
+    if (s->ctrl->has_dma) {
+        aspeed_smc_dma_setup(s, errp);
+    }
 }
 
 static const VMStateDescription vmstate_aspeed_smc = {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_smc = {
 static Property aspeed_smc_properties[] = {
     DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
     DEFINE_PROP_UINT64("sdram-base", AspeedSMCState, sdram_base, 0),
+    DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
+                     TYPE_MEMORY_REGION, MemoryRegion *),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

When doing calibration, the SPI clock rate in the CE0 Control Register
and the read delay cycles in the Read Timing Compensation Register are
set using bit[11:4] of the DMA Control Register.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190904070506.1052-7-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/aspeed_smc.c | 64 ++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 63 insertions(+), 1 deletion(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@
 #define   CTRL_CMD_MASK            0xff
 #define   CTRL_DUMMY_HIGH_SHIFT    14
 #define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
+#define CE_CTRL_CLOCK_FREQ_SHIFT   8
+#define CE_CTRL_CLOCK_FREQ_MASK    0xf
+#define CE_CTRL_CLOCK_FREQ(div)                                         \
+    (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT)
 #define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
 #define   CTRL_CE_STOP_ACTIVE      (1 << 2)
 #define   CTRL_CMD_MODE_MASK       0x3
@@ -XXX,XX +XXX,XX @@
 #define   DMA_CTRL_DELAY_SHIFT  8
 #define   DMA_CTRL_FREQ_MASK    0xf
 #define   DMA_CTRL_FREQ_SHIFT   4
-#define   DMA_CTRL_MODE         (1 << 3)
+#define   DMA_CTRL_CALIB        (1 << 3)
 #define   DMA_CTRL_CKSUM        (1 << 2)
 #define   DMA_CTRL_WRITE        (1 << 1)
 #define   DMA_CTRL_ENABLE       (1 << 0)
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
     }
 }
 
+static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask)
+{
+    /* HCLK/1 .. HCLK/16 */
+    const uint8_t hclk_divisors[] = {
+        15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0
+    };
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) {
+        if (hclk_mask == hclk_divisors[i]) {
+            return i + 1;
+        }
+    }
+
+    qemu_log_mask(LOG_GUEST_ERROR, "invalid HCLK mask %x", hclk_mask);
+    return 0;
+}
+
+/*
+ * When doing calibration, the SPI clock rate in the CE0 Control
+ * Register and the read delay cycles in the Read Timing Compensation
+ * Register are set using bit[11:4] of the DMA Control Register.
+ */
+static void aspeed_smc_dma_calibration(AspeedSMCState *s)
+{
+    uint8_t delay =
+        (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
+    uint8_t hclk_mask =
+        (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
+    uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask);
+    uint32_t hclk_shift = (hclk_div - 1) << 2;
+    uint8_t cs;
+
+    /*
+     * The Read Timing Compensation Register values apply to all CS on
+     * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays
+     */
+    if (hclk_div && hclk_div < 6) {
+        s->regs[s->r_timings] &= ~(0xf << hclk_shift);
+        s->regs[s->r_timings] |= delay << hclk_shift;
+    }
+
+    /*
+     * TODO: compute the CS from the DMA address and the segment
+     * registers. This is not really a problem for now because the
+     * Timing Register values apply to all CS and software uses CS0 to
+     * do calibration.
+     */
+    cs = 0;
+    s->regs[s->r_ctrl0 + cs] &=
+        ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT);
+    s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
+}
+
 /*
  * Accumulate the result of the reads to provide a checksum that will
  * be used to validate the read timing settings.
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_checksum(AspeedSMCState *s)
         return;
     }
 
+    if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) {
+        aspeed_smc_dma_calibration(s);
+    }
+
     while (s->regs[R_DMA_LEN]) {
         data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
                                     MEMTXATTRS_UNSPECIFIED, &result);
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

Emulate read errors in the DMA Checksum Register for high frequencies
and optimistic settings of the Read Timing Compensation Register. This
will help in tuning the SPI timing calibration algorithm. Errors are
only injected when the property "inject_failure" is set to true as
suggested by Philippe.

The values below are those to expect from the first flash device of
the FMC controller of a palmetto-bmc machine.

Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190904070506.1052-8-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/ssi/aspeed_smc.h |  1 +
 hw/ssi/aspeed_smc.c         | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ssi/aspeed_smc.h
+++ b/include/hw/ssi/aspeed_smc.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCState {
 
     uint32_t num_cs;
     qemu_irq *cs_lines;
+    bool inject_failure;
 
     SSIBus *spi;
 
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_calibration(AspeedSMCState *s)
     s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
 }
 
+/*
+ * Emulate read errors in the DMA Checksum Register for high
+ * frequencies and optimistic settings of the Read Timing Compensation
+ * Register. This will help in tuning the SPI timing calibration
+ * algorithm.
+ */
+static bool aspeed_smc_inject_read_failure(AspeedSMCState *s)
+{
+    uint8_t delay =
+        (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
+    uint8_t hclk_mask =
+        (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
+
+    /*
+     * Typical values of a palmetto-bmc machine.
+     */
+    switch (aspeed_smc_hclk_divisor(hclk_mask)) {
+    case 4 ... 16:
+        return false;
+    case 3: /* at least one HCLK cycle delay */
+        return (delay & 0x7) < 1;
+    case 2: /* at least two HCLK cycle delay */
+        return (delay & 0x7) < 2;
+    case 1: /* (> 100MHz) is above the max freq of the controller */
+        return true;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 /*
  * Accumulate the result of the reads to provide a checksum that will
  * be used to validate the read timing settings.
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_checksum(AspeedSMCState *s)
         s->regs[R_DMA_FLASH_ADDR] += 4;
         s->regs[R_DMA_LEN] -= 4;
     }
+
+    if (s->inject_failure && aspeed_smc_inject_read_failure(s)) {
+        s->regs[R_DMA_CHECKSUM] = 0xbadc0de;
+    }
+
 }
 
 static void aspeed_smc_dma_rw(AspeedSMCState *s)
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_smc = {
 
 static Property aspeed_smc_properties[] = {
     DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
+    DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false),
     DEFINE_PROP_UINT64("sdram-base", AspeedSMCState, sdram_base, 0),
     DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
                      TYPE_MEMORY_REGION, MemoryRegion *),
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

and use a class AspeedSCUClass to define each SoC characteristics.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-10-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/aspeed_scu.h | 15 +++++++
 hw/arm/aspeed_soc.c          |  3 +-
 hw/misc/aspeed_scu.c         | 83 ++++++++++++++++++++----------------
 3 files changed, 64 insertions(+), 37 deletions(-)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -XXX,XX +XXX,XX @@
 
 #define TYPE_ASPEED_SCU "aspeed.scu"
 #define ASPEED_SCU(obj) OBJECT_CHECK(AspeedSCUState, (obj), TYPE_ASPEED_SCU)
+#define TYPE_ASPEED_2400_SCU TYPE_ASPEED_SCU "-ast2400"
+#define TYPE_ASPEED_2500_SCU TYPE_ASPEED_SCU "-ast2500"
 
 #define ASPEED_SCU_NR_REGS (0x1A8 >> 2)
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
 
 extern bool is_supported_silicon_rev(uint32_t silicon_rev);
 
+#define ASPEED_SCU_CLASS(klass) \
+     OBJECT_CLASS_CHECK(AspeedSCUClass, (klass), TYPE_ASPEED_SCU)
+#define ASPEED_SCU_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(AspeedSCUClass, (obj), TYPE_ASPEED_SCU)
+
+typedef struct  AspeedSCUClass {
+    SysBusDeviceClass parent_class;
+
+    const uint32_t *resets;
+    uint32_t (*calc_hpll)(AspeedSCUState *s);
+    uint32_t apb_divider;
+}  AspeedSCUClass;
+
 #define ASPEED_SCU_PROT_KEY      0x1688A8A8
 
 /*
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                                 &error_abort, NULL);
     }
 
