Series comparison

-[PULL 00/68] target-arm queue
+[PULL 00/36] target-arm queue
-A large arm pullreq, mostly because of 3 series:
+arm queue; dunno if this will be the last before softfreeze
- * aspeed 2600 support
+or not, but anyway probably the last large one. New orangepi-pc
- * semihosting v2.0 support
+board model is the big item here.
  * transaction-based ptimers
 thanks
 -- PMM
-The following changes since commit 22dbfdecc3c52228d3489da3fe81da92b21197bf:
+The following changes since commit 67d9ef7d541c3d21a25796c51c26da096a433565:
-  Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20191010.0' into staging (2019-10-14 15:09:08 +0100)
+  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-docs-20200312' into staging (2020-03-12 15:20:52 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191014
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200312
-for you to fetch changes up to bca1936f8f66c5f8a111569ffd14969de208bf3b:
+for you to fetch changes up to aca53be34ac3e7cac5f39396a51a338860a5a837:
-  hw/misc/bcm2835_mbox: Add trace events (2019-10-14 16:48:56 +0100)
+  target/arm: kvm: Inject events at the last stage of sync (2020-03-12 16:31:10 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Add Aspeed AST2600 SoC and board support
+ * Fix various bugs that might result in an assert() due to
- * aspeed/wdt: Check correct register for clock source
+   incorrect hflags for M-profile CPUs
- * bcm2835: code cleanups, better logging, trace events
+ * Fix Aspeed SMC Controller user-mode select handling
- * implement v2.0 of the Arm semihosting specification
+ * Report correct (with-tag) address in fault address register
- * provide new 'transaction-based' ptimer API and use it
+   when TBI is enabled
-   for the Arm devices that use ptimers
+ * cubieboard: make sure SOC object isn't leaked
- * ARM: KVM: support more than 256 CPUs
+ * fsl-imx25: Wire up eSDHC controllers
  * fsl-imx25: Wire up USB controllers
  * New board model: orangepi-pc (OrangePi PC)
  * ARM/KVM: if user doesn't select GIC version and the
    host kernel can only provide GICv3, use that, rather
    than defaulting to "fail because GICv2 isn't possible"
  * kvm: Only do KVM_SET_VCPU_EVENTS at the last stage of sync
 ----------------------------------------------------------------
-Amithash Prasad (1):
+Beata Michalska (1):
-      aspeed/wdt: Check correct register for clock source
+      target/arm: kvm: Inject events at the last stage of sync
-Cédric Le Goater (15):
+Cédric Le Goater (2):
-      aspeed/timer: Introduce an object class per SoC
+      aspeed/smc: Add some tracing
-      aspeed/timer: Add support for control register 3
+      aspeed/smc: Fix User mode select/unselect scheme
       aspeed/timer: Add AST2600 support
       aspeed/timer: Add support for IRQ status register on the AST2600
       aspeed/sdmc: Introduce an object class per SoC
       watchdog/aspeed: Introduce an object class per SoC
       aspeed/smc: Introduce segment operations
       aspeed/smc: Add AST2600 support
       aspeed/i2c: Introduce an object class per SoC
       aspeed/i2c: Add AST2600 support
       aspeed: Introduce an object class per SoC
       aspeed/soc: Add AST2600 support
       m25p80: Add support for w25q512jv
       aspeed: Add an AST2600 eval board
       aspeed: add support for the Aspeed MII controller of the AST2600
-Eddie James (1):
+Eric Auger (6):
-      hw/sd/aspeed_sdhci: New device
+      hw/arm/virt: Document 'max' value in gic-version property description
       hw/arm/virt: Introduce VirtGICType enum type
       hw/arm/virt: Introduce finalize_gic_version()
       target/arm/kvm: Let kvm_arm_vgic_probe() return a bitmap
       hw/arm/virt: kvm: Restructure finalize_gic_version()
       hw/arm/virt: kvm: allow gicv3 by default if v2 cannot work
-Eric Auger (3):
+Guenter Roeck (2):
-      linux headers: update against v5.4-rc1
+      hw/arm/fsl-imx25: Wire up eSDHC controllers
-      intc/arm_gic: Support IRQ injection for more than 256 vpus
+      hw/arm/fsl-imx25: Wire up USB controllers
       ARM: KVM: Check KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 for smp_cpus > 256
-Joel Stanley (5):
+Igor Mammedov (1):
-      hw: aspeed_scu: Add AST2600 support
+      hw/arm/cubieboard: make sure SOC object isn't leaked
       aspeed/sdmc: Add AST2600 support
       hw: wdt_aspeed: Add AST2600 support
       aspeed: Parameterise number of MACs
       aspeed/soc: Add ASPEED Video stub
-Peter Maydell (36):
+Niek Linnenbank (13):
-      ptimer: Rename ptimer_init() to ptimer_init_with_bh()
+      hw/arm: add Allwinner H3 System-on-Chip
-      ptimer: Provide new transaction-based API
+      hw/arm: add Xunlong Orange Pi PC machine
-      tests/ptimer-test: Switch to transaction-based ptimer API
+      hw/arm/allwinner-h3: add Clock Control Unit
-      hw/timer/arm_timer.c: Switch to transaction-based ptimer API
+      hw/arm/allwinner-h3: add USB host controller
-      hw/arm/musicpal.c: Switch to transaction-based ptimer API
+      hw/arm/allwinner-h3: add System Control module
-      hw/timer/allwinner-a10-pit.c: Switch to transaction-based ptimer API
+      hw/arm/allwinner: add CPU Configuration module
-      hw/timer/arm_mptimer.c: Switch to transaction-based ptimer API
+      hw/arm/allwinner: add Security Identifier device
-      hw/timer/cmsdk-apb-dualtimer.c: Switch to transaction-based ptimer API
+      hw/arm/allwinner: add SD/MMC host controller
-      hw/timer/cmsdk-apb-timer.c: Switch to transaction-based ptimer API
+      hw/arm/allwinner-h3: add EMAC ethernet device
-      hw/timer/digic-timer.c: Switch to transaction-based ptimer API
+      hw/arm/allwinner-h3: add Boot ROM support
-      hw/timer/exynos4210_mct.c: Switch GFRC to transaction-based ptimer API
+      hw/arm/allwinner-h3: add SDRAM controller device
-      hw/timer/exynos4210_mct.c: Switch LFRC to transaction-based ptimer API
+      hw/arm/allwinner: add RTC device support
-      hw/timer/exynos4210_mct.c: Switch ltick to transaction-based ptimer API
+      docs: add Orange Pi PC document
       hw/timer/exynos4210_pwm.c: Switch to transaction-based ptimer API
       hw/timer/exynos4210_rtc.c: Switch 1Hz ptimer to transaction-based API
       hw/timer/exynos4210_rtc.c: Switch main ptimer to transaction-based API
       hw/timer/imx_epit.c: Switch to transaction-based ptimer API
       hw/timer/imx_gpt.c: Switch to transaction-based ptimer API
       hw/timer/mss-timerc: Switch to transaction-based ptimer API
       hw/watchdog/cmsdk-apb-watchdog.c: Switch to transaction-based ptimer API
       hw/net/lan9118.c: Switch to transaction-based ptimer API
       target/arm/arm-semi: Capture errno in softmmu version of set_swi_errno()
       target/arm/arm-semi: Always set some kind of errno for failed calls
       target/arm/arm-semi: Correct comment about gdb syscall races
       target/arm/arm-semi: Make semihosting code hand out its own file descriptors
       target/arm/arm-semi: Restrict use of TaskState*
       target/arm/arm-semi: Use set_swi_errno() in gdbstub callback functions
       target/arm/arm-semi: Factor out implementation of SYS_CLOSE
       target/arm/arm-semi: Factor out implementation of SYS_WRITE
       target/arm/arm-semi: Factor out implementation of SYS_READ
       target/arm/arm-semi: Factor out implementation of SYS_ISTTY
       target/arm/arm-semi: Factor out implementation of SYS_SEEK
       target/arm/arm-semi: Factor out implementation of SYS_FLEN
       target/arm/arm-semi: Implement support for semihosting feature detection
       target/arm/arm-semi: Implement SH_EXT_EXIT_EXTENDED extension
       target/arm/arm-semi: Implement SH_EXT_STDOUT_STDERR extension
-Philippe Mathieu-Daudé (6):
+Peter Maydell (4):
-      hw/arm/raspi: Use the IEC binary prefix definitions
+      hw/intc/armv7m_nvic: Rebuild hflags on reset
-      hw/arm/bcm2835_peripherals: Improve logging
+      target/arm: Update hflags in trans_CPS_v7m()
-      hw/arm/bcm2835_peripherals: Name various address spaces
+      target/arm: Recalculate hflags correctly after writes to CONTROL
-      hw/arm/bcm2835: Rename some definitions
+      target/arm: Fix some comment typos
       hw/arm/bcm2835: Add various unimplemented peripherals
       hw/misc/bcm2835_mbox: Add trace events
-Rashmica Gupta (1):
+Philippe Mathieu-Daudé (5):
-      hw/gpio: Add in AST2600 specific implementation
+      tests/boot_linux_console: Add a quick test for the OrangePi PC board
       tests/boot_linux_console: Add initrd test for the Orange Pi PC board
       tests/boot_linux_console: Add a SD card test for the OrangePi PC board
       tests/boot_linux_console: Add a SLOW test booting Ubuntu on OrangePi PC
       tests/boot_linux_console: Test booting NetBSD via U-Boot on OrangePi PC
- hw/arm/Makefile.objs                          |   2 +-
+Richard Henderson (2):
- hw/sd/Makefile.objs                           |   1 +
+      target/arm: Check addresses for disabled regimes
- include/hw/arm/aspeed.h                       |   1 +
+      target/arm: Disable clean_data_tbi for system mode
  include/hw/arm/aspeed_soc.h                   |  29 +-
  include/hw/arm/bcm2835_peripherals.h          |  15 +
  include/hw/arm/raspi_platform.h               |  24 +-
  include/hw/i2c/aspeed_i2c.h                   |  20 +-
  include/hw/misc/aspeed_scu.h                  |   7 +-
  include/hw/misc/aspeed_sdmc.h                 |  20 +-
  include/hw/net/ftgmac100.h                    |  17 +
  include/hw/ptimer.h                           |  83 ++-
  include/hw/sd/aspeed_sdhci.h                  |  34 ++
  include/hw/ssi/aspeed_smc.h                   |   4 +
  include/hw/timer/aspeed_timer.h               |  18 +
  include/hw/timer/mss-timer.h                  |   1 -
  include/hw/watchdog/wdt_aspeed.h              |  19 +-
  include/standard-headers/asm-x86/bootparam.h  |   2 +
  include/standard-headers/asm-x86/kvm_para.h   |   1 +
  include/standard-headers/linux/ethtool.h      |  24 +
  include/standard-headers/linux/pci_regs.h     |  19 +-
  include/standard-headers/linux/virtio_fs.h    |  19 +
  include/standard-headers/linux/virtio_ids.h   |   2 +
  include/standard-headers/linux/virtio_iommu.h | 165 ++++++
  include/standard-headers/linux/virtio_pmem.h  |   6 +-
  linux-headers/asm-arm/kvm.h                   |  16 +-
  linux-headers/asm-arm/unistd-common.h         |   2 +
  linux-headers/asm-arm64/kvm.h                 |  21 +-
  linux-headers/asm-generic/mman-common.h       |  18 +-
  linux-headers/asm-generic/mman.h              |  10 +-
  linux-headers/asm-generic/unistd.h            |  10 +-
  linux-headers/asm-mips/mman.h                 |   3 +
  linux-headers/asm-mips/unistd_n32.h           |   1 +
  linux-headers/asm-mips/unistd_n64.h           |   1 +
  linux-headers/asm-mips/unistd_o32.h           |   1 +
  linux-headers/asm-powerpc/mman.h              |   6 +-
  linux-headers/asm-powerpc/unistd_32.h         |   2 +
  linux-headers/asm-powerpc/unistd_64.h         |   2 +
  linux-headers/asm-s390/kvm.h                  |   6 +
  linux-headers/asm-s390/unistd_32.h            |   2 +
  linux-headers/asm-s390/unistd_64.h            |   2 +
  linux-headers/asm-x86/kvm.h                   |  28 +-
  linux-headers/asm-x86/unistd.h                |   2 +-
  linux-headers/asm-x86/unistd_32.h             |   2 +
  linux-headers/asm-x86/unistd_64.h             |   2 +
  linux-headers/asm-x86/unistd_x32.h            |   2 +
  linux-headers/linux/kvm.h                     |  12 +-
  linux-headers/linux/psp-sev.h                 |   5 +-
  linux-headers/linux/vfio.h                    |  71 ++-
  target/arm/kvm_arm.h                          |   1 +
  hw/arm/aspeed.c                               |  42 +-
  hw/arm/aspeed_ast2600.c                       | 523 +++++++++++++++++++
  hw/arm/aspeed_soc.c                           | 199 +++++---
  hw/arm/bcm2835_peripherals.c                  |  38 +-
  hw/arm/bcm2836.c                              |   2 +-
  hw/arm/musicpal.c                             |  16 +-
  hw/arm/raspi.c                                |   4 +-
  hw/block/m25p80.c                             |   1 +
  hw/char/bcm2835_aux.c                         |   5 +-
  hw/core/ptimer.c                              | 154 +++++-
  hw/display/bcm2835_fb.c                       |   2 +-
  hw/dma/bcm2835_dma.c                          |  10 +-
  hw/dma/xilinx_axidma.c                        |   2 +-
  hw/gpio/aspeed_gpio.c                         | 142 +++++-
  hw/i2c/aspeed_i2c.c                           | 106 +++-
  hw/intc/arm_gic_kvm.c                         |   7 +-
  hw/intc/bcm2836_control.c                     |   7 +-
  hw/m68k/mcf5206.c                             |   2 +-
  hw/m68k/mcf5208.c                             |   2 +-
  hw/misc/aspeed_scu.c                          | 194 ++++++-
  hw/misc/aspeed_sdmc.c                         | 250 ++++++---
  hw/misc/bcm2835_mbox.c                        |  14 +-
  hw/misc/bcm2835_property.c                    |  20 +-
  hw/net/fsl_etsec/etsec.c                      |   2 +-
  hw/net/ftgmac100.c                            | 162 ++++++
  hw/net/lan9118.c                              |  11 +-
  hw/sd/aspeed_sdhci.c                          | 198 ++++++++
  hw/ssi/aspeed_smc.c                           | 177 ++++++-
  hw/timer/allwinner-a10-pit.c                  |  12 +-
  hw/timer/altera_timer.c                       |   2 +-
  hw/timer/arm_mptimer.c                        |  18 +-
  hw/timer/arm_timer.c                          |  16 +-
  hw/timer/aspeed_timer.c                       | 213 +++++++-
  hw/timer/cmsdk-apb-dualtimer.c                |  14 +-
  hw/timer/cmsdk-apb-timer.c                    |  15 +-
  hw/timer/digic-timer.c                        |  16 +-
  hw/timer/etraxfs_timer.c                      |   6 +-
  hw/timer/exynos4210_mct.c                     | 107 +++-
  hw/timer/exynos4210_pwm.c                     |  17 +-
  hw/timer/exynos4210_rtc.c                     |  22 +-
  hw/timer/grlib_gptimer.c                      |   2 +-
  hw/timer/imx_epit.c                           |  32 +-
  hw/timer/imx_gpt.c                            |  21 +-
  hw/timer/lm32_timer.c                         |   2 +-
  hw/timer/milkymist-sysctl.c                   |   4 +-
  hw/timer/mss-timer.c                          |  11 +-
  hw/timer/puv3_ost.c                           |   2 +-
  hw/timer/sh_timer.c                           |   2 +-
  hw/timer/slavio_timer.c                       |   2 +-
  hw/timer/xilinx_timer.c                       |   2 +-
  hw/watchdog/cmsdk-apb-watchdog.c              |  13 +-
  hw/watchdog/wdt_aspeed.c                      | 153 +++---
  target/arm/arm-semi.c                         | 707 +++++++++++++++++++++-----
  target/arm/cpu.c                              |  10 +-
  target/arm/kvm.c                              |  22 +-
  tests/ptimer-test.c                           | 106 +++-
  hw/misc/trace-events                          |   6 +
 files changed, 3958 insertions(+), 650 deletions(-)
  create mode 100644 include/hw/sd/aspeed_sdhci.h
  create mode 100644 include/standard-headers/linux/virtio_fs.h
  create mode 100644 include/standard-headers/linux/virtio_iommu.h
  create mode 100644 hw/arm/aspeed_ast2600.c
  create mode 100644 hw/sd/aspeed_sdhci.c
+ Makefile.objs                          |   1 +
+ hw/arm/Makefile.objs                   |   1 +
+ hw/misc/Makefile.objs                  |   5 +
+ hw/net/Makefile.objs                   |   1 +
+ hw/rtc/Makefile.objs                   |   1 +
+ hw/sd/Makefile.objs                    |   1 +
+ hw/usb/hcd-ehci.h                      |   1 +
+ include/hw/arm/allwinner-a10.h         |   4 +
+ include/hw/arm/allwinner-h3.h          | 161 ++++++
+ include/hw/arm/fsl-imx25.h             |  18 +
+ include/hw/arm/virt.h                  |  12 +-
+ include/hw/misc/allwinner-cpucfg.h     |  52 ++
+ include/hw/misc/allwinner-h3-ccu.h     |  66 +++
+ include/hw/misc/allwinner-h3-dramc.h   | 106 ++++
+ include/hw/misc/allwinner-h3-sysctrl.h |  67 +++
+ include/hw/misc/allwinner-sid.h        |  60 +++
+ include/hw/net/allwinner-sun8i-emac.h  |  99 ++++
+ include/hw/rtc/allwinner-rtc.h         | 134 +++++
+ include/hw/sd/allwinner-sdhost.h       | 135 +++++
+ target/arm/helper.h                    |   1 +
+ target/arm/kvm_arm.h                   |   3 +
+ hw/arm/allwinner-a10.c                 |  19 +
+ hw/arm/allwinner-h3.c                  | 465 ++++++++++++++++++
+ hw/arm/cubieboard.c                    |  18 +
+ hw/arm/fsl-imx25.c                     |  56 +++
+ hw/arm/imx25_pdk.c                     |  16 +
+ hw/arm/orangepi.c                      | 130 +++++
+ hw/arm/virt.c                          | 145 ++++--
+ hw/intc/armv7m_nvic.c                  |   6 +
+ hw/misc/allwinner-cpucfg.c             | 282 +++++++++++
+ hw/misc/allwinner-h3-ccu.c             | 242 +++++++++
+ hw/misc/allwinner-h3-dramc.c           | 358 ++++++++++++++
+ hw/misc/allwinner-h3-sysctrl.c         | 140 ++++++
+ hw/misc/allwinner-sid.c                | 168 +++++++
+ hw/net/allwinner-sun8i-emac.c          | 871 +++++++++++++++++++++++++++++++++
+ hw/rtc/allwinner-rtc.c                 | 411 ++++++++++++++++
+ hw/sd/allwinner-sdhost.c               | 854 ++++++++++++++++++++++++++++++++
+ hw/ssi/aspeed_smc.c                    |  56 ++-
+ hw/usb/hcd-ehci-sysbus.c               |  17 +
+ target/arm/helper.c                    |  49 +-
+ target/arm/kvm.c                       |  14 +-
+ target/arm/kvm32.c                     |  15 +-
+ target/arm/kvm64.c                     |  15 +-
+ target/arm/translate-a64.c             |  11 +
+ target/arm/translate.c                 |  14 +-
+ MAINTAINERS                            |   9 +
+ default-configs/arm-softmmu.mak        |   1 +
+ docs/system/arm/orangepi.rst           | 253 ++++++++++
+ docs/system/target-arm.rst             |   2 +
+ hw/arm/Kconfig                         |  12 +
+ hw/misc/trace-events                   |  19 +
+ hw/net/Kconfig                         |   3 +
+ hw/net/trace-events                    |  10 +
+ hw/rtc/trace-events                    |   4 +
+ hw/sd/trace-events                     |   7 +
+ hw/ssi/trace-events                    |  10 +
+ tests/acceptance/boot_linux_console.py | 230 +++++++++
+files changed, 5787 insertions(+), 74 deletions(-)
+ create mode 100644 include/hw/arm/allwinner-h3.h
+ create mode 100644 include/hw/misc/allwinner-cpucfg.h
+ create mode 100644 include/hw/misc/allwinner-h3-ccu.h
+ create mode 100644 include/hw/misc/allwinner-h3-dramc.h
+ create mode 100644 include/hw/misc/allwinner-h3-sysctrl.h
+ create mode 100644 include/hw/misc/allwinner-sid.h
+ create mode 100644 include/hw/net/allwinner-sun8i-emac.h
+ create mode 100644 include/hw/rtc/allwinner-rtc.h
+ create mode 100644 include/hw/sd/allwinner-sdhost.h
+ create mode 100644 hw/arm/allwinner-h3.c
+ create mode 100644 hw/arm/orangepi.c
+ create mode 100644 hw/misc/allwinner-cpucfg.c
+ create mode 100644 hw/misc/allwinner-h3-ccu.c
+ create mode 100644 hw/misc/allwinner-h3-dramc.c
+ create mode 100644 hw/misc/allwinner-h3-sysctrl.c
+ create mode 100644 hw/misc/allwinner-sid.c
+ create mode 100644 hw/net/allwinner-sun8i-emac.c
+ create mode 100644 hw/rtc/allwinner-rtc.c
+ create mode 100644 hw/sd/allwinner-sdhost.c
+ create mode 100644 docs/system/arm/orangepi.rst
+ create mode 100644 hw/ssi/trace-events

-[PULL 05/68] ptimer: Provide new transaction-based API
+[PULL 01/36] hw/intc/armv7m_nvic: Rebuild hflags on reset
-Provide the new transaction-based API. If a ptimer is created
+Some of an M-profile CPU's cached hflags state depends on state that's
-using ptimer_init() rather than ptimer_init_with_bh(), then
+in our NVIC object. We already do an hflags rebuild when the NVIC
-instead of providing a QEMUBH, it provides a pointer to the
+registers are written, but we also need to do this on NVIC reset,
-callback function directly, and has opted into the transaction
+because there's no guarantee that this will happen before the
-API. All calls to functions which modify ptimer state:
+CPU reset.