+    snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
     sysbus_init_child_obj(obj, "scu", OBJECT(&s->scu), sizeof(s->scu),
-                          TYPE_ASPEED_SCU);
+                          typename);
     qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev",
                          sc->info->silicon_rev);
     object_property_add_alias(obj, "hw-strap1", OBJECT(&s->scu),
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_get_random(void)
 
 static void aspeed_scu_set_apb_freq(AspeedSCUState *s)
 {
-    uint32_t apb_divider;
-
-    switch (s->silicon_rev) {
-    case AST2400_A0_SILICON_REV:
-    case AST2400_A1_SILICON_REV:
-        apb_divider = 2;
-        break;
-    case AST2500_A0_SILICON_REV:
-    case AST2500_A1_SILICON_REV:
-        apb_divider = 4;
-        break;
-    default:
-        g_assert_not_reached();
-    }
+    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(s);
 
     s->apb_freq = s->hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
-        / apb_divider;
+        / asc->apb_divider;
 }
 
 static uint64_t aspeed_scu_read(void *opaque, hwaddr offset, unsigned size)
@@ -XXX,XX +XXX,XX @@ static const uint32_t hpll_ast2400_freqs[][4] = {
     { 400, 375, 350, 425 }, /* 25MHz */
 };
 
-static uint32_t aspeed_scu_calc_hpll_ast2400(AspeedSCUState *s)
+static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
 {
     uint32_t hpll_reg = s->regs[HPLL_PARAM];
     uint8_t freq_select;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_calc_hpll_ast2400(AspeedSCUState *s)
     return hpll_ast2400_freqs[clk_25m_in][freq_select] * 1000000;
 }
 
-static uint32_t aspeed_scu_calc_hpll_ast2500(AspeedSCUState *s)
+static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
 {
     uint32_t hpll_reg   = s->regs[HPLL_PARAM];
     uint32_t multiplier = 1;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_calc_hpll_ast2500(AspeedSCUState *s)
 static void aspeed_scu_reset(DeviceState *dev)
 {
     AspeedSCUState *s = ASPEED_SCU(dev);
-    const uint32_t *reset;
-    uint32_t (*calc_hpll)(AspeedSCUState *s);
+    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
 
-    switch (s->silicon_rev) {
-    case AST2400_A0_SILICON_REV:
-    case AST2400_A1_SILICON_REV:
-        reset = ast2400_a0_resets;
-        calc_hpll = aspeed_scu_calc_hpll_ast2400;
-        break;
-    case AST2500_A0_SILICON_REV:
-    case AST2500_A1_SILICON_REV:
-        reset = ast2500_a1_resets;
-        calc_hpll = aspeed_scu_calc_hpll_ast2500;
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
-    memcpy(s->regs, reset, sizeof(s->regs));
+    memcpy(s->regs, asc->resets, sizeof(s->regs));
     s->regs[SILICON_REV] = s->silicon_rev;
     s->regs[HW_STRAP1] = s->hw_strap1;
     s->regs[HW_STRAP2] = s->hw_strap2;
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_reset(DeviceState *dev)
      * All registers are set. Now compute the frequencies of the main clocks
      */
     s->clkin = aspeed_scu_get_clkin(s);
-    s->hpll = calc_hpll(s);
+    s->hpll = asc->calc_hpll(s);
     aspeed_scu_set_apb_freq(s);
 }
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_scu_info = {
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(AspeedSCUState),
     .class_init = aspeed_scu_class_init,
+    .class_size    = sizeof(AspeedSCUClass),
+    .abstract      = true,
+};
+
+static void aspeed_2400_scu_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
+
+    dc->desc = "ASPEED 2400 System Control Unit";
+    asc->resets = ast2400_a0_resets;
+    asc->calc_hpll = aspeed_2400_scu_calc_hpll;
+    asc->apb_divider = 2;
+}
+
+static const TypeInfo aspeed_2400_scu_info = {
+    .name = TYPE_ASPEED_2400_SCU,
+    .parent = TYPE_ASPEED_SCU,
+    .instance_size = sizeof(AspeedSCUState),
+    .class_init = aspeed_2400_scu_class_init,
+};
+
+static void aspeed_2500_scu_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
+
+    dc->desc = "ASPEED 2500 System Control Unit";
+    asc->resets = ast2500_a1_resets;
+    asc->calc_hpll = aspeed_2500_scu_calc_hpll;
+    asc->apb_divider = 4;
+}
+
+static const TypeInfo aspeed_2500_scu_info = {
+    .name = TYPE_ASPEED_2500_SCU,
+    .parent = TYPE_ASPEED_SCU,
+    .instance_size = sizeof(AspeedSCUState),
+    .class_init = aspeed_2500_scu_class_init,
 };
 
 static void aspeed_scu_register_types(void)
 {
     type_register_static(&aspeed_scu_info);
+    type_register_static(&aspeed_2400_scu_info);
+    type_register_static(&aspeed_2500_scu_info);
 }
 
 type_init(aspeed_scu_register_types);
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