  - ptimer_set_period()
  - ptimer_set_freq()
  - ptimer_set_limit()
  - ptimer_set_count()
  - ptimer_run()
  - ptimer_stop()
 must be between matched calls to ptimer_transaction_begin()
 and ptimer_transaction_commit(). When ptimer_transaction_commit()
 is called it will evaluate the state of the timer after all the
 changes in the transaction, and call the callback if necessary.
-In the old API the individual update functions generally would
+This fixes an assertion due to mismatched hflags which happens if
-call ptimer_trigger() immediately, which would schedule the QEMUBH.
+the CPU is reset from inside a HardFault handler.
 In the new API the update functions will instead defer the
 "set s->next_event and call ptimer_reload()" work to
 ptimer_transaction_commit().
 Because ptimer_trigger() can now immediately call into the
 device code which may then call other ptimer functions that
 update ptimer_state fields, we must be more careful in
 ptimer_reload() not to cache fields from ptimer_state across
 the ptimer_trigger() call. (This was harmless with the QEMUBH
 mechanism as the BH would not be invoked until much later.)
 We use assertions to check that:
  * the functions modifying ptimer state are not called outside
    a transaction block
  * ptimer_transaction_begin() and _commit() calls are paired
  * the transaction API is not used with a QEMUBH ptimer
 There is some slight repetition of code:
  * most of the set functions have similar looking "if s->bh
    call ptimer_reload, otherwise set s->need_reload" code
  * ptimer_init() and ptimer_init_with_bh() have similar code
 We deliberately don't try to avoid this repetition, because
 it will all be deleted when the QEMUBH version of the API
 is removed.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-3-peter.maydell@linaro.org
+Message-id: 20200303174950.3298-2-peter.maydell@linaro.org
 ---
- include/hw/ptimer.h |  72 +++++++++++++++++++++
+ hw/intc/armv7m_nvic.c | 6 ++++++
- hw/core/ptimer.c    | 152 +++++++++++++++++++++++++++++++++++++++-----
+file changed, 6 insertions(+)
 files changed, 209 insertions(+), 15 deletions(-)
-diff --git a/include/hw/ptimer.h b/include/hw/ptimer.h
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/ptimer.h
+--- a/hw/intc/armv7m_nvic.c
-+++ b/include/hw/ptimer.h
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ typedef void (*ptimer_cb)(void *opaque);
+@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
-  */
+             s->itns[i] = true;
- ptimer_state *ptimer_init_with_bh(QEMUBH *bh, uint8_t policy_mask);
+         }
 +/**
 + * ptimer_init - Allocate and return a new ptimer
 + * @callback: function to call on ptimer expiry
 + * @callback_opaque: opaque pointer passed to @callback
 + * @policy: PTIMER_POLICY_* bits specifying behaviour
 + *
 + * The ptimer returned must be freed using ptimer_free().
 + *
 + * If a ptimer is created using this API then will use the
 + * transaction-based API for modifying ptimer state: all calls
 + * to functions which modify ptimer state:
 + *  - ptimer_set_period()
 + *  - ptimer_set_freq()
 + *  - ptimer_set_limit()
 + *  - ptimer_set_count()
 + *  - ptimer_run()
 + *  - ptimer_stop()
 + * must be between matched calls to ptimer_transaction_begin()
 + * and ptimer_transaction_commit(). When ptimer_transaction_commit()
 + * is called it will evaluate the state of the timer after all the
 + * changes in the transaction, and call the callback if necessary.
 + *
 + * The callback function is always called from within a transaction
 + * begin/commit block, so the callback should not call the
 + * ptimer_transaction_begin() function itself. If the callback changes
 + * the ptimer state such that another ptimer expiry is triggered, then
 + * the callback will be called a second time after the first call returns.
 + */
 +ptimer_state *ptimer_init(ptimer_cb callback,
 +                          void *callback_opaque,
 +                          uint8_t policy_mask);
 +
  /**
   * ptimer_free - Free a ptimer
   * @s: timer to free
@@ -XXX,XX +XXX,XX @@ ptimer_state *ptimer_init_with_bh(QEMUBH *bh, uint8_t policy_mask);
   */
  void ptimer_free(ptimer_state *s);
 +/**
 + * ptimer_transaction_begin() - Start a ptimer modification transaction
 + *
 + * This function must be called before making any calls to functions
 + * which modify the ptimer's state (see the ptimer_init() documentation
 + * for a list of these), and must always have a matched call to
 + * ptimer_transaction_commit().
 + * It is an error to call this function for a BH-based ptimer;
 + * attempting to do this will trigger an assert.
 + */
 +void ptimer_transaction_begin(ptimer_state *s);
 +
 +/**
 + * ptimer_transaction_commit() - Commit a ptimer modification transaction
 + *
 + * This function must be called after calls to functions which modify
 + * the ptimer's state, and completes the update of the ptimer. If the
 + * ptimer state now means that we should trigger the timer expiry
 + * callback, it will be called directly.
 + */
 +void ptimer_transaction_commit(ptimer_state *s);
 +
  /**
   * ptimer_set_period - Set counter increment interval in nanoseconds
   * @s: ptimer to configure
@@ -XXX,XX +XXX,XX @@ void ptimer_free(ptimer_state *s);
   * Note that if your counter behaviour is specified as having a
   * particular frequency rather than a period then ptimer_set_freq()
   * may be more appropriate.
 + *
 + * This function will assert if it is called outside a
 + * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
   */
  void ptimer_set_period(ptimer_state *s, int64_t period);
@@ -XXX,XX +XXX,XX @@ void ptimer_set_period(ptimer_state *s, int64_t period);
   * as setting the frequency then this function is more appropriate,
   * because it allows specifying an effective period which is
   * precise to fractions of a nanosecond, avoiding rounding errors.
 + *
 + * This function will assert if it is called outside a
 + * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
   */
  void ptimer_set_freq(ptimer_state *s, uint32_t freq);
@@ -XXX,XX +XXX,XX @@ uint64_t ptimer_get_limit(ptimer_state *s);
   * Set the limit value of the down-counter. The @reload flag can
   * be used to emulate the behaviour of timers which immediately
   * reload the counter when their reload register is written to.
 + *
 + * This function will assert if it is called outside a
 + * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
   */
  void ptimer_set_limit(ptimer_state *s, uint64_t limit, int reload);
@@ -XXX,XX +XXX,XX @@ uint64_t ptimer_get_count(ptimer_state *s);
   * Set the value of the down-counter. If the counter is currently
   * enabled this will arrange for a timer callback at the appropriate
   * point in the future.
 + *
 + * This function will assert if it is called outside a
 + * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
   */
  void ptimer_set_count(ptimer_state *s, uint64_t count);
@@ -XXX,XX +XXX,XX @@ void ptimer_set_count(ptimer_state *s, uint64_t count);
   * the counter value will then be reloaded from the limit and it will
   * start counting down again. If @oneshot is non-zero, then the counter
   * will disable itself when it reaches zero.
 + *
 + * This function will assert if it is called outside a
 + * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
   */
  void ptimer_run(ptimer_state *s, int oneshot);
@@ -XXX,XX +XXX,XX @@ void ptimer_run(ptimer_state *s, int oneshot);
   *
   * Note that this can cause it to "lose" time, even if it is immediately
   * restarted.
 + *
 + * This function will assert if it is called outside a
 + * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
   */
  void ptimer_stop(ptimer_state *s);
 diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/ptimer.c
 +++ b/hw/core/ptimer.c
@@ -XXX,XX +XXX,XX @@ struct ptimer_state
      uint8_t policy_mask;
      QEMUBH *bh;
      QEMUTimer *timer;
 +    ptimer_cb callback;
 +    void *callback_opaque;
 +    /*
 +     * These track whether we're in a transaction block, and if we
 +     * need to do a timer reload when the block finishes. They don't
 +     * need to be migrated because migration can never happen in the
 +     * middle of a transaction block.
 +     */
 +    bool in_transaction;
 +    bool need_reload;
  };
  /* Use a bottom-half routine to avoid reentrancy issues.  */
@@ -XXX,XX +XXX,XX @@ static void ptimer_trigger(ptimer_state *s)
      if (s->bh) {
          replay_bh_schedule_event(s->bh);
      }
 +    if (s->callback) {
 +        s->callback(s->callback_opaque);
 +    }
  }
  static void ptimer_reload(ptimer_state *s, int delta_adjust)
  {
 -    uint32_t period_frac = s->period_frac;
 -    uint64_t period = s->period;
 -    uint64_t delta = s->delta;
 +    uint32_t period_frac;
 +    uint64_t period;
 +    uint64_t delta;
      bool suppress_trigger = false;
      /*
@@ -XXX,XX +XXX,XX @@ static void ptimer_reload(ptimer_state *s, int delta_adjust)
          (s->policy_mask & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT)) {
          suppress_trigger = true;
      }
 -    if (delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)
 +    if (s->delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)
          && !suppress_trigger) {
          ptimer_trigger(s);
      }
 +    /*
 +     * Note that ptimer_trigger() might call the device callback function,
 +     * which can then modify timer state, so we must not cache any fields
 +     * from ptimer_state until after we have called it.
 +     */
 +    delta = s->delta;
 +    period = s->period;
 +    period_frac = s->period_frac;
 +
      if (delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_RELOAD)) {
          delta = s->delta = s->limit;
      }
@@ -XXX,XX +XXX,XX @@ static void ptimer_tick(void *opaque)
      ptimer_state *s = (ptimer_state *)opaque;
      bool trigger = true;
 +    /*
 +     * We perform all the tick actions within a begin/commit block
 +     * because the callback function that ptimer_trigger() calls
 +     * might make calls into the ptimer APIs that provoke another
 +     * trigger, and we want that to cause the callback function
 +     * to be called iteratively, not recursively.
 +     */
 +    ptimer_transaction_begin(s);
 +
      if (s->enabled == 2) {
          s->delta = 0;
          s->enabled = 0;
@@ -XXX,XX +XXX,XX @@ static void ptimer_tick(void *opaque)
      if (trigger) {
          ptimer_trigger(s);
      }
 +
-+    ptimer_transaction_commit(s);
++    /*
 +     * We updated state that affects the CPU's MMUidx and thus its hflags;
 +     * and we can't guarantee that we run before the CPU reset function.
 +     */
 +    arm_rebuild_hflags(&s->cpu->env);
  }
- uint64_t ptimer_get_count(ptimer_state *s)
+ static void nvic_systick_trigger(void *opaque, int n, int level)
@@ -XXX,XX +XXX,XX @@ uint64_t ptimer_get_count(ptimer_state *s)
  void ptimer_set_count(ptimer_state *s, uint64_t count)
  {
 +    assert(s->in_transaction || !s->callback);
      s->delta = count;
      if (s->enabled) {
 -        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 -        ptimer_reload(s, 0);
 +        if (!s->callback) {
 +            s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +            ptimer_reload(s, 0);
 +        } else {
 +            s->need_reload = true;
 +        }
      }
  }
@@ -XXX,XX +XXX,XX @@ void ptimer_run(ptimer_state *s, int oneshot)
  {
      bool was_disabled = !s->enabled;
 +    assert(s->in_transaction || !s->callback);
 +
      if (was_disabled && s->period == 0) {
          if (!qtest_enabled()) {
              fprintf(stderr, "Timer with period zero, disabling\n");
@@ -XXX,XX +XXX,XX @@ void ptimer_run(ptimer_state *s, int oneshot)
      }
      s->enabled = oneshot ? 2 : 1;
      if (was_disabled) {
 -        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 -        ptimer_reload(s, 0);
 +        if (!s->callback) {
 +            s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +            ptimer_reload(s, 0);
 +        } else {
 +            s->need_reload = true;
 +        }
      }
  }
@@ -XXX,XX +XXX,XX @@ void ptimer_run(ptimer_state *s, int oneshot)
     is immediately restarted.  */
  void ptimer_stop(ptimer_state *s)
  {
 +    assert(s->in_transaction || !s->callback);
 +
      if (!s->enabled)
          return;
      s->delta = ptimer_get_count(s);
      timer_del(s->timer);
      s->enabled = 0;
 +    if (s->callback) {
 +        s->need_reload = false;
 +    }
  }
  /* Set counter increment interval in nanoseconds.  */
  void ptimer_set_period(ptimer_state *s, int64_t period)
  {
 +    assert(s->in_transaction || !s->callback);
      s->delta = ptimer_get_count(s);
      s->period = period;
      s->period_frac = 0;
      if (s->enabled) {
 -        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 -        ptimer_reload(s, 0);
 +        if (!s->callback) {
 +            s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +            ptimer_reload(s, 0);
 +        } else {
 +            s->need_reload = true;
 +        }
      }
  }
  /* Set counter frequency in Hz.  */
  void ptimer_set_freq(ptimer_state *s, uint32_t freq)
  {
 +    assert(s->in_transaction || !s->callback);
      s->delta = ptimer_get_count(s);
      s->period = 1000000000ll / freq;
      s->period_frac = (1000000000ll << 32) / freq;
      if (s->enabled) {
 -        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 -        ptimer_reload(s, 0);
 +        if (!s->callback) {
 +            s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +            ptimer_reload(s, 0);
 +        } else {
 +            s->need_reload = true;
 +        }
      }
  }
@@ -XXX,XX +XXX,XX @@ void ptimer_set_freq(ptimer_state *s, uint32_t freq)
     count = limit.  */
  void ptimer_set_limit(ptimer_state *s, uint64_t limit, int reload)
  {
 +    assert(s->in_transaction || !s->callback);
      s->limit = limit;
      if (reload)
          s->delta = limit;
      if (s->enabled && reload) {
 -        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 -        ptimer_reload(s, 0);
 +        if (!s->callback) {
 +            s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +            ptimer_reload(s, 0);
 +        } else {
 +            s->need_reload = true;
 +        }
      }
  }
@@ -XXX,XX +XXX,XX @@ uint64_t ptimer_get_limit(ptimer_state *s)
      return s->limit;
  }
 +void ptimer_transaction_begin(ptimer_state *s)
 +{
 +    assert(!s->in_transaction || !s->callback);
 +    s->in_transaction = true;
 +    s->need_reload = false;
 +}
 +
 +void ptimer_transaction_commit(ptimer_state *s)
 +{
 +    assert(s->in_transaction);
 +    /*
 +     * We must loop here because ptimer_reload() can call the callback
 +     * function, which might then update ptimer state in a way that
 +     * means we need to do another reload and possibly another callback.
 +     * A disabled timer never needs reloading (and if we don't check
 +     * this then we loop forever if ptimer_reload() disables the timer).
 +     */
 +    while (s->need_reload && s->enabled) {
 +        s->need_reload = false;
 +        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        ptimer_reload(s, 0);
 +    }
 +    /* Now we've finished reload we can leave the transaction block. */
 +    s->in_transaction = false;
 +}
 +
  const VMStateDescription vmstate_ptimer = {
      .name = "ptimer",
      .version_id = 1,
@@ -XXX,XX +XXX,XX @@ ptimer_state *ptimer_init_with_bh(QEMUBH *bh, uint8_t policy_mask)
      return s;
  }
 +ptimer_state *ptimer_init(ptimer_cb callback, void *callback_opaque,
 +                          uint8_t policy_mask)
 +{
 +    ptimer_state *s;
 +
 +    /*
 +     * The callback function is mandatory; so we use it to distinguish
 +     * old-style QEMUBH ptimers from new transaction API ptimers.
 +     * (ptimer_init_with_bh() allows a NULL bh pointer and at least
 +     * one device (digic-timer) passes NULL, so it's not the case
 +     * that either s->bh != NULL or s->callback != NULL.)
 +     */
 +    assert(callback);
 +
 +    s = g_new0(ptimer_state, 1);
 +    s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ptimer_tick, s);
 +    s->policy_mask = policy_mask;
 +    s->callback = callback;
 +    s->callback_opaque = callback_opaque;
 +
 +    /*
 +     * These two policies are incompatible -- trigger-on-decrement implies
 +     * a timer trigger when the count becomes 0, but no-immediate-trigger
 +     * implies a trigger when the count stops being 0.
 +     */
 +    assert(!((policy_mask & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT) &&
 +             (policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)));
 +    return s;
 +}
 +
  void ptimer_free(ptimer_state *s)
  {
 -    qemu_bh_delete(s->bh);
 +    if (s->bh) {
 +        qemu_bh_delete(s->bh);
 +    }
      timer_free(s->timer);
      g_free(s);
  }
 --
 .20.1

-[PULL 28/68] target/arm/arm-semi: Make semihosting code hand out its own file descriptors
+[PULL 02/36] target/arm: Update hflags in trans_CPS_v7m()
-Currently the Arm semihosting code returns the guest file descriptors
+For M-profile CPUs, the FAULTMASK value affects the CPU's MMU index
-(handles) which are simply the fd values from the host OS or the
+(it changes the NegPri bit). We update the hflags after calls
-remote gdbstub. Part of the semihosting 2.0 specification requires
+to the v7m_msr helper in trans_MSR_v7m() but forgot to do so
-that we implement special handling of opening a ":semihosting-features"
+in trans_CPS_v7m().
 filename. Guest fds which result from opening the special file
 won't correspond to host fds, so to ensure that we don't end up
 with duplicate fds we need to have QEMU code control the allocation
 of the fd values we give the guest.
 Add in an abstraction layer which lets us allocate new guest FD
 values, and translate from a guest FD value back to the host one.
 This also fixes an odd hole where a semihosting guest could
 use the semihosting API to read, write or close file descriptors
 that it had never allocated but which were being used by QEMU itself.
 (This isn't a security hole, because enabling semihosting permits
 the guest to do arbitrary file access to the whole host filesystem,
 and so should only be done if the guest is completely trusted.)
 Currently the only kind of guest fd is one which maps to a
 host fd, but in a following commit we will add one which maps
 to the :semihosting-features magic data.
 If the guest is migrated with an open semihosting file descriptor
 then subsequent attempts to use the fd will all fail; this is
 not a change from the previous situation (where the host fd
 being used on the source end would not be re-opened on the
 destination end).
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190916141544.17540-5-peter.maydell@linaro.org
+Message-id: 20200303174950.3298-3-peter.maydell@linaro.org
 ---
- target/arm/arm-semi.c | 232 +++++++++++++++++++++++++++++++++++++++---
+ target/arm/translate.c | 5 ++++-
-file changed, 216 insertions(+), 16 deletions(-)
+file changed, 4 insertions(+), 1 deletion(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
+--- a/target/arm/translate.c
-+++ b/target/arm/arm-semi.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static int open_modeflags[12] = {
+@@ -XXX,XX +XXX,XX @@ static bool trans_CPS(DisasContext *s, arg_CPS *a)
-     O_RDWR | O_CREAT | O_APPEND | O_BINARY
- };
+ static bool trans_CPS_v7m(DisasContext *s, arg_CPS_v7m *a)
 +typedef enum GuestFDType {
 +    GuestFDUnused = 0,
 +    GuestFDHost = 1,
 +} GuestFDType;
 +
 +/*
 + * Guest file descriptors are integer indexes into an array of
 + * these structures (we will dynamically resize as necessary).
 + */
 +typedef struct GuestFD {
 +    GuestFDType type;
 +    int hostfd;
 +} GuestFD;
 +
 +static GArray *guestfd_array;
 +
 +/*
 + * Allocate a new guest file descriptor and return it; if we
 + * couldn't allocate a new fd then return -1.
 + * This is a fairly simplistic implementation because we don't
 + * expect that most semihosting guest programs will make very
 + * heavy use of opening and closing fds.
 + */
 +static int alloc_guestfd(void)
 +{
 +    guint i;
 +
 +    if (!guestfd_array) {
 +        /* New entries zero-initialized, i.e. type GuestFDUnused */
 +        guestfd_array = g_array_new(FALSE, TRUE, sizeof(GuestFD));
 +    }
 +
 +    for (i = 0; i < guestfd_array->len; i++) {
 +        GuestFD *gf = &g_array_index(guestfd_array, GuestFD, i);
 +
 +        if (gf->type == GuestFDUnused) {
 +            return i;
 +        }
 +    }
 +
 +    /* All elements already in use: expand the array */
 +    g_array_set_size(guestfd_array, i + 1);
 +    return i;
 +}
 +
 +/*
 + * Look up the guestfd in the data structure; return NULL
 + * for out of bounds, but don't check whether the slot is unused.
 + * This is used internally by the other guestfd functions.
 + */
 +static GuestFD *do_get_guestfd(int guestfd)
 +{
 +    if (!guestfd_array) {
 +        return NULL;
 +    }
 +
 +    if (guestfd < 0 || guestfd >= guestfd_array->len) {
 +        return NULL;
 +    }
 +
 +    return &g_array_index(guestfd_array, GuestFD, guestfd);
 +}
 +
 +/*
 + * Associate the specified guest fd (which must have been
 + * allocated via alloc_fd() and not previously used) with
 + * the specified host fd.
 + */
 +static void associate_guestfd(int guestfd, int hostfd)
 +{
 +    GuestFD *gf = do_get_guestfd(guestfd);
 +
 +    assert(gf);
 +    gf->type = GuestFDHost;
 +    gf->hostfd = hostfd;
 +}
 +
 +/*
 + * Deallocate the specified guest file descriptor. This doesn't
 + * close the host fd, it merely undoes the work of alloc_fd().
 + */
 +static void dealloc_guestfd(int guestfd)
 +{
 +    GuestFD *gf = do_get_guestfd(guestfd);
 +
 +    assert(gf);
 +    gf->type = GuestFDUnused;
 +}
 +
 +/*
 + * Given a guest file descriptor, get the associated struct.
 + * If the fd is not valid, return NULL. This is the function
 + * used by the various semihosting calls to validate a handle
 + * from the guest.
 + * Note: calling alloc_guestfd() or dealloc_guestfd() will
 + * invalidate any GuestFD* obtained by calling this function.