The APB frequency can be calculated directly when needed from the
HPLL_PARAM and CLK_SEL register values. This removes useless state in
the model.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-11-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/aspeed_scu.h |  8 +++-----
 hw/misc/aspeed_scu.c         | 25 +++++++++----------------
 hw/timer/aspeed_timer.c      |  3 ++-
 3 files changed, 14 insertions(+), 22 deletions(-)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
     uint32_t hw_strap1;
     uint32_t hw_strap2;
     uint32_t hw_prot_key;
-
-    uint32_t clkin;
-    uint32_t hpll;
-    uint32_t apb_freq;
 } AspeedSCUState;
 
 #define AST2400_A0_SILICON_REV   0x02000303U
@@ -XXX,XX +XXX,XX @@ typedef struct  AspeedSCUClass {
     SysBusDeviceClass parent_class;
 
     const uint32_t *resets;
-    uint32_t (*calc_hpll)(AspeedSCUState *s);
+    uint32_t (*calc_hpll)(AspeedSCUState *s, uint32_t hpll_reg);
     uint32_t apb_divider;
 }  AspeedSCUClass;
 
 #define ASPEED_SCU_PROT_KEY      0x1688A8A8
 
+uint32_t aspeed_scu_get_apb_freq(AspeedSCUState *s);
+
 /*
  * Extracted from Aspeed SDK v00.03.21. Fixes and extra definitions
  * were added.
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_get_random(void)
     return num;
 }
 
-static void aspeed_scu_set_apb_freq(AspeedSCUState *s)
+uint32_t aspeed_scu_get_apb_freq(AspeedSCUState *s)
 {
     AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(s);
+    uint32_t hpll = asc->calc_hpll(s, s->regs[HPLL_PARAM]);
 
-    s->apb_freq = s->hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
+    return hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
         / asc->apb_divider;
 }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
         return;
     case CLK_SEL:
         s->regs[reg] = data;
-        aspeed_scu_set_apb_freq(s);
         break;
     case HW_STRAP1:
         if (ASPEED_IS_AST2500(s->regs[SILICON_REV])) {
@@ -XXX,XX +XXX,XX @@ static const uint32_t hpll_ast2400_freqs[][4] = {
     { 400, 375, 350, 425 }, /* 25MHz */
 };
 
-static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
+static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s, uint32_t hpll_reg)
 {
-    uint32_t hpll_reg = s->regs[HPLL_PARAM];
     uint8_t freq_select;
     bool clk_25m_in;
+    uint32_t clkin = aspeed_scu_get_clkin(s);
 
     if (hpll_reg & SCU_AST2400_H_PLL_OFF) {
         return 0;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
             multiplier = (2 - od) * ((n + 2) / (d + 1));
         }
 
-        return s->clkin * multiplier;
+        return clkin * multiplier;
     }
 
     /* HW strapping */
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
     return hpll_ast2400_freqs[clk_25m_in][freq_select] * 1000000;
 }
 
-static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
+static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s, uint32_t hpll_reg)
 {
-    uint32_t hpll_reg   = s->regs[HPLL_PARAM];
     uint32_t multiplier = 1;
+    uint32_t clkin = aspeed_scu_get_clkin(s);
 
     if (hpll_reg & SCU_H_PLL_OFF) {
         return 0;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
         multiplier = ((m + 1) / (n + 1)) / (p + 1);
     }
 
-    return s->clkin * multiplier;
+    return clkin * multiplier;
 }
 
 static void aspeed_scu_reset(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_reset(DeviceState *dev)
     s->regs[HW_STRAP1] = s->hw_strap1;
     s->regs[HW_STRAP2] = s->hw_strap2;
     s->regs[PROT_KEY] = s->hw_prot_key;
-
-    /*
-     * All registers are set. Now compute the frequencies of the main clocks
-     */
-    s->clkin = aspeed_scu_get_clkin(s);
-    s->hpll = asc->calc_hpll(s);
-    aspeed_scu_set_apb_freq(s);
 }
 
 static uint32_t aspeed_silicon_revs[] = {
diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t calculate_rate(struct AspeedTimer *t)
 {
     AspeedTimerCtrlState *s = timer_to_ctrl(t);
 