 + */
 +static GuestFD *get_guestfd(int guestfd)
 +{
 +    GuestFD *gf = do_get_guestfd(guestfd);
 +
 +    if (!gf || gf->type == GuestFDUnused) {
 +        return NULL;
 +    }
 +    return gf;
 +}
 +
  #ifdef CONFIG_USER_ONLY
  static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
  {
-@@ -XXX,XX +XXX,XX @@ static void arm_semi_flen_cb(CPUState *cs, target_ulong ret, target_ulong err)
+-    TCGv_i32 tmp, addr;
- #endif
++    TCGv_i32 tmp, addr, el;
- }
+     if (!arm_dc_feature(s, ARM_FEATURE_M)) {
-+static int arm_semi_open_guestfd;
+         return false;
-+
+@@ -XXX,XX +XXX,XX @@ static bool trans_CPS_v7m(DisasContext *s, arg_CPS_v7m *a)
-+static void arm_semi_open_cb(CPUState *cs, target_ulong ret, target_ulong err)
+         gen_helper_v7m_msr(cpu_env, addr, tmp);
-+{
+         tcg_temp_free_i32(addr);
-+    ARMCPU *cpu = ARM_CPU(cs);
+     }
-+    CPUARMState *env = &cpu->env;
++    el = tcg_const_i32(s->current_el);
-+#ifdef CONFIG_USER_ONLY
++    gen_helper_rebuild_hflags_m32(cpu_env, el);
-+    TaskState *ts = cs->opaque;
++    tcg_temp_free_i32(el);
-+#endif
+     tcg_temp_free_i32(tmp);
-+    if (ret == (target_ulong)-1) {
+     gen_lookup_tb(s);
-+#ifdef CONFIG_USER_ONLY
+     return true;
 +        ts->swi_errno = err;
 +#else
 +        syscall_err = err;
 +#endif
 +        dealloc_guestfd(arm_semi_open_guestfd);
 +    } else {
 +        associate_guestfd(arm_semi_open_guestfd, ret);
 +        ret = arm_semi_open_guestfd;
 +    }
 +
 +    if (is_a64(env)) {
 +        env->xregs[0] = ret;
 +    } else {
 +        env->regs[0] = ret;
 +    }
 +}
 +
  static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
                                      const char *fmt, ...)
  {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
  #else
      CPUARMState *ts = env;
  #endif
 +    GuestFD *gf;
      if (is_a64(env)) {
          /* Note that the syscall number is in W0, not X0 */
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
      switch (nr) {
      case TARGET_SYS_OPEN:
 +    {
 +        int guestfd;
 +
          GET_ARG(0);
          GET_ARG(1);
          GET_ARG(2);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
              errno = EINVAL;
              return set_swi_errno(ts, -1);
          }
 +
 +        guestfd = alloc_guestfd();
 +        if (guestfd < 0) {
 +            unlock_user(s, arg0, 0);
 +            errno = EMFILE;
 +            return set_swi_errno(ts, -1);
 +        }
 +
          if (strcmp(s, ":tt") == 0) {
              int result_fileno = arg1 < 4 ? STDIN_FILENO : STDOUT_FILENO;
 +            associate_guestfd(guestfd, result_fileno);
              unlock_user(s, arg0, 0);
 -            return result_fileno;
 +            return guestfd;
          }
          if (use_gdb_syscalls()) {
 -            ret = arm_gdb_syscall(cpu, arm_semi_cb, "open,%s,%x,1a4", arg0,
 +            arm_semi_open_guestfd = guestfd;
 +            ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
                                    (int)arg2+1, gdb_open_modeflags[arg1]);
          } else {
              ret = set_swi_errno(ts, open(s, open_modeflags[arg1], 0644));
 +            if (ret == (uint32_t)-1) {
 +                dealloc_guestfd(guestfd);
 +            } else {
 +                associate_guestfd(guestfd, ret);
 +                ret = guestfd;
 +            }
          }
          unlock_user(s, arg0, 0);
          return ret;
 +    }
      case TARGET_SYS_CLOSE:
          GET_ARG(0);
 -        if (use_gdb_syscalls()) {
 -            return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", arg0);
 -        } else {
 -            return set_swi_errno(ts, close(arg0));
 +
 +        gf = get_guestfd(arg0);
 +        if (!gf) {
 +            errno = EBADF;
 +            return set_swi_errno(ts, -1);
          }
 +
 +        if (use_gdb_syscalls()) {
 +            ret = arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
 +        } else {
 +            ret = set_swi_errno(ts, close(gf->hostfd));
 +        }
 +        dealloc_guestfd(arg0);
 +        return ret;
      case TARGET_SYS_WRITEC:
          qemu_semihosting_console_outc(env, args);
          return 0xdeadbeef;
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          GET_ARG(2);
          len = arg2;
 +
 +        gf = get_guestfd(arg0);
 +        if (!gf) {
 +            errno = EBADF;
 +            return set_swi_errno(ts, -1);
 +        }
 +
          if (use_gdb_syscalls()) {
              arm_semi_syscall_len = len;
              return arm_gdb_syscall(cpu, arm_semi_cb, "write,%x,%x,%x",
 -                                   arg0, arg1, len);
 +                                   gf->hostfd, arg1, len);
          } else {
              s = lock_user(VERIFY_READ, arg1, len, 1);
              if (!s) {
                  /* Return bytes not written on error */
                  return len;
              }
 -            ret = set_swi_errno(ts, write(arg0, s, len));
 +            ret = set_swi_errno(ts, write(gf->hostfd, s, len));
              unlock_user(s, arg1, 0);
              if (ret == (uint32_t)-1) {
                  ret = 0;
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          GET_ARG(2);
          len = arg2;
 +
 +        gf = get_guestfd(arg0);
 +        if (!gf) {
 +            errno = EBADF;
 +            return set_swi_errno(ts, -1);
 +        }
 +
          if (use_gdb_syscalls()) {
              arm_semi_syscall_len = len;
              return arm_gdb_syscall(cpu, arm_semi_cb, "read,%x,%x,%x",
 -                                   arg0, arg1, len);
 +                                   gf->hostfd, arg1, len);
          } else {
              s = lock_user(VERIFY_WRITE, arg1, len, 0);
              if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
                  return len;
              }
              do {
 -                ret = set_swi_errno(ts, read(arg0, s, len));
 +                ret = set_swi_errno(ts, read(gf->hostfd, s, len));
              } while (ret == -1 && errno == EINTR);
              unlock_user(s, arg1, len);
              if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          return 0;
      case TARGET_SYS_ISTTY:
          GET_ARG(0);
 +
 +        gf = get_guestfd(arg0);
 +        if (!gf) {
 +            errno = EBADF;
 +            return set_swi_errno(ts, -1);
 +        }
 +
          if (use_gdb_syscalls()) {
 -            return arm_gdb_syscall(cpu, arm_semi_cb, "isatty,%x", arg0);
 +            return arm_gdb_syscall(cpu, arm_semi_cb, "isatty,%x", gf->hostfd);
          } else {
 -            return isatty(arg0);
 +            return isatty(gf->hostfd);
          }
      case TARGET_SYS_SEEK:
          GET_ARG(0);
          GET_ARG(1);
 +
 +        gf = get_guestfd(arg0);
 +        if (!gf) {
 +            errno = EBADF;
 +            return set_swi_errno(ts, -1);
 +        }
 +
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "lseek,%x,%x,0",
 -                                   arg0, arg1);
 +                                   gf->hostfd, arg1);
          } else {
 -            ret = set_swi_errno(ts, lseek(arg0, arg1, SEEK_SET));
 +            ret = set_swi_errno(ts, lseek(gf->hostfd, arg1, SEEK_SET));
              if (ret == (uint32_t)-1)
                return -1;
              return 0;
          }
      case TARGET_SYS_FLEN:
          GET_ARG(0);
 +
 +        gf = get_guestfd(arg0);
 +        if (!gf) {
 +            errno = EBADF;
 +            return set_swi_errno(ts, -1);
 +        }
 +
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_flen_cb, "fstat,%x,%x",
 -                                   arg0, arm_flen_buf(cpu));
 +                                   gf->hostfd, arm_flen_buf(cpu));
          } else {
              struct stat buf;
 -            ret = set_swi_errno(ts, fstat(arg0, &buf));
 +            ret = set_swi_errno(ts, fstat(gf->hostfd, &buf));
              if (ret == (uint32_t)-1)
                  return -1;
              return buf.st_size;
 --
 .20.1

-[PULL 20/68] hw/timer/imx_epit.c: Switch to transaction-based ptimer API
+[PULL 03/36] target/arm: Recalculate hflags correctly after writes to CONTROL
-Switch the imx_epit.c code away from bottom-half based ptimers to
+A write to the CONTROL register can change our current EL (by
-the new transaction-based ptimer API.  This just requires adding
+writing to the nPRIV bit). That means that we can't assume
-begin/commit calls around the various places that modify the ptimer
+that s->current_el is still valid in trans_MSR_v7m() when
-state, and using the new ptimer_init() function to create the timer.
+we try to rebuild the hflags.
 Add a new helper rebuild_hflags_m32_newel() which, like the
 existing rebuild_hflags_a32_newel(), recalculates the current
 EL from scratch, and use it in trans_MSR_v7m().
 This fixes an assertion about an hflags mismatch when the
 guest changes privilege by writing to CONTROL.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-18-peter.maydell@linaro.org
+Message-id: 20200303174950.3298-4-peter.maydell@linaro.org
 ---
- hw/timer/imx_epit.c | 32 +++++++++++++++++++++++++++-----
+ target/arm/helper.h    |  1 +
-file changed, 27 insertions(+), 5 deletions(-)
+ target/arm/helper.c    | 12 ++++++++++++
  target/arm/translate.c |  7 +++----
 files changed, 16 insertions(+), 4 deletions(-)
-diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/imx_epit.c
+--- a/target/arm/helper.h
-+++ b/hw/timer/imx_epit.c
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(msr_banked, void, env, i32, i32, i32)
- #include "migration/vmstate.h"
+ DEF_HELPER_2(get_user_reg, i32, env, i32)
- #include "hw/irq.h"
+ DEF_HELPER_3(set_user_reg, void, env, i32, i32)
- #include "hw/misc/imx_ccm.h"
--#include "qemu/main-loop.h"
++DEF_HELPER_FLAGS_1(rebuild_hflags_m32_newel, TCG_CALL_NO_RWG, void, env)
- #include "qemu/module.h"
+ DEF_HELPER_FLAGS_2(rebuild_hflags_m32, TCG_CALL_NO_RWG, void, env, int)
- #include "qemu/log.h"
+ DEF_HELPER_FLAGS_1(rebuild_hflags_a32_newel, TCG_CALL_NO_RWG, void, env)
+ DEF_HELPER_FLAGS_2(rebuild_hflags_a32, TCG_CALL_NO_RWG, void, env, int)
-@@ -XXX,XX +XXX,XX @@ static void imx_epit_update_int(IMXEPITState *s)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
-     }
+index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_rebuild_hflags(CPUARMState *env)
      env->hflags = rebuild_hflags_internal(env);
  }
 +/*
-+ * Must be called from within a ptimer_transaction_begin/commit block
++ * If we have triggered a EL state change we can't rely on the
-+ * for both s->timer_cmp and s->timer_reload.
++ * translator having passed it to us, we need to recompute.
 + */
- static void imx_epit_set_freq(IMXEPITState *s)
++void HELPER(rebuild_hflags_m32_newel)(CPUARMState *env)
  {
      uint32_t clksrc;
@@ -XXX,XX +XXX,XX @@ static void imx_epit_reset(DeviceState *dev)
      s->lr = EPIT_TIMER_MAX;
      s->cmp = 0;
      s->cnt = 0;
 +    ptimer_transaction_begin(s->timer_cmp);
 +    ptimer_transaction_begin(s->timer_reload);
      /* stop both timers */
      ptimer_stop(s->timer_cmp);
      ptimer_stop(s->timer_reload);
@@ -XXX,XX +XXX,XX @@ static void imx_epit_reset(DeviceState *dev)
          /* if the timer is still enabled, restart it */
          ptimer_run(s->timer_reload, 0);
      }
 +    ptimer_transaction_commit(s->timer_cmp);
 +    ptimer_transaction_commit(s->timer_reload);
  }
  static uint32_t imx_epit_update_count(IMXEPITState *s)
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_epit_read(void *opaque, hwaddr offset, unsigned size)
      return reg_value;
  }
 +/* Must be called from ptimer_transaction_begin/commit block for s->timer_cmp */
  static void imx_epit_reload_compare_timer(IMXEPITState *s)
  {
      if ((s->cr & (CR_EN | CR_OCIEN)) == (CR_EN | CR_OCIEN))  {
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
      switch (offset >> 2) {
      case 0: /* CR */
 +        ptimer_transaction_begin(s->timer_cmp);
 +        ptimer_transaction_begin(s->timer_reload);
          oldcr = s->cr;
          s->cr = value & 0x03ffffff;
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
          } else {
              ptimer_stop(s->timer_cmp);
          }
 +
 +        ptimer_transaction_commit(s->timer_cmp);
 +        ptimer_transaction_commit(s->timer_reload);
          break;
      case 1: /* SR - ACK*/
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
      case 2: /* LR - set ticks */
          s->lr = value;
 +        ptimer_transaction_begin(s->timer_cmp);
 +        ptimer_transaction_begin(s->timer_reload);
          if (s->cr & CR_RLD) {
              /* Also set the limit if the LRD bit is set */
              /* If IOVW bit is set then set the timer value */
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
          }
          imx_epit_reload_compare_timer(s);
 +        ptimer_transaction_commit(s->timer_cmp);
 +        ptimer_transaction_commit(s->timer_reload);
          break;
      case 3: /* CMP */
          s->cmp = value;
 +        ptimer_transaction_begin(s->timer_cmp);
          imx_epit_reload_compare_timer(s);
 +        ptimer_transaction_commit(s->timer_cmp);
          break;
@@ -XXX,XX +XXX,XX @@ static void imx_epit_cmp(void *opaque)
      imx_epit_update_int(s);
  }
 +static void imx_epit_reload(void *opaque)
 +{
-+    /* No action required on rollover of timer_reload */
++    int el = arm_current_el(env);
 +    int fp_el = fp_exception_el(env, el);
 +    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
 +    env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
 +}
 +
- static const MemoryRegionOps imx_epit_ops = {
+ void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
      .read = imx_epit_read,
      .write = imx_epit_write,
@@ -XXX,XX +XXX,XX @@ static void imx_epit_realize(DeviceState *dev, Error **errp)
  {
-     IMXEPITState *s = IMX_EPIT(dev);
+     int fp_el = fp_exception_el(env, el);
-     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+diff --git a/target/arm/translate.c b/target/arm/translate.c
--    QEMUBH *bh;
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
-     DPRINTF("\n");
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_MRS_v7m(DisasContext *s, arg_MRS_v7m *a)
-@@ -XXX,XX +XXX,XX @@ static void imx_epit_realize(DeviceState *dev, Error **errp)
-x00001000);
+ static bool trans_MSR_v7m(DisasContext *s, arg_MSR_v7m *a)
-     sysbus_init_mmio(sbd, &s->iomem);
+ {
+-    TCGv_i32 addr, reg, el;
--    s->timer_reload = ptimer_init_with_bh(NULL, PTIMER_POLICY_DEFAULT);
++    TCGv_i32 addr, reg;
-+    s->timer_reload = ptimer_init(imx_epit_reload, s, PTIMER_POLICY_DEFAULT);
+     if (!arm_dc_feature(s, ARM_FEATURE_M)) {
--    bh = qemu_bh_new(imx_epit_cmp, s);
+         return false;
--    s->timer_cmp = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+@@ -XXX,XX +XXX,XX @@ static bool trans_MSR_v7m(DisasContext *s, arg_MSR_v7m *a)
-+    s->timer_cmp = ptimer_init(imx_epit_cmp, s, PTIMER_POLICY_DEFAULT);
+     gen_helper_v7m_msr(cpu_env, addr, reg);
      tcg_temp_free_i32(addr);
      tcg_temp_free_i32(reg);
 -    el = tcg_const_i32(s->current_el);
 -    gen_helper_rebuild_hflags_m32(cpu_env, el);
 -    tcg_temp_free_i32(el);
 +    /* If we wrote to CONTROL, the EL might have changed */
 +    gen_helper_rebuild_hflags_m32_newel(cpu_env);
      gen_lookup_tb(s);
      return true;
  }
- static void imx_epit_class_init(ObjectClass *klass, void *data)
 --
 .20.1

-[PULL 15/68] hw/timer/exynos4210_mct.c: Switch LFRC to transaction-based ptimer API
+[PULL 04/36] target/arm: Fix some comment typos
-Switch the exynos MCT LFRC timers over to the ptimer transaction API.
+Fix a couple of comment typos.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-13-peter.maydell@linaro.org
+Message-id: 20200303174950.3298-5-peter.maydell@linaro.org
 ---
- hw/timer/exynos4210_mct.c | 27 +++++++++++++++++++++++----
+ target/arm/helper.c    | 2 +-
-file changed, 23 insertions(+), 4 deletions(-)
+ target/arm/translate.c | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
+--- a/target/arm/helper.c
-+++ b/hw/timer/exynos4210_mct.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_lfrc_get_count(Exynos4210MCTLT *s)
+@@ -XXX,XX +XXX,XX @@ void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
  /*
-  * Set counter of FRC local timer.
+  * If we have triggered a EL state change we can't rely on the
-+ * Must be called from within exynos4210_lfrc_tx_begin/commit block.
+- * translator having passed it too us, we need to recompute.
 + * translator having passed it to us, we need to recompute.
   */
- static void exynos4210_lfrc_update_count(Exynos4210MCTLT *s)
+ void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env)
  {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_lfrc_update_count(Exynos4210MCTLT *s)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
- /*
+--- a/target/arm/translate.c
-  * Start local FRC timer
++++ b/target/arm/translate.c
-+ * Must be called from within exynos4210_lfrc_tx_begin/commit block.
+@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
-  */
- static void exynos4210_lfrc_start(Exynos4210MCTLT *s)
+         if (!isread && !(ri->type & ARM_CP_SUPPRESS_TB_END)) {
- {
+             /*
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_lfrc_start(Exynos4210MCTLT *s)
+-             * A write to any coprocessor regiser that ends a TB
++             * A write to any coprocessor register that ends a TB
- /*
+              * must rebuild the hflags for the next TB.
-  * Stop local FRC timer
+              */
-+ * Must be called from within exynos4210_lfrc_tx_begin/commit block.
+             TCGv_i32 tcg_el = tcg_const_i32(s->current_el);
   */
  static void exynos4210_lfrc_stop(Exynos4210MCTLT *s)
  {
      ptimer_stop(s->ptimer_frc);
  }
 +/* Start ptimer transaction for local FRC timer */
 +static void exynos4210_lfrc_tx_begin(Exynos4210MCTLT *s)
 +{
 +    ptimer_transaction_begin(s->ptimer_frc);
 +}
 +
 +/* Commit ptimer transaction for local FRC timer */
 +static void exynos4210_lfrc_tx_commit(Exynos4210MCTLT *s)
 +{
 +    ptimer_transaction_commit(s->ptimer_frc);
 +}
 +
  /*
   * Local timer free running counter tick handler
   */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
          /* local timer */
          ptimer_set_freq(s->l_timer[0].tick_timer.ptimer_tick, s->freq);
 -        ptimer_set_freq(s->l_timer[0].ptimer_frc, s->freq);
 +        tx_ptimer_set_freq(s->l_timer[0].ptimer_frc, s->freq);
          ptimer_set_freq(s->l_timer[1].tick_timer.ptimer_tick, s->freq);
 -        ptimer_set_freq(s->l_timer[1].ptimer_frc, s->freq);
 +        tx_ptimer_set_freq(s->l_timer[1].ptimer_frc, s->freq);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_reset(DeviceState *d)
          s->l_timer[i].tick_timer.count = 0;
          s->l_timer[i].tick_timer.distance = 0;
          s->l_timer[i].tick_timer.progress = 0;
 +        exynos4210_lfrc_tx_begin(&s->l_timer[i]);
          ptimer_stop(s->l_timer[i].ptimer_frc);
 +        exynos4210_lfrc_tx_commit(&s->l_timer[i]);
          exynos4210_ltick_timer_init(&s->l_timer[i].tick_timer);
      }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
          }
          /* Start or Stop local FRC if TCON changed */
 +        exynos4210_lfrc_tx_begin(&s->l_timer[lt_i]);
          if ((value & L_TCON_FRC_START) >
          (s->l_timer[lt_i].reg.tcon & L_TCON_FRC_START)) {
              DPRINTF("local timer[%d] start frc\n", lt_i);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
              DPRINTF("local timer[%d] stop frc\n", lt_i);
              exynos4210_lfrc_stop(&s->l_timer[lt_i]);
          }
 +        exynos4210_lfrc_tx_commit(&s->l_timer[lt_i]);
          break;
      case L0_TCNTB: case L1_TCNTB:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
      /* Local timers */
      for (i = 0; i < 2; i++) {
          bh[0] = qemu_bh_new(exynos4210_ltick_event, &s->l_timer[i]);
 -        bh[1] = qemu_bh_new(exynos4210_lfrc_event, &s->l_timer[i]);
          s->l_timer[i].tick_timer.ptimer_tick =
              ptimer_init_with_bh(bh[0], PTIMER_POLICY_DEFAULT);
          s->l_timer[i].ptimer_frc =
 -            ptimer_init_with_bh(bh[1], PTIMER_POLICY_DEFAULT);
 +            ptimer_init(exynos4210_lfrc_event, &s->l_timer[i],
 +                        PTIMER_POLICY_DEFAULT);
          s->l_timer[i].id = i;
      }
 --
 .20.1

-[PULL 52/68] aspeed/smc: Add AST2600 support
+[PULL 05/36] aspeed/smc: Add some tracing
 From: Cédric Le Goater <clg@kaod.org>
-The AST2600 SoC SMC controller is a SPI only controller now and has a
-few extensions which we will need to take into account when SW
-requires it. This is enough to support u-boot and Linux.