-    return timer_external_clock(t) ? TIMER_CLOCK_EXT_HZ : s->scu->apb_freq;
+    return timer_external_clock(t) ? TIMER_CLOCK_EXT_HZ :
+        aspeed_scu_get_apb_freq(s->scu);
 }
 
 static inline uint32_t calculate_ticks(struct AspeedTimer *t, uint64_t now_ns)
-- 
2.20.1

From: "Emilio G. Cota" <cota@braap.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Emilio G. Cota <cota@braap.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/tcg/atomic_template.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
 
 #define GEN_ATOMIC_HELPER(X)                                        \
 ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
-                 ABI_TYPE val EXTRA_ARGS)                           \
+                        ABI_TYPE val EXTRA_ARGS)                    \
 {                                                                   \
     ATOMIC_MMU_DECLS;                                               \
     DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
-- 
2.20.1

The qemu-ga documentation is currently in qemu-ga.texi in
Texinfo format, which we present to the user as:
 * a qemu-ga manpage
 * a section of the main qemu-doc HTML documentation

Convert the documentation to rST format, and present it to
the user as:
 * a qemu-ga manpage
 * part of the interop/ Sphinx manual

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Message-id: 20190905131040.8350-1-peter.maydell@linaro.org
---
 Makefile                 |  24 ++++---
 MAINTAINERS              |   2 +-
 docs/conf.py             |  18 ++---
 docs/interop/conf.py     |   7 ++
 docs/interop/index.rst   |   1 +
 docs/interop/qemu-ga.rst | 133 +++++++++++++++++++++++++++++++++++++
 qemu-doc.texi            |   5 --
 qemu-ga.texi             | 137 ---------------------------------------
 8 files changed, 166 insertions(+), 161 deletions(-)
 create mode 100644 docs/interop/qemu-ga.rst
 delete mode 100644 qemu-ga.texi

diff --git a/Makefile b/Makefile
index XXXXXXX..XXXXXXX 100644
--- a/Makefile
+++ b/Makefile
@@ -XXX,XX +XXX,XX @@ endif
 endif
 
 ifdef BUILD_DOCS
-DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 qemu-ga.8
+DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 docs/interop/qemu-ga.8
 DOCS+=docs/interop/qemu-qmp-ref.html docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7
 DOCS+=docs/interop/qemu-ga-ref.html docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7
 DOCS+=docs/qemu-block-drivers.7
@@ -XXX,XX +XXX,XX @@ DESCS=
 endif
 
 # Note that we manually filter-out the non-Sphinx documentation which
-# is currently built into the docs/interop directory in the build tree.
+# is currently built into the docs/interop directory in the build tree,
+# and also any sphinx-built manpages.
 define install-manual =
 for d in $$(cd $(MANUAL_BUILDDIR) && find $1 -type d); do $(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)/$$d"; done
-for f in $$(cd $(MANUAL_BUILDDIR) && find $1 -type f -a '!' '(' -name 'qemu-*-qapi.*' -o -name 'qemu-*-ref.*' ')' ); do $(INSTALL_DATA) "$(MANUAL_BUILDDIR)/$$f" "$(DESTDIR)$(qemu_docdir)/$$f"; done
+for f in $$(cd $(MANUAL_BUILDDIR) && find $1 -type f -a '!' '(' -name '*.[0-9]' -o -name 'qemu-*-qapi.*' -o -name 'qemu-*-ref.*' ')' ); do $(INSTALL_DATA) "$(MANUAL_BUILDDIR)/$$f" "$(DESTDIR)$(qemu_docdir)/$$f"; done
 endef
 
 # Note that we deliberately do not install the "devel" manual: it is
@@ -XXX,XX +XXX,XX @@ ifdef CONFIG_TRACE_SYSTEMTAP
 	$(INSTALL_DATA) scripts/qemu-trace-stap.1 "$(DESTDIR)$(mandir)/man1"
 endif
 ifneq (,$(findstring qemu-ga,$(TOOLS)))
-	$(INSTALL_DATA) qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
+	$(INSTALL_DATA) docs/interop/qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
 	$(INSTALL_DATA) docs/interop/qemu-ga-ref.html "$(DESTDIR)$(qemu_docdir)"
 	$(INSTALL_DATA) docs/interop/qemu-ga-ref.txt "$(DESTDIR)$(qemu_docdir)"
 	$(INSTALL_DATA) docs/interop/qemu-ga-ref.7 "$(DESTDIR)$(mandir)/man7"
@@ -XXX,XX +XXX,XX @@ docs/version.texi: $(SRC_PATH)/VERSION config-host.mak
 sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html $(MANUAL_BUILDDIR)/interop/index.html $(MANUAL_BUILDDIR)/specs/index.html
 