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Acked-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
-Message-id: 20190925143248.10000-14-clg@kaod.org
+Reviewed-by: Joel Stanley <joel@jms.id.au>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20200206112645.21275-2-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/ssi/aspeed_smc.c | 132 ++++++++++++++++++++++++++++++++++++++++++--
+ Makefile.objs       |  1 +
-file changed, 128 insertions(+), 4 deletions(-)
+ hw/ssi/aspeed_smc.c | 17 +++++++++++++++++
  hw/ssi/trace-events |  9 +++++++++
 files changed, 27 insertions(+)
  create mode 100644 hw/ssi/trace-events
+diff --git a/Makefile.objs b/Makefile.objs
+index XXXXXXX..XXXXXXX 100644
+--- a/Makefile.objs
++++ b/Makefile.objs
+@@ -XXX,XX +XXX,XX @@ trace-events-subdirs += hw/scsi
+ trace-events-subdirs += hw/sd
+ trace-events-subdirs += hw/sparc
+ trace-events-subdirs += hw/sparc64
++trace-events-subdirs += hw/ssi
+ trace-events-subdirs += hw/timer
+ trace-events-subdirs += hw/tpm
+ trace-events-subdirs += hw/usb
 diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/aspeed_smc.c
 +++ b/hw/ssi/aspeed_smc.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/error-report.h"
  #include "qapi/error.h"
  #include "exec/address-spaces.h"
-+#include "qemu/units.h"
+ #include "qemu/units.h"
 +#include "trace.h"
  #include "hw/irq.h"
  #include "hw/qdev-properties.h"
+@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
+     s->ctrl->reg_to_segment(s, new, &seg);
++    trace_aspeed_smc_flash_set_segment(cs, new, seg.addr, seg.addr + seg.size);
++
+     /* The start address of CS0 is read-only */
+     if (cs == 0 && seg.addr != s->ctrl->flash_window_base) {
+         qemu_log_mask(LOG_GUEST_ERROR,
+@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
+                       __func__, aspeed_smc_flash_mode(fl));
+     }
++    trace_aspeed_smc_flash_read(fl->id, addr, size, ret,
++                                aspeed_smc_flash_mode(fl));
+     return ret;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl,  uint64_t data,
+     AspeedSMCState *s = fl->controller;
+     uint8_t addr_width = aspeed_smc_flash_is_4byte(fl) ? 4 : 3;
++    trace_aspeed_smc_do_snoop(fl->id, s->snoop_index, s->snoop_dummies,
++                              (uint8_t) data & 0xff);
++
+     if (s->snoop_index == SNOOP_OFF) {
+         return false; /* Do nothing */
+@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
+     AspeedSMCState *s = fl->controller;
+     int i;
++    trace_aspeed_smc_flash_write(fl->id, addr, size, data,
++                                 aspeed_smc_flash_mode(fl));
++
+     if (!aspeed_smc_is_writable(fl)) {
+         qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%"
+                       HWADDR_PRIx "\n", __func__, addr);
+@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
+         (s->ctrl->has_dma && addr == R_DMA_CHECKSUM) ||
+         (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) ||
+         (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->ctrl->max_slaves)) {
++
++        trace_aspeed_smc_read(addr, size, s->regs[addr]);
++
+         return s->regs[addr];
+     } else {
+         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
+@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_checksum(AspeedSMCState *s)
+                           __func__, s->regs[R_DMA_FLASH_ADDR]);
+             return;
+         }
++        trace_aspeed_smc_dma_checksum(s->regs[R_DMA_FLASH_ADDR], data);
+         /*
+          * When the DMA is on-going, the DMA registers are updated
+@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
+     addr >>= 2;
++    trace_aspeed_smc_write(addr, size, data);
++
+     if (addr == s->r_conf ||
+         (addr >= s->r_timings &&
+          addr < s->r_timings + s->ctrl->nregs_timings) ||
+diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/hw/ssi/trace-events
 @@ -XXX,XX +XXX,XX @@
- #define   CONF_FLASH_TYPE0     0
++# aspeed_smc.c
  #define      CONF_FLASH_TYPE_NOR   0x0
  #define      CONF_FLASH_TYPE_NAND  0x1
 -#define      CONF_FLASH_TYPE_SPI   0x2
 +#define      CONF_FLASH_TYPE_SPI   0x2 /* AST2600 is SPI only */
  /* CE Control Register */
  #define R_CE_CTRL            (0x04 / 4)
@@ -XXX,XX +XXX,XX @@
  /* CEx Control Register */
  #define R_CTRL0           (0x10 / 4)
 +#define   CTRL_IO_QPI              (1 << 31)
 +#define   CTRL_IO_QUAD_DATA        (1 << 30)
  #define   CTRL_IO_DUAL_DATA        (1 << 29)
  #define   CTRL_IO_DUAL_ADDR_DATA   (1 << 28) /* Includes dummies */
 +#define   CTRL_IO_QUAD_ADDR_DATA   (1 << 28) /* Includes dummies */
  #define   CTRL_CMD_SHIFT           16
  #define   CTRL_CMD_MASK            0xff
  #define   CTRL_DUMMY_HIGH_SHIFT    14
@@ -XXX,XX +XXX,XX @@
  /* Misc Control Register #2 */
  #define R_TIMINGS         (0x94 / 4)
 -/* SPI controller registers and bits */
 +/* SPI controller registers and bits (AST2400) */
  #define R_SPI_CONF        (0x00 / 4)
  #define   SPI_CONF_ENABLE_W0   0
  #define R_SPI_CTRL0       (0x4 / 4)
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
  static void aspeed_smc_reg_to_segment(const AspeedSMCState *s, uint32_t reg,
                                        AspeedSegments *seg);
 +/*
 + * AST2600 definitions
 + */
 +#define ASPEED26_SOC_FMC_FLASH_BASE   0x20000000
 +#define ASPEED26_SOC_SPI_FLASH_BASE   0x30000000
 +#define ASPEED26_SOC_SPI2_FLASH_BASE  0x50000000
 +
-+static const AspeedSegments aspeed_segments_ast2600_fmc[] = {
++aspeed_smc_flash_set_segment(int cs, uint64_t reg, uint64_t start, uint64_t end) "CS%d segreg=0x%"PRIx64" [ 0x%"PRIx64" - 0x%"PRIx64" ]"
-+    { 0x0, 128 * MiB }, /* start address is readonly */
++aspeed_smc_flash_read(int cs, uint64_t addr,  uint32_t size, uint64_t data, int mode) "CS%d @0x%" PRIx64 " size %u: 0x%" PRIx64" mode:%d"
-+    { 0x0, 0 }, /* disabled */
++aspeed_smc_do_snoop(int cs, int index, int dummies, int data) "CS%d index:0x%x dummies:%d data:0x%x"
-+    { 0x0, 0 }, /* disabled */
++aspeed_smc_flash_write(int cs, uint64_t addr,  uint32_t size, uint64_t data, int mode) "CS%d @0x%" PRIx64 " size %u: 0x%" PRIx64" mode:%d"
-+};
++aspeed_smc_read(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
-+
++aspeed_smc_dma_checksum(uint32_t addr, uint32_t data) "0x%08x: 0x%08x"
-+static const AspeedSegments aspeed_segments_ast2600_spi1[] = {
++aspeed_smc_write(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
 +    { 0x0, 128 * MiB }, /* start address is readonly */
 +    { 0x0, 0 }, /* disabled */
 +};
 +
 +static const AspeedSegments aspeed_segments_ast2600_spi2[] = {
 +    { 0x0, 128 * MiB }, /* start address is readonly */
 +    { 0x0, 0 }, /* disabled */
 +    { 0x0, 0 }, /* disabled */
 +};
 +
 +static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s,
 +                                               const AspeedSegments *seg);
 +static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s,
 +                                           uint32_t reg, AspeedSegments *seg);
 +
  static const AspeedSMCController controllers[] = {
      {
          .name              = "aspeed.smc-ast2400",
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .nregs             = ASPEED_SMC_R_MAX,
          .segment_to_reg    = aspeed_smc_segment_to_reg,
          .reg_to_segment    = aspeed_smc_reg_to_segment,
 +    }, {
 +        .name              = "aspeed.fmc-ast2600",
 +        .r_conf            = R_CONF,
 +        .r_ce_ctrl         = R_CE_CTRL,
 +        .r_ctrl0           = R_CTRL0,
 +        .r_timings         = R_TIMINGS,
 +        .conf_enable_w0    = CONF_ENABLE_W0,
 +        .max_slaves        = 3,
 +        .segments          = aspeed_segments_ast2600_fmc,
 +        .flash_window_base = ASPEED26_SOC_FMC_FLASH_BASE,
 +        .flash_window_size = 0x10000000,
 +        .has_dma           = true,
 +        .nregs             = ASPEED_SMC_R_MAX,
 +        .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
 +        .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
 +    }, {
 +        .name              = "aspeed.spi1-ast2600",
 +        .r_conf            = R_CONF,
 +        .r_ce_ctrl         = R_CE_CTRL,
 +        .r_ctrl0           = R_CTRL0,
 +        .r_timings         = R_TIMINGS,
 +        .conf_enable_w0    = CONF_ENABLE_W0,
 +        .max_slaves        = 2,
 +        .segments          = aspeed_segments_ast2600_spi1,
 +        .flash_window_base = ASPEED26_SOC_SPI_FLASH_BASE,
 +        .flash_window_size = 0x10000000,
 +        .has_dma           = false,
 +        .nregs             = ASPEED_SMC_R_MAX,
 +        .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
 +        .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
 +    }, {
 +        .name              = "aspeed.spi2-ast2600",
 +        .r_conf            = R_CONF,
 +        .r_ce_ctrl         = R_CE_CTRL,
 +        .r_ctrl0           = R_CTRL0,
 +        .r_timings         = R_TIMINGS,
 +        .conf_enable_w0    = CONF_ENABLE_W0,
 +        .max_slaves        = 3,
 +        .segments          = aspeed_segments_ast2600_spi2,
 +        .flash_window_base = ASPEED26_SOC_SPI2_FLASH_BASE,
 +        .flash_window_size = 0x10000000,
 +        .has_dma           = false,
 +        .nregs             = ASPEED_SMC_R_MAX,
 +        .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
 +        .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
      },
  };
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reg_to_segment(const AspeedSMCState *s,
      seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
  }
 +/*
 + * The Segment Registers of the AST2600 have a 1MB unit. The address
 + * range of a flash SPI slave is encoded with offsets in the overall
 + * controller window. The previous SoC AST2400 and AST2500 used
 + * absolute addresses. Only bits [27:20] are relevant and the end
 + * address is an upper bound limit.
 + */
 +#define AST2600_SEG_ADDR_MASK 0x0ff00000
 +
 +static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s,
 +                                               const AspeedSegments *seg)
 +{
 +    uint32_t reg = 0;
 +
 +    /* Disabled segments have a nil register */
 +    if (!seg->size) {
 +        return 0;
 +    }
 +
 +    reg |= (seg->addr & AST2600_SEG_ADDR_MASK) >> 16; /* start offset */
 +    reg |= (seg->addr + seg->size - 1) & AST2600_SEG_ADDR_MASK; /* end offset */
 +    return reg;
 +}
 +
 +static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s,
 +                                           uint32_t reg, AspeedSegments *seg)
 +{
 +    uint32_t start_offset = (reg << 16) & AST2600_SEG_ADDR_MASK;
 +    uint32_t end_offset = reg & AST2600_SEG_ADDR_MASK;
 +
 +    seg->addr = s->ctrl->flash_window_base + start_offset;
 +    seg->size = end_offset + MiB - start_offset;
 +}
 +
  static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
                                       const AspeedSegments *new,
                                       int cs)
@@ -XXX,XX +XXX,XX @@ static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
      const AspeedSMCState *s = fl->controller;
      int cmd = (s->regs[s->r_ctrl0 + fl->id] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
 -    /* In read mode, the default SPI command is READ (0x3). In other
 -     * modes, the command should necessarily be defined */
 +    /*
 +     * In read mode, the default SPI command is READ (0x3). In other
 +     * modes, the command should necessarily be defined
 +     *
 +     * TODO: add support for READ4 (0x13) on AST2600
 +     */
      if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
          cmd = SPI_OP_READ;
      }
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reset(DeviceState *d)
              s->ctrl->segment_to_reg(s, &s->ctrl->segments[i]);
      }
 +    /* HW strapping flash type for the AST2600 controllers  */
 +    if (s->ctrl->segments == aspeed_segments_ast2600_fmc) {
 +        /* flash type is fixed to SPI for all */
 +        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0);
 +        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1);
 +        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE2);
 +    }
 +
      /* HW strapping flash type for FMC controllers  */
      if (s->ctrl->segments == aspeed_segments_ast2500_fmc) {
          /* flash type is fixed to SPI for CE0 and CE1 */
 --
 .20.1

-[PULL 51/68] aspeed/smc: Introduce segment operations
+[PULL 06/36] aspeed/smc: Fix User mode select/unselect scheme
 From: Cédric Le Goater <clg@kaod.org>
-AST2600 will use a different encoding for the addresses defined in the
+The Aspeed SMC Controller can operate in different modes : Read, Fast
-Segment Register.
+Read, Write and User modes. When the User mode is configured, it
 selects automatically the SPI slave device until the CE_STOP_ACTIVE
 bit is set to 1. When any other modes are configured the device is
 unselected. The HW logic handles the chip select automatically when
 the flash is accessed through its AHB window.
+When configuring the CEx Control Register, the User mode logic to
+select and unselect the slave is incorrect and data corruption can be
+seen on machines using two chips, witherspoon and romulus.
+Rework the handler setting the CEx Control Register to fix this issue.
+Fixes: 7c1c69bca43c ("ast2400: add SMC controllers (FMC and SPI)")
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Acked-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
-Message-id: 20190925143248.10000-13-clg@kaod.org
+Message-id: 20200206112645.21275-3-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/ssi/aspeed_smc.h |  4 ++++
+ hw/ssi/aspeed_smc.c | 39 +++++++++++++++++++++++----------------
- hw/ssi/aspeed_smc.c         | 45 ++++++++++++++++++++++++-------------
+ hw/ssi/trace-events |  1 +
-files changed, 34 insertions(+), 15 deletions(-)
+files changed, 24 insertions(+), 16 deletions(-)
-diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/ssi/aspeed_smc.h
-+++ b/include/hw/ssi/aspeed_smc.h
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCController {
-     hwaddr dma_flash_mask;
-     hwaddr dma_dram_mask;
-     uint32_t nregs;
-+    uint32_t (*segment_to_reg)(const struct AspeedSMCState *s,
-+                               const AspeedSegments *seg);
-+    void (*reg_to_segment)(const struct AspeedSMCState *s, uint32_t reg,
-+                           AspeedSegments *seg);
- } AspeedSMCController;
- typedef struct AspeedSMCFlash {
 diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/aspeed_smc.c
 +++ b/hw/ssi/aspeed_smc.c
-@@ -XXX,XX +XXX,XX @@ static const AspeedSegments aspeed_segments_ast2500_spi2[] = {
+@@ -XXX,XX +XXX,XX @@ static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl)
-     { 0x38000000, 32 * 1024 * 1024 }, /* start address is readonly */
+     }
-     { 0x3A000000, 96 * 1024 * 1024 }, /* end address is readonly */
+ }
- };
-+static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
+-static inline bool aspeed_smc_is_ce_stop_active(const AspeedSMCFlash *fl)
-+                                          const AspeedSegments *seg);
++static void aspeed_smc_flash_do_select(AspeedSMCFlash *fl, bool unselect)
-+static void aspeed_smc_reg_to_segment(const AspeedSMCState *s, uint32_t reg,
+ {
-+                                      AspeedSegments *seg);
+-    const AspeedSMCState *s = fl->controller;
++    AspeedSMCState *s = fl->controller;
- static const AspeedSMCController controllers[] = {
-     {
+-    return s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE;
-@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
++    trace_aspeed_smc_flash_select(fl->id, unselect ? "un" : "");
-         .flash_window_size = 0x6000000,
++
-         .has_dma           = false,
++    qemu_set_irq(s->cs_lines[fl->id], unselect);
-         .nregs             = ASPEED_SMC_R_SMC_MAX,
+ }
-+        .segment_to_reg    = aspeed_smc_segment_to_reg,
-+        .reg_to_segment    = aspeed_smc_reg_to_segment,
+ static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
-     }, {
+ {
-         .name              = "aspeed.fmc-ast2400",
+-    AspeedSMCState *s = fl->controller;
-         .r_conf            = R_CONF,
+-
-@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
+-    s->regs[s->r_ctrl0 + fl->id] &= ~CTRL_CE_STOP_ACTIVE;
-         .dma_flash_mask    = 0x0FFFFFFC,
+-    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
-         .dma_dram_mask     = 0x1FFFFFFC,
++    aspeed_smc_flash_do_select(fl, false);
-         .nregs             = ASPEED_SMC_R_MAX,
+ }
-+        .segment_to_reg    = aspeed_smc_segment_to_reg,
-+        .reg_to_segment    = aspeed_smc_reg_to_segment,
+ static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
-     }, {
+ {
-         .name              = "aspeed.spi1-ast2400",
+-    AspeedSMCState *s = fl->controller;
-         .r_conf            = R_SPI_CONF,
+-
-@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
+-    s->regs[s->r_ctrl0 + fl->id] |= CTRL_CE_STOP_ACTIVE;
-         .flash_window_size = 0x10000000,
+-    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
-         .has_dma           = false,
++    aspeed_smc_flash_do_select(fl, true);
-         .nregs             = ASPEED_SMC_R_SPI_MAX,
+ }
-+        .segment_to_reg    = aspeed_smc_segment_to_reg,
-+        .reg_to_segment    = aspeed_smc_reg_to_segment,
+ static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
-     }, {
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_smc_flash_ops = {
          .name              = "aspeed.fmc-ast2500",
          .r_conf            = R_CONF,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .dma_flash_mask    = 0x0FFFFFFC,
          .dma_dram_mask     = 0x3FFFFFFC,
          .nregs             = ASPEED_SMC_R_MAX,
 +        .segment_to_reg    = aspeed_smc_segment_to_reg,
 +        .reg_to_segment    = aspeed_smc_reg_to_segment,
      }, {
          .name              = "aspeed.spi1-ast2500",
          .r_conf            = R_CONF,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .flash_window_size = 0x8000000,
          .has_dma           = false,
          .nregs             = ASPEED_SMC_R_MAX,
 +        .segment_to_reg    = aspeed_smc_segment_to_reg,
 +        .reg_to_segment    = aspeed_smc_reg_to_segment,
      }, {
          .name              = "aspeed.spi2-ast2500",
          .r_conf            = R_CONF,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .flash_window_size = 0x8000000,
          .has_dma           = false,
          .nregs             = ASPEED_SMC_R_MAX,
 +        .segment_to_reg    = aspeed_smc_segment_to_reg,
 +        .reg_to_segment    = aspeed_smc_reg_to_segment,
      },
  };
- /*
+-static void aspeed_smc_flash_update_cs(AspeedSMCFlash *fl)
-- * The Segment Register uses a 8MB unit to encode the start address
++static void aspeed_smc_flash_update_ctrl(AspeedSMCFlash *fl, uint32_t value)
 - * and the end address of the mapping window of a flash SPI slave :
 - *
 - *        | byte 1 | byte 2 | byte 3 | byte 4 |
 - *        +--------+--------+--------+--------+
 - *        |  end   |  start |   0    |   0    |
 - *
 + * The Segment Registers of the AST2400 and AST2500 have a 8MB
 + * unit. The address range of a flash SPI slave is encoded with
 + * absolute addresses which should be part of the overall controller
 + * window.
   */
 -static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg)
 +static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
 +                                          const AspeedSegments *seg)
  {
-     uint32_t reg = 0;
+     AspeedSMCState *s = fl->controller;
-     reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
++    bool unselect;
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg)
-     return reg;
+-    s->snoop_index = aspeed_smc_is_ce_stop_active(fl) ? SNOOP_OFF : SNOOP_START;
 +    /* User mode selects the CS, other modes unselect */
 +    unselect = (value & CTRL_CMD_MODE_MASK) != CTRL_USERMODE;
 -    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
 +    /* A change of CTRL_CE_STOP_ACTIVE from 0 to 1, unselects the CS */
 +    if (!(s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE) &&
 +        value & CTRL_CE_STOP_ACTIVE) {
 +        unselect = true;
 +    }
 +
 +    s->regs[s->r_ctrl0 + fl->id] = value;
 +
 +    s->snoop_index = unselect ? SNOOP_OFF : SNOOP_START;
 +
 +    aspeed_smc_flash_do_select(fl, unselect);
  }
--static inline void aspeed_smc_reg_to_segment(uint32_t reg, AspeedSegments *seg)
+ static void aspeed_smc_reset(DeviceState *d)
-+static void aspeed_smc_reg_to_segment(const AspeedSMCState *s,
+@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
-+                                      uint32_t reg, AspeedSegments *seg)
+         s->regs[addr] = value;
- {
+     } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) {
-     seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
+         int cs = addr - s->r_ctrl0;
-     seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
+-        s->regs[addr] = value;
-@@ -XXX,XX +XXX,XX @@ static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
+-        aspeed_smc_flash_update_cs(&s->flashes[cs]);
-             continue;
++        aspeed_smc_flash_update_ctrl(&s->flashes[cs], value);
-         }
+     } else if (addr >= R_SEG_ADDR0 &&
+                addr < R_SEG_ADDR0 + s->ctrl->max_slaves) {
--        aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + i], &seg);
+         int cs = addr - R_SEG_ADDR0;
-+        s->ctrl->reg_to_segment(s, s->regs[R_SEG_ADDR0 + i], &seg);
+diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
+index XXXXXXX..XXXXXXX 100644
-         if (new->addr + new->size > seg.addr &&
+--- a/hw/ssi/trace-events
-             new->addr < seg.addr + seg.size) {
++++ b/hw/ssi/trace-events
-@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
+@@ -XXX,XX +XXX,XX @@ aspeed_smc_flash_write(int cs, uint64_t addr,  uint32_t size, uint64_t data, int
-     AspeedSMCFlash *fl = &s->flashes[cs];
+ aspeed_smc_read(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
-     AspeedSegments seg;
+ aspeed_smc_dma_checksum(uint32_t addr, uint32_t data) "0x%08x: 0x%08x"
+ aspeed_smc_write(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
--    aspeed_smc_reg_to_segment(new, &seg);
++aspeed_smc_flash_select(int cs, const char *prefix) "CS%d %sselect"
 +    s->ctrl->reg_to_segment(s, new, &seg);
      /* The start address of CS0 is read-only */
      if (cs == 0 && seg.addr != s->ctrl->flash_window_base) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
                        "%s: Tried to change CS0 start address to 0x%"
                        HWADDR_PRIx "\n", s->ctrl->name, seg.addr);
          seg.addr = s->ctrl->flash_window_base;
 -        new = aspeed_smc_segment_to_reg(&seg);
 +        new = s->ctrl->segment_to_reg(s, &seg);
      }
      /*
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
                        HWADDR_PRIx "\n", s->ctrl->name, cs, seg.addr + seg.size);
          seg.size = s->ctrl->segments[cs].addr + s->ctrl->segments[cs].size -
              seg.addr;
 -        new = aspeed_smc_segment_to_reg(&seg);
 +        new = s->ctrl->segment_to_reg(s, &seg);
      }
      /* Keep the segment in the overall flash window */
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
      const AspeedSMCState *s = fl->controller;
      AspeedSegments seg;
 -    aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + fl->id], &seg);
 +    s->ctrl->reg_to_segment(s, s->regs[R_SEG_ADDR0 + fl->id], &seg);
      if ((addr % seg.size) != addr) {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "%s: invalid address 0x%08x for CS%d segment : "
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reset(DeviceState *d)
      /* setup default segment register values for all */
      for (i = 0; i < s->ctrl->max_slaves; ++i) {
          s->regs[R_SEG_ADDR0 + i] =
 -            aspeed_smc_segment_to_reg(&s->ctrl->segments[i]);
 +            s->ctrl->segment_to_reg(s, &s->ctrl->segments[i]);
      }
      /* HW strapping flash type for FMC controllers  */
 --
 .20.1

-[PULL 62/68] aspeed/soc: Add ASPEED Video stub
+[PULL 07/36] target/arm: Check addresses for disabled regimes
-From: Joel Stanley <joel@jms.id.au>
+From: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Joel Stanley <joel@jms.id.au>
+We fail to validate the upper bits of a virtual address on a
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+translation disabled regime, as per AArch64.TranslateAddressS1Off.