 # Canned command to build a single manual
-build-manual = $(call quiet-command,sphinx-build $(if $(V),,-q) -W -n -b html -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
+# Arguments: $1 = manual name, $2 = Sphinx builder ('html' or 'man')
+build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" sphinx-build $(if $(V),,-q) -W -n -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
 # We assume all RST files in the manual's directory are used in it
 manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst) $(SRC_PATH)/docs/$1/conf.py $(SRC_PATH)/docs/conf.py
 
 $(MANUAL_BUILDDIR)/devel/index.html: $(call manual-deps,devel)
-	$(call build-manual,devel)
+	$(call build-manual,devel,html)
 
 $(MANUAL_BUILDDIR)/interop/index.html: $(call manual-deps,interop)
-	$(call build-manual,interop)
+	$(call build-manual,interop,html)
 
 $(MANUAL_BUILDDIR)/specs/index.html: $(call manual-deps,specs)
-	$(call build-manual,specs)
+	$(call build-manual,specs,html)
+
+$(MANUAL_BUILDDIR)/interop/qemu-ga.8: $(call manual-deps,interop)
+	$(call build-manual,interop,man)
 
 qemu-options.texi: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")
@@ -XXX,XX +XXX,XX @@ qemu.1: qemu-option-trace.texi
 qemu-img.1: qemu-img.texi qemu-option-trace.texi qemu-img-cmds.texi
 fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
 qemu-nbd.8: qemu-nbd.texi qemu-option-trace.texi
-qemu-ga.8: qemu-ga.texi
 docs/qemu-block-drivers.7: docs/qemu-block-drivers.texi
 docs/qemu-cpu-models.7: docs/qemu-cpu-models.texi
 scripts/qemu-trace-stap.1: scripts/qemu-trace-stap.texi
@@ -XXX,XX +XXX,XX @@ txt: qemu-doc.txt docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
 qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi \
 	qemu-tech.texi qemu-option-trace.texi \
-	qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
+	qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi \
 	qemu-monitor-info.texi docs/qemu-block-drivers.texi \
 	docs/qemu-cpu-models.texi docs/security.texi
 
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ QEMU Guest Agent
 M: Michael Roth <mdroth@linux.vnet.ibm.com>
 S: Maintained
 F: qga/
-F: qemu-ga.texi
+F: docs/interop/qemu-ga.rst
 F: scripts/qemu-guest-agent/
 F: tests/test-qga.c
 F: docs/interop/qemu-ga-ref.texi
diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@ todo_include_todos = False
 # with "option::" in the document being processed. Turn that off.
 suppress_warnings = ["ref.option"]
 
+# The rst_epilog fragment is effectively included in every rST file.
+# We use it to define substitutions based on build config that
+# can then be used in the documentation. The fallback if the
+# environment variable is not set is for the benefit of readthedocs
+# style document building; our Makefile always sets the variable.
+confdir = os.getenv('CONFDIR', "/etc/qemu")
+rst_epilog = ".. |CONFDIR| replace:: ``" + confdir + "``\n"
+
 # -- Options for HTML output ----------------------------------------------
 
 # The theme to use for HTML and HTML Help pages.  See the documentation for
@@ -XXX,XX +XXX,XX @@ latex_documents = [
 
 
 # -- Options for manual page output ---------------------------------------
-
-# One entry per manual page. List of tuples
-# (source start file, name, description, authors, manual section).
-man_pages = [
-    (master_doc, 'qemu', u'QEMU Documentation',
-     [author], 1)
-]
-
+# Individual manual/conf.py can override this to create man pages
+man_pages = []
 