-Message-id: 20190925143248.10000-24-clg@kaod.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200308012946.16303-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed_soc.h | 1 +
+ target/arm/helper.c | 35 ++++++++++++++++++++++++++++++++++-
- hw/arm/aspeed_ast2600.c     | 5 +++++
+file changed, 34 insertions(+), 1 deletion(-)
  hw/arm/aspeed_soc.c         | 6 ++++++
 files changed, 12 insertions(+)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/target/arm/helper.c
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-     ASPEED_SDMC,
+     /* Definitely a real MMU, not an MPU */
-     ASPEED_SCU,
-     ASPEED_ADC,
+     if (regime_translation_disabled(env, mmu_idx)) {
-+    ASPEED_VIDEO,
+-        /* MMU disabled. */
-     ASPEED_SRAM,
++        /*
-     ASPEED_SDHCI,
++         * MMU disabled.  S1 addresses within aa64 translation regimes are
-     ASPEED_GPIO,
++         * still checked for bounds -- see AArch64.TranslateAddressS1Off.
-diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
++         */
-index XXXXXXX..XXXXXXX 100644
++        if (mmu_idx != ARMMMUIdx_Stage2) {
---- a/hw/arm/aspeed_ast2600.c
++            int r_el = regime_el(env, mmu_idx);
-+++ b/hw/arm/aspeed_ast2600.c
++            if (arm_el_is_aa64(env, r_el)) {
-@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
++                int pamax = arm_pamax(env_archcpu(env));
-     [ASPEED_SCU]       = 0x1E6E2000,
++                uint64_t tcr = env->cp15.tcr_el[r_el].raw_tcr;
-     [ASPEED_XDMA]      = 0x1E6E7000,
++                int addrtop, tbi;
      [ASPEED_ADC]       = 0x1E6E9000,
 +    [ASPEED_VIDEO]     = 0x1E700000,
      [ASPEED_SDHCI]     = 0x1E740000,
      [ASPEED_GPIO]      = 0x1E780000,
      [ASPEED_GPIO_1_8V] = 0x1E780800,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
      create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_IOMEM],
                                  ASPEED_SOC_IOMEM_SIZE);
 +    /* Video engine stub */
 +    create_unimplemented_device("aspeed.video", sc->memmap[ASPEED_VIDEO],
 +                                0x1000);
 +
-     if (s->num_cpus > sc->num_cpus) {
++                tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
-         warn_report("%s: invalid number of CPUs %d, using default %d",
++                if (access_type == MMU_INST_FETCH) {
-                     sc->name, s->num_cpus, sc->num_cpus);
++                    tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
++                }
-index XXXXXXX..XXXXXXX 100644
++                tbi = (tbi >> extract64(address, 55, 1)) & 1;
---- a/hw/arm/aspeed_soc.c
++                addrtop = (tbi ? 55 : 63);
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2400_memmap[] = {
      [ASPEED_SDMC]   = 0x1E6E0000,
      [ASPEED_SCU]    = 0x1E6E2000,
      [ASPEED_XDMA]   = 0x1E6E7000,
 +    [ASPEED_VIDEO]  = 0x1E700000,
      [ASPEED_ADC]    = 0x1E6E9000,
      [ASPEED_SRAM]   = 0x1E720000,
      [ASPEED_SDHCI]  = 0x1E740000,
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2500_memmap[] = {
      [ASPEED_SCU]    = 0x1E6E2000,
      [ASPEED_XDMA]   = 0x1E6E7000,
      [ASPEED_ADC]    = 0x1E6E9000,
 +    [ASPEED_VIDEO]  = 0x1E700000,
      [ASPEED_SRAM]   = 0x1E720000,
      [ASPEED_SDHCI]  = 0x1E740000,
      [ASPEED_GPIO]   = 0x1E780000,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_IOMEM],
                                  ASPEED_SOC_IOMEM_SIZE);
 +    /* Video engine stub */
 +    create_unimplemented_device("aspeed.video", sc->memmap[ASPEED_VIDEO],
 +                                0x1000);
 +
-     if (s->num_cpus > sc->num_cpus) {
++                if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
-         warn_report("%s: invalid number of CPUs %d, using default %d",
++                    fi->type = ARMFault_AddressSize;
-                     sc->name, s->num_cpus, sc->num_cpus);
++                    fi->level = 0;
 +                    fi->stage2 = false;
 +                    return 1;
 +                }
 +
 +                /*
 +                 * When TBI is disabled, we've just validated that all of the
 +                 * bits above PAMax are zero, so logically we only need to
 +                 * clear the top byte for TBI.  But it's clearer to follow
 +                 * the pseudocode set of addrdesc.paddress.
 +                 */
 +                address = extract64(address, 0, 52);
 +            }
 +        }
          *phys_ptr = address;
          *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
          *page_size = TARGET_PAGE_SIZE;
 --
 .20.1

-[PULL 59/68] aspeed: Add an AST2600 eval board
+[PULL 08/36] target/arm: Disable clean_data_tbi for system mode
-From: Cédric Le Goater <clg@kaod.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+We must include the tag in the FAR_ELx register when raising
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+an addressing exception.  Which means that we should not clear
-Message-id: 20190925143248.10000-21-clg@kaod.org
+out the tag during translation.
 We cannot at present comply with this for user mode, so we
 retain the clean_data_tbi function for the moment, though it
 no longer does what it says on the tin for system mode.  This
 function is to be replaced with MTE, so don't worry about the
 slight misnaming.
 Buglink: https://bugs.launchpad.net/qemu/+bug/1867072
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200308012946.16303-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed.h |  1 +
+ target/arm/translate-a64.c | 11 +++++++++++
- hw/arm/aspeed.c         | 23 +++++++++++++++++++++++
+file changed, 11 insertions(+)
 files changed, 24 insertions(+)
-diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed.h
+--- a/target/arm/translate-a64.c
-+++ b/include/hw/arm/aspeed.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardConfig {
+@@ -XXX,XX +XXX,XX @@ static void gen_a64_set_pc(DisasContext *s, TCGv_i64 src)
-     const char *desc;
+ static TCGv_i64 clean_data_tbi(DisasContext *s, TCGv_i64 addr)
-     const char *soc_name;
+ {
-     uint32_t hw_strap1;
+     TCGv_i64 clean = new_tmp_a64(s);
-+    uint32_t hw_strap2;
++    /*
-     const char *fmc_model;
++     * In order to get the correct value in the FAR_ELx register,
-     const char *spi_model;
++     * we must present the memory subsystem with the "dirty" address
-     uint32_t num_cs;
++     * including the TBI.  In system mode we can make this work via
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
++     * the TLB, dropping the TBI during translation.  But for user-only
-index XXXXXXX..XXXXXXX 100644
++     * mode we don't have that option, and must remove the top byte now.
---- a/hw/arm/aspeed.c
++     */
-+++ b/hw/arm/aspeed.c
++#ifdef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ struct AspeedBoardState {
+     gen_top_byte_ignore(s, clean, addr, s->tbid);
- /* Witherspoon hardware value: 0xF10AD216 (but use romulus definition) */
++#else
- #define WITHERSPOON_BMC_HW_STRAP1 ROMULUS_BMC_HW_STRAP1
++    tcg_gen_mov_i64(clean, addr);
++#endif
-+/* AST2600 evb hardware value */
+     return clean;
 +#define AST2600_EVB_HW_STRAP1 0x000000C0
 +#define AST2600_EVB_HW_STRAP2 0x00000003
 +
  /*
   * The max ram region is for firmwares that scan the address space
   * with load/store to guess how much RAM the SoC has.
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
                               &error_abort);
      object_property_set_int(OBJECT(&bmc->soc), cfg->hw_strap1, "hw-strap1",
                              &error_abort);
 +    object_property_set_int(OBJECT(&bmc->soc), cfg->hw_strap2, "hw-strap2",
 +                            &error_abort);
      object_property_set_int(OBJECT(&bmc->soc), cfg->num_cs, "num-cs",
                              &error_abort);
      object_property_set_int(OBJECT(&bmc->soc), machine->smp.cpus, "num-cpus",
@@ -XXX,XX +XXX,XX @@ static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
      i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
  }
-+static void ast2600_evb_i2c_init(AspeedBoardState *bmc)
-+{
-+    /* Start with some devices on our I2C busses */
-+    ast2500_evb_i2c_init(bmc);
-+}
-+
- static void romulus_bmc_i2c_init(AspeedBoardState *bmc)
- {
-     AspeedSoCState *soc = &bmc->soc;
-@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
-         .num_cs    = 2,
-         .i2c_init  = witherspoon_bmc_i2c_init,
-         .ram       = 512 * MiB,
-+    }, {
-+        .name      = MACHINE_TYPE_NAME("ast2600-evb"),
-+        .desc      = "Aspeed AST2600 EVB (Cortex A7)",
-+        .soc_name  = "ast2600-a0",
-+        .hw_strap1 = AST2600_EVB_HW_STRAP1,
-+        .hw_strap2 = AST2600_EVB_HW_STRAP2,
-+        .fmc_model = "w25q512jv",
-+        .spi_model = "mx66u51235f",
-+        .num_cs    = 1,
-+        .i2c_init  = ast2600_evb_i2c_init,
-+        .ram       = 2 * GiB,
-     },
- };
 --
 .20.1

-[PULL 60/68] aspeed: Parameterise number of MACs
+[PULL 09/36] hw/arm/cubieboard: make sure SOC object isn't leaked
-From: Joel Stanley <joel@jms.id.au>
+From: Igor Mammedov <imammedo@redhat.com>
-To support the ast2600's four MACs allow SoCs to specify the number
+SOC object returned by object_new() is leaked in current code.
-they have, and create that many.
+Set SOC parent explicitly to board and then unref to SOC object
 to make sure that refererence returned by object_new() is taken
 care of.
-Signed-off-by: Joel Stanley <joel@jms.id.au>
+The SOC object will be kept alive by its parent (machine) and
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+will be automatically freed when MachineState is destroyed.
-Message-id: 20190925143248.10000-22-clg@kaod.org
-[clg: - included a check on sc->macs_num when realizing the macs
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-      - included interrupt definitions for the AST2600 ]
+Reported-by: Andrew Jones <drjones@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Message-id: 20200303091254.22373-1-imammedo@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed_soc.h |  5 ++++-
+ hw/arm/cubieboard.c | 3 +++
- hw/arm/aspeed_ast2600.c     | 10 ++++++++--
+file changed, 3 insertions(+)
  hw/arm/aspeed_soc.c         |  6 ++++--
 files changed, 16 insertions(+), 5 deletions(-)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+diff --git a/hw/arm/cubieboard.c b/hw/arm/cubieboard.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/hw/arm/cubieboard.c
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/hw/arm/cubieboard.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void cubieboard_init(MachineState *machine)
  #define ASPEED_SPIS_NUM  2
  #define ASPEED_WDTS_NUM  4
  #define ASPEED_CPUS_NUM  2
 -#define ASPEED_MACS_NUM  2
 +#define ASPEED_MACS_NUM  4
  typedef struct AspeedSoCState {
      /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCClass {
      uint64_t sram_size;
      int spis_num;
      int wdts_num;
 +    int macs_num;
      const int *irqmap;
      const hwaddr *memmap;
      uint32_t num_cpus;
@@ -XXX,XX +XXX,XX @@ enum {
      ASPEED_I2C,
      ASPEED_ETH1,
      ASPEED_ETH2,
 +    ASPEED_ETH3,
 +    ASPEED_ETH4,
      ASPEED_SDRAM,
      ASPEED_XDMA,
  };
 diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_ast2600.c
 +++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
      [ASPEED_SPI1]      = 0x1E630000,
      [ASPEED_SPI2]      = 0x1E641000,
      [ASPEED_ETH1]      = 0x1E660000,
 +    [ASPEED_ETH3]      = 0x1E670000,
      [ASPEED_ETH2]      = 0x1E680000,
 +    [ASPEED_ETH4]      = 0x1E690000,
      [ASPEED_VIC]       = 0x1E6C0000,
      [ASPEED_SDMC]      = 0x1E6E0000,
      [ASPEED_SCU]       = 0x1E6E2000,
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2600_irqmap[] = {
      [ASPEED_I2C]       = 110,   /* 110 -> 125 */
      [ASPEED_ETH1]      = 2,
      [ASPEED_ETH2]      = 3,
 +    [ASPEED_ETH3]      = 32,
 +    [ASPEED_ETH4]      = 33,
 +
  };
  static qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int ctrl)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
                                         OBJECT(&s->scu), &error_abort);
      }
--    for (i = 0; i < ASPEED_MACS_NUM; i++) {
+     a10 = AW_A10(object_new(TYPE_AW_A10));
-+    for (i = 0; i < sc->macs_num; i++) {
++    object_property_add_child(OBJECT(machine), "soc", OBJECT(a10),
-         sysbus_init_child_obj(obj, "ftgmac100[*]", OBJECT(&s->ftgmac100[i]),
++                              &error_abort);
-                               sizeof(s->ftgmac100[i]), TYPE_FTGMAC100);
++    object_unref(OBJECT(a10));
-     }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
+     object_property_set_int(OBJECT(&a10->emac), 1, "phy-addr", &err);
-     }
+     if (err != NULL) {
      /* Net */
 -    for (i = 0; i < nb_nics; i++) {
 +    for (i = 0; i < nb_nics && i < sc->macs_num; i++) {
          qdev_set_nic_properties(DEVICE(&s->ftgmac100[i]), &nd_table[i]);
          object_property_set_bool(OBJECT(&s->ftgmac100[i]), true, "aspeed",
                                   &err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)
      sc->sram_size    = 0x10000;
      sc->spis_num     = 2;
      sc->wdts_num     = 4;
 +    sc->macs_num     = 4;
      sc->irqmap       = aspeed_soc_ast2600_irqmap;
      sc->memmap       = aspeed_soc_ast2600_memmap;
      sc->num_cpus     = 2;
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                                         OBJECT(&s->scu), &error_abort);
      }
 -    for (i = 0; i < ASPEED_MACS_NUM; i++) {
 +    for (i = 0; i < sc->macs_num; i++) {
          sysbus_init_child_obj(obj, "ftgmac100[*]", OBJECT(&s->ftgmac100[i]),
                                sizeof(s->ftgmac100[i]), TYPE_FTGMAC100);
      }
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      }
      /* Net */
 -    for (i = 0; i < nb_nics; i++) {
 +    for (i = 0; i < nb_nics && i < sc->macs_num; i++) {
          qdev_set_nic_properties(DEVICE(&s->ftgmac100[i]), &nd_table[i]);
          object_property_set_bool(OBJECT(&s->ftgmac100[i]), true, "aspeed",
                                   &err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
      sc->sram_size    = 0x8000;
      sc->spis_num     = 1;
      sc->wdts_num     = 2;
 +    sc->macs_num     = 2;
      sc->irqmap       = aspeed_soc_ast2400_irqmap;
      sc->memmap       = aspeed_soc_ast2400_memmap;
      sc->num_cpus     = 1;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
      sc->sram_size    = 0x9000;
      sc->spis_num     = 2;
      sc->wdts_num     = 3;
 +    sc->macs_num     = 2;
      sc->irqmap       = aspeed_soc_ast2500_irqmap;
      sc->memmap       = aspeed_soc_ast2500_memmap;
      sc->num_cpus     = 1;
 --
 .20.1

-[PULL 48/68] aspeed/sdmc: Add AST2600 support
+[PULL 10/36] hw/arm/fsl-imx25: Wire up eSDHC controllers
-From: Joel Stanley <joel@jms.id.au>
+From: Guenter Roeck <linux@roeck-us.net>
-The AST2600 SDMC controller is slightly different from its predecessor
+Wire up eSDHC controllers in fsl-imx25. For imx25-pdk, connect drives
-(DRAM training). Max memory is now 2G on the AST2600.
+provided on the command line to available eSDHC controllers.
-Signed-off-by: Joel Stanley <joel@jms.id.au>
+This patch enables booting the imx25-pdk emulation from SD card.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 20190925143248.10000-10-clg@kaod.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-[clg: - improved commit log
+Message-id: 20200310215146.19688-2-linux@roeck-us.net
-      - reworked model integration into new object class ]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+[PMM: made commit subject consistent with other patch]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/aspeed_sdmc.h |  1 +
+ include/hw/arm/fsl-imx25.h |  9 +++++++++
- hw/misc/aspeed_scu.c          |  2 +
+ hw/arm/fsl-imx25.c         | 32 ++++++++++++++++++++++++++++++++
- hw/misc/aspeed_sdmc.c         | 82 +++++++++++++++++++++++++++++++++++
+ hw/arm/imx25_pdk.c         | 16 ++++++++++++++++
-files changed, 85 insertions(+)
+files changed, 57 insertions(+)
-diff --git a/include/hw/misc/aspeed_sdmc.h b/include/hw/misc/aspeed_sdmc.h
+diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/aspeed_sdmc.h
+--- a/include/hw/arm/fsl-imx25.h
-+++ b/include/hw/misc/aspeed_sdmc.h
++++ b/include/hw/arm/fsl-imx25.h
 @@ -XXX,XX +XXX,XX @@
- #define ASPEED_SDMC(obj) OBJECT_CHECK(AspeedSDMCState, (obj), TYPE_ASPEED_SDMC)
+ #include "hw/misc/imx_rngc.h"
- #define TYPE_ASPEED_2400_SDMC TYPE_ASPEED_SDMC "-ast2400"
+ #include "hw/i2c/imx_i2c.h"
- #define TYPE_ASPEED_2500_SDMC TYPE_ASPEED_SDMC "-ast2500"
+ #include "hw/gpio/imx_gpio.h"
-+#define TYPE_ASPEED_2600_SDMC TYPE_ASPEED_SDMC "-ast2600"
++#include "hw/sd/sdhci.h"
+ #include "exec/memory.h"
- #define ASPEED_SDMC_NR_REGS (0x174 >> 2)
+ #include "target/arm/cpu.h"
-diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
+@@ -XXX,XX +XXX,XX @@
  #define FSL_IMX25_NUM_EPITS 2
  #define FSL_IMX25_NUM_I2CS 3
  #define FSL_IMX25_NUM_GPIOS 4
 +#define FSL_IMX25_NUM_ESDHCS 2
  typedef struct FslIMX25State {
      /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
      IMXRNGCState   rngc;
      IMXI2CState    i2c[FSL_IMX25_NUM_I2CS];
      IMXGPIOState   gpio[FSL_IMX25_NUM_GPIOS];
 +    SDHCIState     esdhc[FSL_IMX25_NUM_ESDHCS];
      MemoryRegion   rom[2];
      MemoryRegion   iram;
      MemoryRegion   iram_alias;
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
  #define FSL_IMX25_GPIO3_SIZE    0x4000
  #define FSL_IMX25_RNGC_ADDR     0x53FB0000
  #define FSL_IMX25_RNGC_SIZE     0x4000
 +#define FSL_IMX25_ESDHC1_ADDR   0x53FB4000
 +#define FSL_IMX25_ESDHC1_SIZE   0x4000
 +#define FSL_IMX25_ESDHC2_ADDR   0x53FB8000
 +#define FSL_IMX25_ESDHC2_SIZE   0x4000
  #define FSL_IMX25_GPIO1_ADDR    0x53FCC000
  #define FSL_IMX25_GPIO1_SIZE    0x4000
  #define FSL_IMX25_GPIO2_ADDR    0x53FD0000
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
  #define FSL_IMX25_GPIO2_IRQ     51
  #define FSL_IMX25_GPIO3_IRQ     16
  #define FSL_IMX25_GPIO4_IRQ     23
 +#define FSL_IMX25_ESDHC1_IRQ    9
 +#define FSL_IMX25_ESDHC2_IRQ    8
  #endif /* FSL_IMX25_H */
 diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/aspeed_scu.c
+--- a/hw/arm/fsl-imx25.c
-+++ b/hw/misc/aspeed_scu.c
++++ b/hw/arm/fsl-imx25.c
 @@ -XXX,XX +XXX,XX @@
- #define AST2600_CLK_STOP_CTRL_CLR TO_REG(0x84)
+ #include "hw/qdev-properties.h"
- #define AST2600_CLK_STOP_CTRL2     TO_REG(0x90)
+ #include "chardev/char.h"
- #define AST2600_CLK_STOP_CTR2L_CLR TO_REG(0x94)
-+#define AST2600_SDRAM_HANDSHAKE   TO_REG(0x100)
++#define IMX25_ESDHC_CAPABILITIES     0x07e20000
  #define AST2600_HPLL_PARAM        TO_REG(0x200)
  #define AST2600_HPLL_EXT          TO_REG(0x204)
  #define AST2600_MPLL_EXT          TO_REG(0x224)
@@ -XXX,XX +XXX,XX @@ static const uint32_t ast2600_a0_resets[ASPEED_AST2600_SCU_NR_REGS] = {
      [AST2600_SYS_RST_CTRL2]     = 0xFFFFFFFC,
      [AST2600_CLK_STOP_CTRL]     = 0xEFF43E8B,
      [AST2600_CLK_STOP_CTRL2]    = 0xFFF0FFF0,
 +    [AST2600_SDRAM_HANDSHAKE]   = 0x00000040,  /* SoC completed DRAM init */
      [AST2600_HPLL_PARAM]        = 0x1000405F,
  };
 diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/aspeed_sdmc.c
 +++ b/hw/misc/aspeed_sdmc.c
@@ -XXX,XX +XXX,XX @@
  /* Control/Status Register #1 (ast2500) */
  #define R_STATUS1         (0x60 / 4)
  #define   PHY_BUSY_STATE      BIT(0)
 +#define   PHY_PLL_LOCK_STATUS BIT(4)
  #define R_ECC_TEST_CTRL   (0x70 / 4)
  #define   ECC_TEST_FINISHED   BIT(12)
@@ -XXX,XX +XXX,XX @@
  #define     ASPEED_SDMC_AST2500_512MB       0x2
  #define     ASPEED_SDMC_AST2500_1024MB      0x3
 +#define     ASPEED_SDMC_AST2600_256MB       0x0
 +#define     ASPEED_SDMC_AST2600_512MB       0x1
 +#define     ASPEED_SDMC_AST2600_1024MB      0x2
 +#define     ASPEED_SDMC_AST2600_2048MB      0x3
 +
- #define ASPEED_SDMC_AST2500_READONLY_MASK                               \
+ static void fsl_imx25_init(Object *obj)
-     (ASPEED_SDMC_HW_VERSION(0xf) | ASPEED_SDMC_CACHE_INITIAL_DONE |     \
+ {
-      ASPEED_SDMC_AST2500_RESERVED | ASPEED_SDMC_VGA_COMPAT |            \
+     FslIMX25State *s = FSL_IMX25(obj);
-@@ -XXX,XX +XXX,XX @@ static int ast2500_rambits(AspeedSDMCState *s)
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_init(Object *obj)
-     return ASPEED_SDMC_AST2500_512MB;
+         sysbus_init_child_obj(obj, "gpio[*]", &s->gpio[i], sizeof(s->gpio[i]),
                                TYPE_IMX_GPIO);
      }
 +
 +    for (i = 0; i < FSL_IMX25_NUM_ESDHCS; i++) {
 +        sysbus_init_child_obj(obj, "sdhc[*]", &s->esdhc[i], sizeof(s->esdhc[i]),
 +                              TYPE_IMX_USDHC);
 +    }
  }
-+static int ast2600_rambits(AspeedSDMCState *s)
+ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
-+{
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
-+    switch (s->ram_size >> 20) {
+                                             gpio_table[i].irq));
-+    case 256:
+     }
-+        return ASPEED_SDMC_AST2600_256MB;
-+    case 512:
++    /* Initialize all SDHC */
-+        return ASPEED_SDMC_AST2600_512MB;
++    for (i = 0; i < FSL_IMX25_NUM_ESDHCS; i++) {
-+    case 1024:
++        static const struct {
-+        return ASPEED_SDMC_AST2600_1024MB;
++            hwaddr addr;
-+    case 2048:
++            unsigned int irq;
-+        return ASPEED_SDMC_AST2600_2048MB;
++        } esdhc_table[FSL_IMX25_NUM_ESDHCS] = {
-+    default:
++            { FSL_IMX25_ESDHC1_ADDR, FSL_IMX25_ESDHC1_IRQ },
-+        break;
++            { FSL_IMX25_ESDHC2_ADDR, FSL_IMX25_ESDHC2_IRQ },
 +        };
 +
 +        object_property_set_uint(OBJECT(&s->esdhc[i]), 2, "sd-spec-version",
 +                                 &err);
 +        object_property_set_uint(OBJECT(&s->esdhc[i]), IMX25_ESDHC_CAPABILITIES,
 +                                 "capareg", &err);
 +        object_property_set_bool(OBJECT(&s->esdhc[i]), true, "realized", &err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->esdhc[i]), 0, esdhc_table[i].addr);
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->esdhc[i]), 0,
 +                           qdev_get_gpio_in(DEVICE(&s->avic),
 +                                            esdhc_table[i].irq));
 +    }
 +
-+    /* use a common default */
+     /* initialize 2 x 16 KB ROM */
-+    warn_report("Invalid RAM size 0x%" PRIx64 ". Using default 512M",
+     memory_region_init_rom(&s->rom[0], NULL,
-+                s->ram_size);
+                            "imx25.rom0", FSL_IMX25_ROM0_SIZE, &err);
-+    s->ram_size = 512 << 20;
+diff --git a/hw/arm/imx25_pdk.c b/hw/arm/imx25_pdk.c
-+    return ASPEED_SDMC_AST2600_512MB;
+index XXXXXXX..XXXXXXX 100644
-+}
+--- a/hw/arm/imx25_pdk.c
 +++ b/hw/arm/imx25_pdk.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "cpu.h"
 +#include "hw/qdev-properties.h"
  #include "hw/arm/fsl-imx25.h"
  #include "hw/boards.h"
  #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static void imx25_pdk_init(MachineState *machine)
      imx25_pdk_binfo.board_id = 1771,
      imx25_pdk_binfo.nb_cpus = 1;
 +    for (i = 0; i < FSL_IMX25_NUM_ESDHCS; i++) {
 +        BusState *bus;
 +        DeviceState *carddev;
 +        DriveInfo *di;
 +        BlockBackend *blk;
 +
- static void aspeed_sdmc_reset(DeviceState *dev)
++        di = drive_get_next(IF_SD);
- {
++        blk = di ? blk_by_legacy_dinfo(di) : NULL;
-     AspeedSDMCState *s = ASPEED_SDMC(dev);
++        bus = qdev_get_child_bus(DEVICE(&s->soc.esdhc[i]), "sd-bus");
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_2500_sdmc_info = {
++        carddev = qdev_create(bus, TYPE_SD_CARD);
-     .class_init = aspeed_2500_sdmc_class_init,
++        qdev_prop_set_drive(carddev, "drive", blk, &error_fatal);
- };
++        object_property_set_bool(OBJECT(carddev), true,
++                                 "realized", &error_fatal);
 +static uint32_t aspeed_2600_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
 +{
 +    uint32_t fixed_conf = ASPEED_SDMC_HW_VERSION(3) |
 +        ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
 +        ASPEED_SDMC_DRAM_SIZE(ast2600_rambits(s));
 +
 +    /* Make sure readonly bits are kept (use ast2500 mask) */
 +    data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
 +
 +    return data | fixed_conf;
 +}
 +
 +static void aspeed_2600_sdmc_write(AspeedSDMCState *s, uint32_t reg,
 +                                   uint32_t data)
 +{
 +    switch (reg) {
 +    case R_CONF:
 +        data = aspeed_2600_sdmc_compute_conf(s, data);
 +        break;
 +    case R_STATUS1:
 +        /* Will never return 'busy'. 'lock status' is always set */
 +        data &= ~PHY_BUSY_STATE;
 +        data |= PHY_PLL_LOCK_STATUS;
 +        break;
 +    case R_ECC_TEST_CTRL:
 +        /* Always done, always happy */
 +        data |= ECC_TEST_FINISHED;
 +        data &= ~ECC_TEST_FAIL;
 +        break;
 +    default:
 +        break;
 +    }
 +
-+    s->regs[reg] = data;
+     /*
-+}
+      * We test explicitly for qtest here as it is not done (yet?) in
-+
+      * arm_load_kernel(). Without this the "make check" command would
 +static void aspeed_2600_sdmc_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
 +
 +    dc->desc = "ASPEED 2600 SDRAM Memory Controller";
 +    asc->max_ram_size = 2048 << 20;
 +    asc->compute_conf = aspeed_2600_sdmc_compute_conf;
 +    asc->write = aspeed_2600_sdmc_write;
 +}
 +
 +static const TypeInfo aspeed_2600_sdmc_info = {
 +    .name = TYPE_ASPEED_2600_SDMC,
 +    .parent = TYPE_ASPEED_SDMC,
 +    .class_init = aspeed_2600_sdmc_class_init,
 +};
 +
  static void aspeed_sdmc_register_types(void)
  {
      type_register_static(&aspeed_sdmc_info);
      type_register_static(&aspeed_2400_sdmc_info);
      type_register_static(&aspeed_2500_sdmc_info);
 +    type_register_static(&aspeed_2600_sdmc_info);
  }
  type_init(aspeed_sdmc_register_types);
 --
 .20.1

-[PULL 67/68] hw/arm/bcm2835: Add various unimplemented peripherals
+[PULL 11/36] hw/arm/fsl-imx25: Wire up USB controllers
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Guenter Roeck <linux@roeck-us.net>
-Base addresses and sizes taken from the "BCM2835 ARM Peripherals"
+i.MX25 supports two USB controllers. Let's wire them up.
 datasheet from February 06 2012:
 https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf
+With this patch, imx25-pdk can boot from both USB ports.
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Message-id: 20200310215146.19688-3-linux@roeck-us.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190926173428.10713-6-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/bcm2835_peripherals.h | 15 ++++++++++++++
+ include/hw/arm/fsl-imx25.h |  9 +++++++++
- include/hw/arm/raspi_platform.h      |  8 +++++++
+ hw/arm/fsl-imx25.c         | 24 ++++++++++++++++++++++++
- hw/arm/bcm2835_peripherals.c         | 31 ++++++++++++++++++++++++++++
+files changed, 33 insertions(+)
 files changed, 54 insertions(+)
-diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
+diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2835_peripherals.h
+--- a/include/hw/arm/fsl-imx25.h
-+++ b/include/hw/arm/bcm2835_peripherals.h
++++ b/include/hw/arm/fsl-imx25.h
 @@ -XXX,XX +XXX,XX @@
+ #include "hw/i2c/imx_i2c.h"
+ #include "hw/gpio/imx_gpio.h"
  #include "hw/sd/sdhci.h"
- #include "hw/sd/bcm2835_sdhost.h"
++#include "hw/usb/chipidea.h"
- #include "hw/gpio/bcm2835_gpio.h"
+ #include "exec/memory.h"
-+#include "hw/misc/unimp.h"
+ #include "target/arm/cpu.h"
- #define TYPE_BCM2835_PERIPHERALS "bcm2835-peripherals"
+@@ -XXX,XX +XXX,XX @@
- #define BCM2835_PERIPHERALS(obj) \
+ #define FSL_IMX25_NUM_I2CS 3
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM2835PeripheralState {
+ #define FSL_IMX25_NUM_GPIOS 4
-     MemoryRegion ram_alias[4];
+ #define FSL_IMX25_NUM_ESDHCS 2
-     qemu_irq irq, fiq;
++#define FSL_IMX25_NUM_USBS 2
-+    UnimplementedDeviceState systmr;
+ typedef struct FslIMX25State {
-+    UnimplementedDeviceState armtmr;
+     /*< private >*/
-+    UnimplementedDeviceState cprman;
+@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
-+    UnimplementedDeviceState a2w;
+     IMXI2CState    i2c[FSL_IMX25_NUM_I2CS];
-     PL011State uart0;
+     IMXGPIOState   gpio[FSL_IMX25_NUM_GPIOS];
-     BCM2835AuxState aux;
+     SDHCIState     esdhc[FSL_IMX25_NUM_ESDHCS];
-     BCM2835FBState fb;
++    ChipideaState  usb[FSL_IMX25_NUM_USBS];
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM2835PeripheralState {
+     MemoryRegion   rom[2];
-     SDHCIState sdhci;
+     MemoryRegion   iram;
-     BCM2835SDHostState sdhost;
+     MemoryRegion   iram_alias;
-     BCM2835GpioState gpio;
+@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
-+    UnimplementedDeviceState i2s;
+ #define FSL_IMX25_GPIO1_SIZE    0x4000
-+    UnimplementedDeviceState spi[1];
+ #define FSL_IMX25_GPIO2_ADDR    0x53FD0000
-+    UnimplementedDeviceState i2c[3];
+ #define FSL_IMX25_GPIO2_SIZE    0x4000
-+    UnimplementedDeviceState otp;
++#define FSL_IMX25_USB1_ADDR     0x53FF4000
-+    UnimplementedDeviceState dbus;
++#define FSL_IMX25_USB1_SIZE     0x0200
-+    UnimplementedDeviceState ave0;
++#define FSL_IMX25_USB2_ADDR     0x53FF4400
-+    UnimplementedDeviceState bscsl;
++#define FSL_IMX25_USB2_SIZE     0x0200
-+    UnimplementedDeviceState smi;
+ #define FSL_IMX25_AVIC_ADDR     0x68000000
-+    UnimplementedDeviceState dwc2;
+ #define FSL_IMX25_AVIC_SIZE     0x4000
-+    UnimplementedDeviceState sdramc;
+ #define FSL_IMX25_IRAM_ADDR     0x78000000
- } BCM2835PeripheralState;
+@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
+ #define FSL_IMX25_GPIO4_IRQ     23
- #endif /* BCM2835_PERIPHERALS_H */
+ #define FSL_IMX25_ESDHC1_IRQ    9
-diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
+ #define FSL_IMX25_ESDHC2_IRQ    8
 +#define FSL_IMX25_USB1_IRQ      37
 +#define FSL_IMX25_USB2_IRQ      35
  #endif /* FSL_IMX25_H */
 diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/raspi_platform.h
+--- a/hw/arm/fsl-imx25.c
-+++ b/include/hw/arm/raspi_platform.h
++++ b/hw/arm/fsl-imx25.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_init(Object *obj)
-                                                       * Doorbells & Mailboxes */
+         sysbus_init_child_obj(obj, "sdhc[*]", &s->esdhc[i], sizeof(s->esdhc[i]),
- #define CPRMAN_OFFSET           0x100000 /* Power Management, Watchdog */
+                               TYPE_IMX_USDHC);
  #define CM_OFFSET               0x101000 /* Clock Management */
 +#define A2W_OFFSET              0x102000 /* Reset controller */
 +#define AVS_OFFSET              0x103000 /* Audio Video Standard */
  #define RNG_OFFSET              0x104000
  #define GPIO_OFFSET             0x200000
  #define UART0_OFFSET            0x201000
@@ -XXX,XX +XXX,XX @@
  #define I2S_OFFSET              0x203000
  #define SPI0_OFFSET             0x204000
  #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
 +#define OTP_OFFSET              0x20f000
 +#define BSC_SL_OFFSET           0x214000 /* SPI slave */
  #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
  #define EMMC1_OFFSET            0x300000
  #define SMI_OFFSET              0x600000
  #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
 +#define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
 +#define DBUS_OFFSET             0x900000
 +#define AVE0_OFFSET             0x910000
  #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
 +#define SDRAMC_OFFSET           0xe00000
  #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
  /* GPU interrupts */
 diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/bcm2835_peripherals.c
 +++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@
  /* Capabilities for SD controller: no DMA, high-speed, default clocks etc. */
  #define BCM2835_SDHC_CAPAREG 0x52134b4
 +static void create_unimp(BCM2835PeripheralState *ps,
 +                         UnimplementedDeviceState *uds,
 +                         const char *name, hwaddr ofs, hwaddr size)
 +{
 +    sysbus_init_child_obj(OBJECT(ps), name, uds,
 +                          sizeof(UnimplementedDeviceState),
 +                          TYPE_UNIMPLEMENTED_DEVICE);
 +    qdev_prop_set_string(DEVICE(uds), "name", name);
 +    qdev_prop_set_uint64(DEVICE(uds), "size", size);
 +    object_property_set_bool(OBJECT(uds), true, "realized", &error_fatal);
 +    memory_region_add_subregion_overlap(&ps->peri_mr, ofs,
 +                    sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0), -1000);
 +}
 +
  static void bcm2835_peripherals_init(Object *obj)
  {
      BCM2835PeripheralState *s = BCM2835_PERIPHERALS(obj);
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
          error_propagate(errp, err);
          return;
      }
 +
-+    create_unimp(s, &s->armtmr, "bcm2835-sp804", ARMCTRL_TIMER0_1_OFFSET, 0x40);
++    for (i = 0; i < FSL_IMX25_NUM_USBS; i++) {
-+    create_unimp(s, &s->systmr, "bcm2835-systimer", ST_OFFSET, 0x20);
++        sysbus_init_child_obj(obj, "usb[*]", &s->usb[i], sizeof(s->usb[i]),
-+    create_unimp(s, &s->cprman, "bcm2835-cprman", CPRMAN_OFFSET, 0x1000);
++                              TYPE_CHIPIDEA);
-+    create_unimp(s, &s->a2w, "bcm2835-a2w", A2W_OFFSET, 0x1000);
++    }
-+    create_unimp(s, &s->i2s, "bcm2835-i2s", I2S_OFFSET, 0x100);
++
 +    create_unimp(s, &s->smi, "bcm2835-smi", SMI_OFFSET, 0x100);
 +    create_unimp(s, &s->spi[0], "bcm2835-spi0", SPI0_OFFSET, 0x20);
 +    create_unimp(s, &s->bscsl, "bcm2835-spis", BSC_SL_OFFSET, 0x100);
 +    create_unimp(s, &s->i2c[0], "bcm2835-i2c0", BSC0_OFFSET, 0x20);
 +    create_unimp(s, &s->i2c[1], "bcm2835-i2c1", BSC1_OFFSET, 0x20);
 +    create_unimp(s, &s->i2c[2], "bcm2835-i2c2", BSC2_OFFSET, 0x20);
 +    create_unimp(s, &s->otp, "bcm2835-otp", OTP_OFFSET, 0x80);
 +    create_unimp(s, &s->dbus, "bcm2835-dbus", DBUS_OFFSET, 0x8000);
 +    create_unimp(s, &s->ave0, "bcm2835-ave0", AVE0_OFFSET, 0x8000);
 +    create_unimp(s, &s->dwc2, "dwc-usb2", USB_OTG_OFFSET, 0x1000);
 +    create_unimp(s, &s->sdramc, "bcm2835-sdramc", SDRAMC_OFFSET, 0x100);
  }
- static void bcm2835_peripherals_class_init(ObjectClass *oc, void *data)
+ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
                                              esdhc_table[i].irq));
      }
 +    /* USB */
 +    for (i = 0; i < FSL_IMX25_NUM_USBS; i++) {
 +        static const struct {
 +            hwaddr addr;
 +            unsigned int irq;
 +        } usb_table[FSL_IMX25_NUM_USBS] = {
 +            { FSL_IMX25_USB1_ADDR, FSL_IMX25_USB1_IRQ },
 +            { FSL_IMX25_USB2_ADDR, FSL_IMX25_USB2_IRQ },
 +        };
 +
 +        object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",
 +                                 &error_abort);
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0, usb_table[i].addr);
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
 +                           qdev_get_gpio_in(DEVICE(&s->avic),
 +                                            usb_table[i].irq));
 +    }
 +
      /* initialize 2 x 16 KB ROM */
      memory_region_init_rom(&s->rom[0], NULL,
                             "imx25.rom0", FSL_IMX25_ROM0_SIZE, &err);
 --
 .20.1

-[PULL 57/68] aspeed/soc: Add AST2600 support
+[PULL 12/36] hw/arm: add Allwinner H3 System-on-Chip
-From: Cédric Le Goater <clg@kaod.org>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-Initial definitions for a simple machine using an AST2600 SoC (Cortex
+The Allwinner H3 is a System on Chip containing four ARM Cortex A7
-CPU).
+processor cores. Features and specifications include DDR2/DDR3 memory,
 SD/MMC storage cards, 10/100/1000Mbit Ethernet, USB 2.0, HDMI and
 various I/O modules. This commit adds support for the Allwinner H3
 System on Chip.
-The Cortex CPU and its interrupt controller are too complex to handle
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-in the common Aspeed SoC framework. We introduce a new Aspeed SoC
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-class with instance_init and realize handlers to handle the differences
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-with the AST2400 and the AST2500 SoCs. This will add extra work to
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-keep in sync both models with future extensions but it makes the code
+Message-id: 20200311221854.30370-2-nieklinnenbank@gmail.com
 clearer.