 # -- Options for Texinfo output -------------------------------------------
 
diff --git a/docs/interop/conf.py b/docs/interop/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/conf.py
+++ b/docs/interop/conf.py
@@ -XXX,XX +XXX,XX @@ exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 # This slightly misuses the 'description', but is the best way to get
 # the manual title to appear in the sidebar.
 html_theme_options['description'] = u'System Emulation Management and Interoperability Guide'
+
+# One entry per manual page. List of tuples
+# (source start file, name, description, authors, manual section).
+man_pages = [
+    ('qemu-ga', 'qemu-ga', u'QEMU Guest Agent',
+     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8)
+]
diff --git a/docs/interop/index.rst b/docs/interop/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/index.rst
+++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
    bitmaps
    live-block-operations
    pr-helper
+   qemu-ga
    vhost-user
    vhost-user-gpu
diff --git a/docs/interop/qemu-ga.rst b/docs/interop/qemu-ga.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/interop/qemu-ga.rst
@@ -XXX,XX +XXX,XX @@
+QEMU Guest Agent
+================
+
+Synopsis
+--------
+
+**qemu-ga** [*OPTIONS*]
+
+Description
+-----------
+
+The QEMU Guest Agent is a daemon intended to be run within virtual
+machines. It allows the hypervisor host to perform various operations
+in the guest, such as:
+
+- get information from the guest
+- set the guest's system time
+- read/write a file
+- sync and freeze the filesystems
+- suspend the guest
+- reconfigure guest local processors
+- set user's password
+- ...
+
+qemu-ga will read a system configuration file on startup (located at
+|CONFDIR|\ ``/qemu-ga.conf`` by default), then parse remaining
+configuration options on the command line. For the same key, the last
+option wins, but the lists accumulate (see below for configuration
+file format).
+
+Options
+-------
+
+.. program:: qemu-ga
+
+.. option:: -m, --method=METHOD
+
+  Transport method: one of ``unix-listen``, ``virtio-serial``, or
+  ``isa-serial`` (``virtio-serial`` is the default).
+
+.. option:: -p, --path=PATH
+
+  Device/socket path (the default for virtio-serial is
+  ``/dev/virtio-ports/org.qemu.guest_agent.0``,
+  the default for isa-serial is ``/dev/ttyS0``)
+
+.. option:: -l, --logfile=PATH
+
+  Set log file path (default is stderr).
+
+.. option:: -f, --pidfile=PATH
+
+  Specify pid file (default is ``/var/run/qemu-ga.pid``).
+
+.. option:: -F, --fsfreeze-hook=PATH
+
+  Enable fsfreeze hook. Accepts an optional argument that specifies
+  script to run on freeze/thaw. Script will be called with
+  'freeze'/'thaw' arguments accordingly (default is
+  |CONFDIR|\ ``/fsfreeze-hook``). If using -F with an argument, do
+  not follow -F with a space (for example:
+  ``-F/var/run/fsfreezehook.sh``).
+
+.. option:: -t, --statedir=PATH
+
+  Specify the directory to store state information (absolute paths only,
+  default is ``/var/run``).
+
+.. option:: -v, --verbose
+
+  Log extra debugging information.
+
+.. option:: -V, --version
+
+  Print version information and exit.
+
+.. option:: -d, --daemon
+
+  Daemonize after startup (detach from terminal).
+
+.. option:: -b, --blacklist=LIST
+
+  Comma-separated list of RPCs to disable (no spaces, ``?`` to list
+  available RPCs).
+
+.. option:: -D, --dump-conf
+
+  Dump the configuration in a format compatible with ``qemu-ga.conf``
+  and exit.
+
+.. option:: -h, --help
+
+  Display this help and exit.
+
+Files
+-----
+
+
+The syntax of the ``qemu-ga.conf`` configuration file follows the
+Desktop Entry Specification, here is a quick summary: it consists of
+groups of key-value pairs, interspersed with comments.
+
+::
+
+    # qemu-ga configuration sample
+    [general]
+    daemonize = 0
+    pidfile = /var/run/qemu-ga.pid
+    verbose = 0
+    method = virtio-serial
+    path = /dev/virtio-ports/org.qemu.guest_agent.0
+    statedir = /var/run
+
+The list of keys follows the command line options:
+
+=============  ===========
+Key             Key type
+=============  ===========
+daemon         boolean
+method         string
+path           string
+logfile        string
+pidfile        string
+fsfreeze-hook  string
+statedir       string
+verbose        boolean
+blacklist      string list
+=============  ===========
+
+See also
+--------
+
+:manpage:`qemu(1)`
diff --git a/qemu-doc.texi b/qemu-doc.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@ so should only be used with trusted guest OS.
 