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Joel Stanley <joel@jms.id.au>
 Message-id: 20190925143248.10000-19-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs        |   2 +-
+ hw/arm/Makefile.objs            |   1 +
- include/hw/arm/aspeed_soc.h |   4 +
+ include/hw/arm/allwinner-h3.h   | 106 +++++++++++
- hw/arm/aspeed_ast2600.c     | 492 ++++++++++++++++++++++++++++++++++++
+ hw/arm/allwinner-h3.c           | 327 ++++++++++++++++++++++++++++++++
-files changed, 497 insertions(+), 1 deletion(-)
+ MAINTAINERS                     |   7 +
- create mode 100644 hw/arm/aspeed_ast2600.c
+ default-configs/arm-softmmu.mak |   1 +
  hw/arm/Kconfig                  |   8 +
 files changed, 450 insertions(+)
  create mode 100644 include/hw/arm/allwinner-h3.h
  create mode 100644 hw/arm/allwinner-h3.c
 diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Makefile.objs
 +++ b/hw/arm/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o xlnx-versal-virt.o
+@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_DIGIC) += digic.o
- obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
+ obj-$(CONFIG_OMAP) += omap1.o omap2.o
- obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
+ obj-$(CONFIG_STRONGARM) += strongarm.o
- obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o
+ obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
--obj-$(CONFIG_ASPEED_SOC) += aspeed_soc.o aspeed.o
++obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3.o
-+obj-$(CONFIG_ASPEED_SOC) += aspeed_soc.o aspeed.o aspeed_ast2600.o
+ obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
- obj-$(CONFIG_MPS2) += mps2.o
+ obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
- obj-$(CONFIG_MPS2) += mps2-tz.o
+ obj-$(CONFIG_STM32F405_SOC) += stm32f405_soc.o
- obj-$(CONFIG_MSF2) += msf2-soc.o
+diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
 diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/aspeed_soc.h
 +++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
  #ifndef ASPEED_SOC_H
  #define ASPEED_SOC_H
 +#include "hw/cpu/a15mpcore.h"
  #include "hw/intc/aspeed_vic.h"
  #include "hw/misc/aspeed_scu.h"
  #include "hw/misc/aspeed_sdmc.h"
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
      /*< public >*/
      ARMCPU cpu[ASPEED_CPUS_NUM];
      uint32_t num_cpus;
 +    A15MPPrivState     a7mpcore;
      MemoryRegion sram;
      AspeedVICState vic;
      AspeedRtcState rtc;
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
      AspeedWDTState wdt[ASPEED_WDTS_NUM];
      FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
      AspeedGPIOState gpio;
 +    AspeedGPIOState gpio_1_8v;
      AspeedSDHCIState sdhci;
  } AspeedSoCState;
@@ -XXX,XX +XXX,XX @@ enum {
      ASPEED_SRAM,
      ASPEED_SDHCI,
      ASPEED_GPIO,
 +    ASPEED_GPIO_1_8V,
      ASPEED_RTC,
      ASPEED_TIMER1,
      ASPEED_TIMER2,
 diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/arm/aspeed_ast2600.c
++++ b/include/hw/arm/allwinner-h3.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * ASPEED SoC 2600 family
++ * Allwinner H3 System on Chip emulation
 + *
-+ * Copyright (c) 2016-2019, IBM Corporation.
++ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
-+ * This code is licensed under the GPL version 2 or later.  See
++ * This program is free software: you can redistribute it and/or modify
-+ * the COPYING file in the top-level directory.
++ * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
++/*
++ * The Allwinner H3 is a System on Chip containing four ARM Cortex A7
++ * processor cores. Features and specifications include DDR2/DDR3 memory,
++ * SD/MMC storage cards, 10/100/1000Mbit Ethernet, USB 2.0, HDMI and
++ * various I/O modules.
++ *
++ * This implementation is based on the following datasheet:
++ *
++ *   https://linux-sunxi.org/File:Allwinner_H3_Datasheet_V1.2.pdf
++ *
++ * The latest datasheet and more info can be found on the Linux Sunxi wiki:
++ *
++ *   https://linux-sunxi.org/H3
++ */
++
++#ifndef HW_ARM_ALLWINNER_H3_H
++#define HW_ARM_ALLWINNER_H3_H
++
++#include "qom/object.h"
++#include "hw/arm/boot.h"
++#include "hw/timer/allwinner-a10-pit.h"
++#include "hw/intc/arm_gic.h"
++#include "target/arm/cpu.h"
++
++/**
++ * Allwinner H3 device list
++ *
++ * This enumeration is can be used refer to a particular device in the
++ * Allwinner H3 SoC. For example, the physical memory base address for
++ * each device can be found in the AwH3State object in the memmap member
++ * using the device enum value as index.
++ *
++ * @see AwH3State
++ */
++enum {
++    AW_H3_SRAM_A1,
++    AW_H3_SRAM_A2,
++    AW_H3_SRAM_C,
++    AW_H3_PIT,
++    AW_H3_UART0,
++    AW_H3_UART1,
++    AW_H3_UART2,
++    AW_H3_UART3,
++    AW_H3_GIC_DIST,
++    AW_H3_GIC_CPU,
++    AW_H3_GIC_HYP,
++    AW_H3_GIC_VCPU,
++    AW_H3_SDRAM
++};
++
++/** Total number of CPU cores in the H3 SoC */
++#define AW_H3_NUM_CPUS      (4)
++
++/**
++ * Allwinner H3 object model
++ * @{
++ */
++
++/** Object type for the Allwinner H3 SoC */
++#define TYPE_AW_H3 "allwinner-h3"
++
++/** Convert input object to Allwinner H3 state object */
++#define AW_H3(obj) OBJECT_CHECK(AwH3State, (obj), TYPE_AW_H3)
++
++/** @} */
++
++/**
++ * Allwinner H3 object
++ *
++ * This struct contains the state of all the devices
++ * which are currently emulated by the H3 SoC code.
++ */
++typedef struct AwH3State {
++    /*< private >*/
++    DeviceState parent_obj;
++    /*< public >*/
++
++    ARMCPU cpus[AW_H3_NUM_CPUS];
++    const hwaddr *memmap;
++    AwA10PITState timer;
++    GICState gic;
++    MemoryRegion sram_a1;
++    MemoryRegion sram_a2;
++    MemoryRegion sram_c;
++} AwH3State;
++
++#endif /* HW_ARM_ALLWINNER_H3_H */
+diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/hw/arm/allwinner-h3.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * Allwinner H3 System on Chip emulation
++ *
++ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
++ *
++ * This program is free software: you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation, either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
++ */
++
 +#include "qemu/osdep.h"
++#include "exec/address-spaces.h"
 +#include "qapi/error.h"
++#include "qemu/error-report.h"
++#include "qemu/module.h"
++#include "qemu/units.h"
++#include "hw/qdev-core.h"
 +#include "cpu.h"
-+#include "exec/address-spaces.h"
++#include "hw/sysbus.h"
 +#include "hw/char/serial.h"
 +#include "hw/misc/unimp.h"
-+#include "hw/arm/aspeed_soc.h"
-+#include "hw/char/serial.h"
-+#include "qemu/log.h"
-+#include "qemu/module.h"
-+#include "qemu/error-report.h"
-+#include "hw/i2c/aspeed_i2c.h"
-+#include "net/net.h"
 +#include "sysemu/sysemu.h"
-+
++#include "hw/arm/allwinner-h3.h"
-+#define ASPEED_SOC_IOMEM_SIZE       0x00200000
++
-+
++/* Memory map */
-+static const hwaddr aspeed_soc_ast2600_memmap[] = {
++const hwaddr allwinner_h3_memmap[] = {
-+    [ASPEED_SRAM]      = 0x10000000,
++    [AW_H3_SRAM_A1]    = 0x00000000,
-+    /* 0x16000000     0x17FFFFFF : AHB BUS do LPC Bus bridge */
++    [AW_H3_SRAM_A2]    = 0x00044000,
-+    [ASPEED_IOMEM]     = 0x1E600000,
++    [AW_H3_SRAM_C]     = 0x00010000,
-+    [ASPEED_PWM]       = 0x1E610000,
++    [AW_H3_PIT]        = 0x01c20c00,
-+    [ASPEED_FMC]       = 0x1E620000,
++    [AW_H3_UART0]      = 0x01c28000,
-+    [ASPEED_SPI1]      = 0x1E630000,
++    [AW_H3_UART1]      = 0x01c28400,
-+    [ASPEED_SPI2]      = 0x1E641000,
++    [AW_H3_UART2]      = 0x01c28800,
-+    [ASPEED_ETH1]      = 0x1E660000,
++    [AW_H3_UART3]      = 0x01c28c00,
-+    [ASPEED_ETH2]      = 0x1E680000,
++    [AW_H3_GIC_DIST]   = 0x01c81000,
-+    [ASPEED_VIC]       = 0x1E6C0000,
++    [AW_H3_GIC_CPU]    = 0x01c82000,
-+    [ASPEED_SDMC]      = 0x1E6E0000,
++    [AW_H3_GIC_HYP]    = 0x01c84000,
-+    [ASPEED_SCU]       = 0x1E6E2000,
++    [AW_H3_GIC_VCPU]   = 0x01c86000,
-+    [ASPEED_XDMA]      = 0x1E6E7000,
++    [AW_H3_SDRAM]      = 0x40000000
-+    [ASPEED_ADC]       = 0x1E6E9000,
++};
-+    [ASPEED_SDHCI]     = 0x1E740000,
++
-+    [ASPEED_GPIO]      = 0x1E780000,
++/* List of unimplemented devices */
-+    [ASPEED_GPIO_1_8V] = 0x1E780800,
++struct AwH3Unimplemented {
-+    [ASPEED_RTC]       = 0x1E781000,
++    const char *device_name;
-+    [ASPEED_TIMER1]    = 0x1E782000,
++    hwaddr base;
-+    [ASPEED_WDT]       = 0x1E785000,
++    hwaddr size;
-+    [ASPEED_LPC]       = 0x1E789000,
++} unimplemented[] = {
-+    [ASPEED_IBT]       = 0x1E789140,
++    { "d-engine",  0x01000000, 4 * MiB },
-+    [ASPEED_I2C]       = 0x1E78A000,
++    { "d-inter",   0x01400000, 128 * KiB },
-+    [ASPEED_UART1]     = 0x1E783000,
++    { "syscon",    0x01c00000, 4 * KiB },
-+    [ASPEED_UART5]     = 0x1E784000,
++    { "dma",       0x01c02000, 4 * KiB },
-+    [ASPEED_VUART]     = 0x1E787000,
++    { "nfdc",      0x01c03000, 4 * KiB },
-+    [ASPEED_SDRAM]     = 0x80000000,
++    { "ts",        0x01c06000, 4 * KiB },
-+};
++    { "keymem",    0x01c0b000, 4 * KiB },
-+
++    { "lcd0",      0x01c0c000, 4 * KiB },
-+#define ASPEED_A7MPCORE_ADDR 0x40460000
++    { "lcd1",      0x01c0d000, 4 * KiB },
-+
++    { "ve",        0x01c0e000, 4 * KiB },
-+#define ASPEED_SOC_AST2600_MAX_IRQ 128
++    { "mmc0",      0x01c0f000, 4 * KiB },
-+
++    { "mmc1",      0x01c10000, 4 * KiB },
-+static const int aspeed_soc_ast2600_irqmap[] = {
++    { "mmc2",      0x01c11000, 4 * KiB },
-+    [ASPEED_UART1]     = 47,
++    { "sid",       0x01c14000, 1 * KiB },
-+    [ASPEED_UART2]     = 48,
++    { "crypto",    0x01c15000, 4 * KiB },
-+    [ASPEED_UART3]     = 49,
++    { "msgbox",    0x01c17000, 4 * KiB },
-+    [ASPEED_UART4]     = 50,
++    { "spinlock",  0x01c18000, 4 * KiB },
-+    [ASPEED_UART5]     = 8,
++    { "usb0-otg",  0x01c19000, 4 * KiB },
-+    [ASPEED_VUART]     = 8,
++    { "usb0-phy",  0x01c1a000, 4 * KiB },
-+    [ASPEED_FMC]       = 39,
++    { "usb1-phy",  0x01c1b000, 4 * KiB },
-+    [ASPEED_SDMC]      = 0,
++    { "usb2-phy",  0x01c1c000, 4 * KiB },
-+    [ASPEED_SCU]       = 12,
++    { "usb3-phy",  0x01c1d000, 4 * KiB },
-+    [ASPEED_ADC]       = 78,
++    { "smc",       0x01c1e000, 4 * KiB },
-+    [ASPEED_XDMA]      = 6,
++    { "ccu",       0x01c20000, 1 * KiB },
-+    [ASPEED_SDHCI]     = 43,
++    { "pio",       0x01c20800, 1 * KiB },
-+    [ASPEED_GPIO]      = 40,
++    { "owa",       0x01c21000, 1 * KiB },
-+    [ASPEED_GPIO_1_8V] = 11,
++    { "pwm",       0x01c21400, 1 * KiB },
-+    [ASPEED_RTC]       = 13,
++    { "keyadc",    0x01c21800, 1 * KiB },
-+    [ASPEED_TIMER1]    = 16,
++    { "pcm0",      0x01c22000, 1 * KiB },
-+    [ASPEED_TIMER2]    = 17,
++    { "pcm1",      0x01c22400, 1 * KiB },
-+    [ASPEED_TIMER3]    = 18,
++    { "pcm2",      0x01c22800, 1 * KiB },
-+    [ASPEED_TIMER4]    = 19,
++    { "audio",     0x01c22c00, 2 * KiB },
-+    [ASPEED_TIMER5]    = 20,
++    { "smta",      0x01c23400, 1 * KiB },
-+    [ASPEED_TIMER6]    = 21,
++    { "ths",       0x01c25000, 1 * KiB },
-+    [ASPEED_TIMER7]    = 22,
++    { "uart0",     0x01c28000, 1 * KiB },
-+    [ASPEED_TIMER8]    = 23,
++    { "uart1",     0x01c28400, 1 * KiB },
-+    [ASPEED_WDT]       = 24,
++    { "uart2",     0x01c28800, 1 * KiB },
-+    [ASPEED_PWM]       = 44,
++    { "uart3",     0x01c28c00, 1 * KiB },
-+    [ASPEED_LPC]       = 35,
++    { "twi0",      0x01c2ac00, 1 * KiB },
-+    [ASPEED_IBT]       = 35,    /* LPC */
++    { "twi1",      0x01c2b000, 1 * KiB },
-+    [ASPEED_I2C]       = 110,   /* 110 -> 125 */
++    { "twi2",      0x01c2b400, 1 * KiB },
-+    [ASPEED_ETH1]      = 2,
++    { "scr",       0x01c2c400, 1 * KiB },
-+    [ASPEED_ETH2]      = 3,
++    { "emac",      0x01c30000, 64 * KiB },
-+};
++    { "gpu",       0x01c40000, 64 * KiB },
-+
++    { "hstmr",     0x01c60000, 4 * KiB },
-+static qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int ctrl)
++    { "dramcom",   0x01c62000, 4 * KiB },
 +    { "dramctl0",  0x01c63000, 4 * KiB },
 +    { "dramphy0",  0x01c65000, 4 * KiB },
 +    { "spi0",      0x01c68000, 4 * KiB },
 +    { "spi1",      0x01c69000, 4 * KiB },
 +    { "csi",       0x01cb0000, 320 * KiB },
 +    { "tve",       0x01e00000, 64 * KiB },
 +    { "hdmi",      0x01ee0000, 128 * KiB },
 +    { "rtc",       0x01f00000, 1 * KiB },
 +    { "r_timer",   0x01f00800, 1 * KiB },
 +    { "r_intc",    0x01f00c00, 1 * KiB },
 +    { "r_wdog",    0x01f01000, 1 * KiB },
 +    { "r_prcm",    0x01f01400, 1 * KiB },
 +    { "r_twd",     0x01f01800, 1 * KiB },
 +    { "r_cpucfg",  0x01f01c00, 1 * KiB },
 +    { "r_cir-rx",  0x01f02000, 1 * KiB },
 +    { "r_twi",     0x01f02400, 1 * KiB },
 +    { "r_uart",    0x01f02800, 1 * KiB },
 +    { "r_pio",     0x01f02c00, 1 * KiB },
 +    { "r_pwm",     0x01f03800, 1 * KiB },
 +    { "core-dbg",  0x3f500000, 128 * KiB },
 +    { "tsgen-ro",  0x3f506000, 4 * KiB },
 +    { "tsgen-ctl", 0x3f507000, 4 * KiB },
 +    { "ddr-mem",   0x40000000, 2 * GiB },
 +    { "n-brom",    0xffff0000, 32 * KiB },
 +    { "s-brom",    0xffff0000, 64 * KiB }
 +};
 +
 +/* Per Processor Interrupts */
 +enum {
 +    AW_H3_GIC_PPI_MAINT     =  9,
 +    AW_H3_GIC_PPI_HYPTIMER  = 10,
 +    AW_H3_GIC_PPI_VIRTTIMER = 11,
 +    AW_H3_GIC_PPI_SECTIMER  = 13,
 +    AW_H3_GIC_PPI_PHYSTIMER = 14
 +};
 +
 +/* Shared Processor Interrupts */
 +enum {
 +    AW_H3_GIC_SPI_UART0     =  0,
 +    AW_H3_GIC_SPI_UART1     =  1,
 +    AW_H3_GIC_SPI_UART2     =  2,
 +    AW_H3_GIC_SPI_UART3     =  3,
 +    AW_H3_GIC_SPI_TIMER0    = 18,
 +    AW_H3_GIC_SPI_TIMER1    = 19,
 +};
 +
 +/* Allwinner H3 general constants */
 +enum {
 +    AW_H3_GIC_NUM_SPI       = 128
 +};
 +
 +static void allwinner_h3_init(Object *obj)
 +{
-+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
++    AwH3State *s = AW_H3(obj);
 +
-+    return qdev_get_gpio_in(DEVICE(&s->a7mpcore), sc->irqmap[ctrl]);
++    s->memmap = allwinner_h3_memmap;
-+}
++
-+
++    for (int i = 0; i < AW_H3_NUM_CPUS; i++) {
-+static void aspeed_soc_ast2600_init(Object *obj)
++        object_initialize_child(obj, "cpu[*]", &s->cpus[i], sizeof(s->cpus[i]),
-+{
++                                ARM_CPU_TYPE_NAME("cortex-a7"),
 +    AspeedSoCState *s = ASPEED_SOC(obj);
 +    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 +    int i;
 +    char socname[8];
 +    char typename[64];
 +
 +    if (sscanf(sc->name, "%7s", socname) != 1) {
 +        g_assert_not_reached();
 +    }
 +
 +    for (i = 0; i < sc->num_cpus; i++) {
 +        object_initialize_child(obj, "cpu[*]", OBJECT(&s->cpu[i]),
 +                                sizeof(s->cpu[i]), sc->cpu_type,
 +                                &error_abort, NULL);
 +    }
 +
-+    snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
++    sysbus_init_child_obj(obj, "gic", &s->gic, sizeof(s->gic),
-+    sysbus_init_child_obj(obj, "scu", OBJECT(&s->scu), sizeof(s->scu),
++                          TYPE_ARM_GIC);
-+                          typename);
++
-+    qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev",
++    sysbus_init_child_obj(obj, "timer", &s->timer, sizeof(s->timer),
-+                         sc->silicon_rev);
++                          TYPE_AW_A10_PIT);
-+    object_property_add_alias(obj, "hw-strap1", OBJECT(&s->scu),
++    object_property_add_alias(obj, "clk0-freq", OBJECT(&s->timer),
-+                              "hw-strap1", &error_abort);
++                              "clk0-freq", &error_abort);
-+    object_property_add_alias(obj, "hw-strap2", OBJECT(&s->scu),
++    object_property_add_alias(obj, "clk1-freq", OBJECT(&s->timer),
-+                              "hw-strap2", &error_abort);
++                              "clk1-freq", &error_abort);
-+    object_property_add_alias(obj, "hw-prot-key", OBJECT(&s->scu),
++}
-+                              "hw-prot-key", &error_abort);
++
-+
++static void allwinner_h3_realize(DeviceState *dev, Error **errp)
-+    sysbus_init_child_obj(obj, "a7mpcore", &s->a7mpcore,
++{
-+                          sizeof(s->a7mpcore), TYPE_A15MPCORE_PRIV);
++    AwH3State *s = AW_H3(dev);
-+
++    unsigned i;
-+    sysbus_init_child_obj(obj, "rtc", OBJECT(&s->rtc), sizeof(s->rtc),
++
-+                          TYPE_ASPEED_RTC);
++    /* CPUs */
-+
++    for (i = 0; i < AW_H3_NUM_CPUS; i++) {
-+    snprintf(typename, sizeof(typename), "aspeed.timer-%s", socname);
++
-+    sysbus_init_child_obj(obj, "timerctrl", OBJECT(&s->timerctrl),
++        /* Provide Power State Coordination Interface */
-+                          sizeof(s->timerctrl), typename);
++        qdev_prop_set_int32(DEVICE(&s->cpus[i]), "psci-conduit",
-+    object_property_add_const_link(OBJECT(&s->timerctrl), "scu",
++                            QEMU_PSCI_CONDUIT_HVC);
-+                                   OBJECT(&s->scu), &error_abort);
++
-+
++        /* Disable secondary CPUs */
-+    snprintf(typename, sizeof(typename), "aspeed.i2c-%s", socname);
++        qdev_prop_set_bit(DEVICE(&s->cpus[i]), "start-powered-off",
-+    sysbus_init_child_obj(obj, "i2c", OBJECT(&s->i2c), sizeof(s->i2c),
++                          i > 0);
-+                          typename);
++
-+
++        /* All exception levels required */
-+    snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
++        qdev_prop_set_bit(DEVICE(&s->cpus[i]), "has_el3", true);
-+    sysbus_init_child_obj(obj, "fmc", OBJECT(&s->fmc), sizeof(s->fmc),
++        qdev_prop_set_bit(DEVICE(&s->cpus[i]), "has_el2", true);
-+                          typename);
++
-+    object_property_add_alias(obj, "num-cs", OBJECT(&s->fmc), "num-cs",
++        /* Mark realized */
-+                              &error_abort);
++        qdev_init_nofail(DEVICE(&s->cpus[i]));
 +    object_property_add_alias(obj, "dram", OBJECT(&s->fmc), "dram",
 +                              &error_abort);
 +
 +    for (i = 0; i < sc->spis_num; i++) {
 +        snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
 +        sysbus_init_child_obj(obj, "spi[*]", OBJECT(&s->spi[i]),
 +                              sizeof(s->spi[i]), typename);
 +    }
 +
-+    snprintf(typename, sizeof(typename), "aspeed.sdmc-%s", socname);
++    /* Generic Interrupt Controller */
-+    sysbus_init_child_obj(obj, "sdmc", OBJECT(&s->sdmc), sizeof(s->sdmc),
++    qdev_prop_set_uint32(DEVICE(&s->gic), "num-irq", AW_H3_GIC_NUM_SPI +
-+                          typename);
++                                                     GIC_INTERNAL);
-+    object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
++    qdev_prop_set_uint32(DEVICE(&s->gic), "revision", 2);
-+                              "ram-size", &error_abort);
++    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", AW_H3_NUM_CPUS);
-+    object_property_add_alias(obj, "max-ram-size", OBJECT(&s->sdmc),
++    qdev_prop_set_bit(DEVICE(&s->gic), "has-security-extensions", false);
-+                              "max-ram-size", &error_abort);
++    qdev_prop_set_bit(DEVICE(&s->gic), "has-virtualization-extensions", true);
-+
++    qdev_init_nofail(DEVICE(&s->gic));
-+    for (i = 0; i < sc->wdts_num; i++) {
++
-+        snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 0, s->memmap[AW_H3_GIC_DIST]);
-+        sysbus_init_child_obj(obj, "wdt[*]", OBJECT(&s->wdt[i]),
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 1, s->memmap[AW_H3_GIC_CPU]);
-+                              sizeof(s->wdt[i]), typename);
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 2, s->memmap[AW_H3_GIC_HYP]);
-+        object_property_add_const_link(OBJECT(&s->wdt[i]), "scu",
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 3, s->memmap[AW_H3_GIC_VCPU]);
-+                                       OBJECT(&s->scu), &error_abort);
++
 +    /*
 +     * Wire the outputs from each CPU's generic timer and the GICv3
 +     * maintenance interrupt signal to the appropriate GIC PPI inputs,
 +     * and the GIC's IRQ/FIQ/VIRQ/VFIQ interrupt outputs to the CPU's inputs.