 @c man end
 
-@node QEMU Guest Agent
-@chapter QEMU Guest Agent invocation
-
-@include qemu-ga.texi
-
 @node QEMU User space emulator
 @chapter QEMU User space emulator
 
diff --git a/qemu-ga.texi b/qemu-ga.texi
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/qemu-ga.texi
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-@example
-@c man begin SYNOPSIS
-@command{qemu-ga} [@var{OPTIONS}]
-@c man end
-@end example
-
-@c man begin DESCRIPTION
-
-The QEMU Guest Agent is a daemon intended to be run within virtual
-machines. It allows the hypervisor host to perform various operations
-in the guest, such as:
-
-@itemize
-@item
-get information from the guest
-@item
-set the guest's system time
-@item
-read/write a file
-@item
-sync and freeze the filesystems
-@item
-suspend the guest
-@item
-reconfigure guest local processors
-@item
-set user's password
-@item
-...
-@end itemize
-
-qemu-ga will read a system configuration file on startup (located at
-@file{@value{CONFDIR}/qemu-ga.conf} by default), then parse remaining
-configuration options on the command line. For the same key, the last
-option wins, but the lists accumulate (see below for configuration
-file format).
-
-@c man end
-
-@c man begin OPTIONS
-@table @option
-@item -m, --method=@var{method}
-  Transport method: one of @samp{unix-listen}, @samp{virtio-serial}, or
-  @samp{isa-serial} (@samp{virtio-serial} is the default).
-
-@item -p, --path=@var{path}
-  Device/socket path (the default for virtio-serial is
-  @samp{/dev/virtio-ports/org.qemu.guest_agent.0},
-  the default for isa-serial is @samp{/dev/ttyS0})
-
-@item -l, --logfile=@var{path}
-  Set log file path (default is stderr).
-
-@item -f, --pidfile=@var{path}
-  Specify pid file (default is @samp{/var/run/qemu-ga.pid}).
-
-@item -F, --fsfreeze-hook=@var{path}
-  Enable fsfreeze hook. Accepts an optional argument that specifies
-  script to run on freeze/thaw. Script will be called with
-  'freeze'/'thaw' arguments accordingly (default is
-  @samp{@value{CONFDIR}/fsfreeze-hook}). If using -F with an argument, do
-  not follow -F with a space (for example:
-  @samp{-F/var/run/fsfreezehook.sh}).
-
-@item -t, --statedir=@var{path}
-  Specify the directory to store state information (absolute paths only,
-  default is @samp{/var/run}).
-
-@item -v, --verbose
-  Log extra debugging information.
-
-@item -V, --version
-  Print version information and exit.
-
-@item -d, --daemon
-  Daemonize after startup (detach from terminal).
-
-@item -b, --blacklist=@var{list}
-  Comma-separated list of RPCs to disable (no spaces, @samp{?} to list
-  available RPCs).
-
-@item -D, --dump-conf
-  Dump the configuration in a format compatible with @file{qemu-ga.conf}
-  and exit.
-
-@item -h, --help
-  Display this help and exit.
-@end table
-
-@c man end
-
-@c man begin FILES
-
-The syntax of the @file{qemu-ga.conf} configuration file follows the
-Desktop Entry Specification, here is a quick summary: it consists of
-groups of key-value pairs, interspersed with comments.
-
-@example
-# qemu-ga configuration sample
-[general]
-daemonize = 0
-pidfile = /var/run/qemu-ga.pid
-verbose = 0
-method = virtio-serial
-path = /dev/virtio-ports/org.qemu.guest_agent.0
-statedir = /var/run
-@end example
-
-The list of keys follows the command line options:
-@table @option
-@item daemon= boolean
-@item method= string
-@item path= string
-@item logfile= string
-@item pidfile= string
-@item fsfreeze-hook= string
-@item statedir= string
-@item verbose= boolean
-@item blacklist= string list
-@end table
-
-@c man end
-
-@ignore
-
-@setfilename qemu-ga
-@settitle QEMU Guest Agent
-
-@c man begin AUTHOR
-Michael Roth <mdroth@linux.vnet.ibm.com>
-@c man end
-
-@c man begin SEEALSO
-qemu(1)
-@c man end
-
-@end ignore
-- 
2.20.1