 +     */
 +    for (i = 0; i < AW_H3_NUM_CPUS; i++) {
 +        DeviceState *cpudev = DEVICE(&s->cpus[i]);
 +        int ppibase = AW_H3_GIC_NUM_SPI + i * GIC_INTERNAL + GIC_NR_SGIS;
 +        int irq;
 +        /*
 +         * Mapping from the output timer irq lines from the CPU to the
 +         * GIC PPI inputs used for this board.
 +         */
 +        const int timer_irq[] = {
 +            [GTIMER_PHYS] = AW_H3_GIC_PPI_PHYSTIMER,
 +            [GTIMER_VIRT] = AW_H3_GIC_PPI_VIRTTIMER,
 +            [GTIMER_HYP]  = AW_H3_GIC_PPI_HYPTIMER,
 +            [GTIMER_SEC]  = AW_H3_GIC_PPI_SECTIMER,
 +        };
 +
 +        /* Connect CPU timer outputs to GIC PPI inputs */
 +        for (irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {
 +            qdev_connect_gpio_out(cpudev, irq,
 +                                  qdev_get_gpio_in(DEVICE(&s->gic),
 +                                                   ppibase + timer_irq[irq]));
 +        }
 +
 +        /* Connect GIC outputs to CPU interrupt inputs */
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i,
 +                           qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i + AW_H3_NUM_CPUS,
 +                           qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i + (2 * AW_H3_NUM_CPUS),
 +                           qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i + (3 * AW_H3_NUM_CPUS),
 +                           qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
 +
 +        /* GIC maintenance signal */
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i + (4 * AW_H3_NUM_CPUS),
 +                           qdev_get_gpio_in(DEVICE(&s->gic),
 +                                            ppibase + AW_H3_GIC_PPI_MAINT));
 +    }
 +
-+    for (i = 0; i < ASPEED_MACS_NUM; i++) {
++    /* Timer */
-+        sysbus_init_child_obj(obj, "ftgmac100[*]", OBJECT(&s->ftgmac100[i]),
++    qdev_init_nofail(DEVICE(&s->timer));
-+                              sizeof(s->ftgmac100[i]), TYPE_FTGMAC100);
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->timer), 0, s->memmap[AW_H3_PIT]);
-+    }
++    sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer), 0,
-+
++                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TIMER0));
-+    sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
++    sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer), 1,
-+                          TYPE_ASPEED_XDMA);
++                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TIMER1));
 +
-+    snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
++    /* SRAM */
-+    sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
++    memory_region_init_ram(&s->sram_a1, OBJECT(dev), "sram A1",
-+                          typename);
++                            64 * KiB, &error_abort);
-+
++    memory_region_init_ram(&s->sram_a2, OBJECT(dev), "sram A2",
-+    snprintf(typename, sizeof(typename), "aspeed.gpio-%s-1_8v", socname);
++                            32 * KiB, &error_abort);
-+    sysbus_init_child_obj(obj, "gpio_1_8v", OBJECT(&s->gpio_1_8v),
++    memory_region_init_ram(&s->sram_c, OBJECT(dev), "sram C",
-+                          sizeof(s->gpio_1_8v), typename);
++                            44 * KiB, &error_abort);
-+
++    memory_region_add_subregion(get_system_memory(), s->memmap[AW_H3_SRAM_A1],
-+    sysbus_init_child_obj(obj, "sdc", OBJECT(&s->sdhci), sizeof(s->sdhci),
++                                &s->sram_a1);
-+                          TYPE_ASPEED_SDHCI);
++    memory_region_add_subregion(get_system_memory(), s->memmap[AW_H3_SRAM_A2],
-+
++                                &s->sram_a2);
-+    /* Init sd card slot class here so that they're under the correct parent */
++    memory_region_add_subregion(get_system_memory(), s->memmap[AW_H3_SRAM_C],
-+    for (i = 0; i < ASPEED_SDHCI_NUM_SLOTS; ++i) {
++                                &s->sram_c);
-+        sysbus_init_child_obj(obj, "sdhci[*]", OBJECT(&s->sdhci.slots[i]),
++
-+                              sizeof(s->sdhci.slots[i]), TYPE_SYSBUS_SDHCI);
++    /* UART0. For future clocktree API: All UARTS are connected to APB2_CLK. */
 +    serial_mm_init(get_system_memory(), s->memmap[AW_H3_UART0], 2,
 +                   qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART0),
 +                   115200, serial_hd(0), DEVICE_NATIVE_ENDIAN);
 +    /* UART1 */
 +    serial_mm_init(get_system_memory(), s->memmap[AW_H3_UART1], 2,
 +                   qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART1),
 +                   115200, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 +    /* UART2 */
 +    serial_mm_init(get_system_memory(), s->memmap[AW_H3_UART2], 2,
 +                   qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART2),
 +                   115200, serial_hd(2), DEVICE_NATIVE_ENDIAN);
 +    /* UART3 */
 +    serial_mm_init(get_system_memory(), s->memmap[AW_H3_UART3], 2,
 +                   qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART3),
 +                   115200, serial_hd(3), DEVICE_NATIVE_ENDIAN);
 +
 +    /* Unimplemented devices */
 +    for (i = 0; i < ARRAY_SIZE(unimplemented); i++) {
 +        create_unimplemented_device(unimplemented[i].device_name,
 +                                    unimplemented[i].base,
 +                                    unimplemented[i].size);
 +    }
 +}
 +
-+/*
++static void allwinner_h3_class_init(ObjectClass *oc, void *data)
 + * ASPEED ast2600 has 0xf as cluster ID
 + *
 + * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0388e/CIHEBGFG.html
 + */
 +static uint64_t aspeed_calc_affinity(int cpu)
 +{
 +    return (0xf << ARM_AFF1_SHIFT) | cpu;
 +}
 +
 +static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
 +{
 +    int i;
 +    AspeedSoCState *s = ASPEED_SOC(dev);
 +    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 +    Error *err = NULL, *local_err = NULL;
 +    qemu_irq irq;
 +
 +    /* IO space */
 +    create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_IOMEM],
 +                                ASPEED_SOC_IOMEM_SIZE);
 +
 +    if (s->num_cpus > sc->num_cpus) {
 +        warn_report("%s: invalid number of CPUs %d, using default %d",
 +                    sc->name, s->num_cpus, sc->num_cpus);
 +        s->num_cpus = sc->num_cpus;
 +    }
 +
 +    /* CPU */
 +    for (i = 0; i < s->num_cpus; i++) {
 +        object_property_set_int(OBJECT(&s->cpu[i]), QEMU_PSCI_CONDUIT_SMC,
 +                                "psci-conduit", &error_abort);
 +        if (s->num_cpus > 1) {
 +            object_property_set_int(OBJECT(&s->cpu[i]),
 +                                    ASPEED_A7MPCORE_ADDR,
 +                                    "reset-cbar", &error_abort);
 +        }
 +        object_property_set_int(OBJECT(&s->cpu[i]), aspeed_calc_affinity(i),
 +                                "mp-affinity", &error_abort);
 +
 +        /*
 +         * TODO: the secondary CPUs are started and a boot helper
 +         * is needed when using -kernel
 +         */
 +
 +        object_property_set_bool(OBJECT(&s->cpu[i]), true, "realized", &err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +    }
 +
 +    /* A7MPCORE */
 +    object_property_set_int(OBJECT(&s->a7mpcore), s->num_cpus, "num-cpu",
 +                            &error_abort);
 +    object_property_set_int(OBJECT(&s->a7mpcore),
 +                            ASPEED_SOC_AST2600_MAX_IRQ + GIC_INTERNAL,
 +                            "num-irq", &error_abort);
 +
 +    object_property_set_bool(OBJECT(&s->a7mpcore), true, "realized",
 +                             &error_abort);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->a7mpcore), 0, ASPEED_A7MPCORE_ADDR);
 +
 +    for (i = 0; i < s->num_cpus; i++) {
 +        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->a7mpcore);
 +        DeviceState  *d   = DEVICE(qemu_get_cpu(i));
 +
 +        irq = qdev_get_gpio_in(d, ARM_CPU_IRQ);
 +        sysbus_connect_irq(sbd, i, irq);
 +        irq = qdev_get_gpio_in(d, ARM_CPU_FIQ);
 +        sysbus_connect_irq(sbd, i + s->num_cpus, irq);
 +        irq = qdev_get_gpio_in(d, ARM_CPU_VIRQ);
 +        sysbus_connect_irq(sbd, i + 2 * s->num_cpus, irq);
 +        irq = qdev_get_gpio_in(d, ARM_CPU_VFIQ);
 +        sysbus_connect_irq(sbd, i + 3 * s->num_cpus, irq);
 +    }
 +
 +    /* SRAM */
 +    memory_region_init_ram(&s->sram, OBJECT(dev), "aspeed.sram",
 +                           sc->sram_size, &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    memory_region_add_subregion(get_system_memory(),
 +                                sc->memmap[ASPEED_SRAM], &s->sram);
 +
 +    /* SCU */
 +    object_property_set_bool(OBJECT(&s->scu), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_SCU]);
 +
 +    /* RTC */
 +    object_property_set_bool(OBJECT(&s->rtc), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_RTC]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
 +                       aspeed_soc_get_irq(s, ASPEED_RTC));
 +
 +    /* Timer */
 +    object_property_set_bool(OBJECT(&s->timerctrl), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->timerctrl), 0,
 +                    sc->memmap[ASPEED_TIMER1]);
 +    for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
 +        qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_TIMER1 + i);
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->timerctrl), i, irq);
 +    }
 +
 +    /* UART - attach an 8250 to the IO space as our UART5 */
 +    if (serial_hd(0)) {
 +        qemu_irq uart5 = aspeed_soc_get_irq(s, ASPEED_UART5);
 +        serial_mm_init(get_system_memory(), sc->memmap[ASPEED_UART5], 2,
 +                       uart5, 38400, serial_hd(0), DEVICE_LITTLE_ENDIAN);
 +    }
 +
 +    /* I2C */
 +    object_property_set_bool(OBJECT(&s->i2c), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_I2C]);
 +    for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
 +        qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 +                                        sc->irqmap[ASPEED_I2C] + i);
 +        /*
 +         * The AST2600 SoC has one IRQ per I2C bus. Skip the common
 +         * IRQ (AST2400 and AST2500) and connect all bussses.
 +         */
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c), i + 1, irq);
 +    }
 +
 +    /* FMC, The number of CS is set at the board level */
 +    object_property_set_int(OBJECT(&s->fmc), sc->memmap[ASPEED_SDRAM],
 +                            "sdram-base", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    object_property_set_bool(OBJECT(&s->fmc), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_FMC]);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 1,
 +                    s->fmc.ctrl->flash_window_base);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
 +                       aspeed_soc_get_irq(s, ASPEED_FMC));
 +
 +    /* SPI */
 +    for (i = 0; i < sc->spis_num; i++) {
 +        object_property_set_int(OBJECT(&s->spi[i]), 1, "num-cs", &err);
 +        object_property_set_bool(OBJECT(&s->spi[i]), true, "realized",
 +                                 &local_err);
 +        error_propagate(&err, local_err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
 +                        sc->memmap[ASPEED_SPI1 + i]);
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 1,
 +                        s->spi[i].ctrl->flash_window_base);
 +    }
 +
 +    /* SDMC - SDRAM Memory Controller */
 +    object_property_set_bool(OBJECT(&s->sdmc), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, sc->memmap[ASPEED_SDMC]);
 +
 +    /* Watch dog */
 +    for (i = 0; i < sc->wdts_num; i++) {
 +        AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(&s->wdt[i]);
 +
 +        object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
 +                        sc->memmap[ASPEED_WDT] + i * awc->offset);
 +    }
 +
 +    /* Net */
 +    for (i = 0; i < nb_nics; i++) {
 +        qdev_set_nic_properties(DEVICE(&s->ftgmac100[i]), &nd_table[i]);
 +        object_property_set_bool(OBJECT(&s->ftgmac100[i]), true, "aspeed",
 +                                 &err);
 +        object_property_set_bool(OBJECT(&s->ftgmac100[i]), true, "realized",
 +                                 &local_err);
 +        error_propagate(&err, local_err);
 +        if (err) {
 +            error_propagate(errp, err);
 +           return;
 +        }
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
 +                        sc->memmap[ASPEED_ETH1 + i]);
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
 +                           aspeed_soc_get_irq(s, ASPEED_ETH1 + i));
 +    }
 +
 +    /* XDMA */
 +    object_property_set_bool(OBJECT(&s->xdma), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->xdma), 0,
 +                    sc->memmap[ASPEED_XDMA]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
 +                       aspeed_soc_get_irq(s, ASPEED_XDMA));
 +
 +    /* GPIO */
 +    object_property_set_bool(OBJECT(&s->gpio), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_GPIO]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
 +                       aspeed_soc_get_irq(s, ASPEED_GPIO));
 +
 +    object_property_set_bool(OBJECT(&s->gpio_1_8v), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
 +                    sc->memmap[ASPEED_GPIO_1_8V]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
 +                       aspeed_soc_get_irq(s, ASPEED_GPIO_1_8V));
 +
 +    /* SDHCI */
 +    object_property_set_bool(OBJECT(&s->sdhci), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
 +                    sc->memmap[ASPEED_SDHCI]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
 +                       aspeed_soc_get_irq(s, ASPEED_SDHCI));
 +}
 +
 +static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(oc);
-+    AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
++
-+
++    dc->realize = allwinner_h3_realize;
-+    dc->realize      = aspeed_soc_ast2600_realize;
++    /* Reason: uses serial_hd() in realize function */
-+
++    dc->user_creatable = false;
 +    sc->name         = "ast2600-a0";
 +    sc->cpu_type     = ARM_CPU_TYPE_NAME("cortex-a7");
 +    sc->silicon_rev  = AST2600_A0_SILICON_REV;
 +    sc->sram_size    = 0x10000;
 +    sc->spis_num     = 2;
 +    sc->wdts_num     = 4;
 +    sc->irqmap       = aspeed_soc_ast2600_irqmap;
 +    sc->memmap       = aspeed_soc_ast2600_memmap;
 +    sc->num_cpus     = 2;
 +}
 +
-+static const TypeInfo aspeed_soc_ast2600_type_info = {
++static const TypeInfo allwinner_h3_type_info = {
-+    .name           = "ast2600-a0",
++    .name = TYPE_AW_H3,
-+    .parent         = TYPE_ASPEED_SOC,
++    .parent = TYPE_DEVICE,
-+    .instance_size  = sizeof(AspeedSoCState),
++    .instance_size = sizeof(AwH3State),
-+    .instance_init  = aspeed_soc_ast2600_init,
++    .instance_init = allwinner_h3_init,
-+    .class_init     = aspeed_soc_ast2600_class_init,
++    .class_init = allwinner_h3_class_init,
-+    .class_size     = sizeof(AspeedSoCClass),
++};
-+};
++
-+
++static void allwinner_h3_register_types(void)
 +static void aspeed_soc_register_types(void)
 +{
-+    type_register_static(&aspeed_soc_ast2600_type_info);
++    type_register_static(&allwinner_h3_type_info);
-+};
++}
 +
-+type_init(aspeed_soc_register_types)
++type_init(allwinner_h3_register_types)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/*/allwinner*
  F: include/hw/*/allwinner*
  F: hw/arm/cubieboard.c
 +Allwinner-h3
 +M: Niek Linnenbank <nieklinnenbank@gmail.com>
 +L: qemu-arm@nongnu.org
 +S: Maintained
 +F: hw/*/allwinner-h3*
 +F: include/hw/*/allwinner-h3*
 +
  ARM PrimeCell and CMSDK devices
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/arm-softmmu.mak
 +++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_FSL_IMX25=y
  CONFIG_FSL_IMX7=y
  CONFIG_FSL_IMX6UL=y
  CONFIG_SEMIHOSTING=y
 +CONFIG_ALLWINNER_H3=y
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
      select SERIAL
      select UNIMP
 +config ALLWINNER_H3
 +    bool
 +    select ALLWINNER_A10_PIT
 +    select SERIAL
 +    select ARM_TIMER
 +    select ARM_GIC
 +    select UNIMP
 +
  config RASPI
      bool
      select FRAMEBUFFER
 --
 .20.1

-[PULL 54/68] aspeed/i2c: Introduce an object class per SoC
+[PULL 13/36] hw/arm: add Xunlong Orange Pi PC machine
-From: Cédric Le Goater <clg@kaod.org>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-It prepares ground for register differences between SoCs.
+The Xunlong Orange Pi PC is an Allwinner H3 System on Chip
 based embedded computer with mainline support in both U-Boot
 and Linux. The board comes with a Quad Core Cortex A7 @ 1.3GHz,
 GiB RAM, 100Mbit ethernet, USB, SD/MMC, USB, HDMI and
 various other I/O. This commit add support for the Xunlong
 Orange Pi PC machine.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+Tested-by: KONRAD Frederic <frederic.konrad@adacore.com>
-Message-id: 20190925143248.10000-16-clg@kaod.org
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Acked-by: Igor Mammedov <imammedo@redhat.com>
 Message-id: 20200311221854.30370-3-nieklinnenbank@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/i2c/aspeed_i2c.h | 15 ++++++++++
+ hw/arm/Makefile.objs |  2 +-
- hw/arm/aspeed_soc.c         |  3 +-
+ hw/arm/orangepi.c    | 92 ++++++++++++++++++++++++++++++++++++++++++++
- hw/i2c/aspeed_i2c.c         | 60 ++++++++++++++++++++++++++++++++-----
+ MAINTAINERS          |  1 +
-files changed, 69 insertions(+), 9 deletions(-)
+files changed, 94 insertions(+), 1 deletion(-)
  create mode 100644 hw/arm/orangepi.c
-diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h
+diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i2c/aspeed_i2c.h
+--- a/hw/arm/Makefile.objs
-+++ b/include/hw/i2c/aspeed_i2c.h
++++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_DIGIC) += digic.o
  obj-$(CONFIG_OMAP) += omap1.o omap2.o
  obj-$(CONFIG_STRONGARM) += strongarm.o
  obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 -obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3.o
 +obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3.o orangepi.o
  obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
  obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
  obj-$(CONFIG_STM32F405_SOC) += stm32f405_soc.o
 diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/orangepi.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
++/*
++ * Orange Pi emulation
- #define TYPE_ASPEED_I2C "aspeed.i2c"
++ *
-+#define TYPE_ASPEED_2400_I2C TYPE_ASPEED_I2C "-ast2400"
++ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
-+#define TYPE_ASPEED_2500_I2C TYPE_ASPEED_I2C "-ast2500"
++ *
- #define ASPEED_I2C(obj) \
++ * This program is free software: you can redistribute it and/or modify
-     OBJECT_CHECK(AspeedI2CState, (obj), TYPE_ASPEED_I2C)
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation, either version 2 of the License, or
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedI2CState {
++ * (at your option) any later version.
-     AspeedI2CBus busses[ASPEED_I2C_NR_BUSSES];
++ *
- } AspeedI2CState;
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+#define ASPEED_I2C_CLASS(klass) \
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+     OBJECT_CLASS_CHECK(AspeedI2CClass, (klass), TYPE_ASPEED_I2C)
++ * GNU General Public License for more details.
-+#define ASPEED_I2C_GET_CLASS(obj) \
++ *
-+     OBJECT_GET_CLASS(AspeedI2CClass, (obj), TYPE_ASPEED_I2C)
++ * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+typedef struct AspeedI2CClass {
++#include "qemu/osdep.h"
-+    SysBusDeviceClass parent_class;
++#include "qemu/units.h"
 +#include "exec/address-spaces.h"
 +#include "qapi/error.h"
 +#include "cpu.h"
 +#include "hw/sysbus.h"
 +#include "hw/boards.h"
 +#include "hw/qdev-properties.h"
 +#include "hw/arm/allwinner-h3.h"
 +#include "sysemu/sysemu.h"
 +
-+    uint8_t num_busses;
++static struct arm_boot_info orangepi_binfo = {
-+    uint8_t reg_size;
++    .nb_cpus = AW_H3_NUM_CPUS,
 +    uint8_t gap;
 +} AspeedI2CClass;
 +
  I2CBus *aspeed_i2c_get_bus(DeviceState *dev, int busnr);
  #endif /* ASPEED_I2C_H */
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      object_property_add_const_link(OBJECT(&s->timerctrl), "scu",
                                     OBJECT(&s->scu), &error_abort);
 +    snprintf(typename, sizeof(typename), "aspeed.i2c-%s", socname);
      sysbus_init_child_obj(obj, "i2c", OBJECT(&s->i2c), sizeof(s->i2c),
 -                          TYPE_ASPEED_I2C);
 +                          typename);
      snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
      sysbus_init_child_obj(obj, "fmc", OBJECT(&s->fmc), sizeof(s->fmc),
 diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/i2c/aspeed_i2c.c
 +++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_reset(DeviceState *dev)
  {
      int i;
      AspeedI2CState *s = ASPEED_I2C(dev);
 +    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
      s->intr_status = 0;
 -    for (i = 0; i < ASPEED_I2C_NR_BUSSES; i++) {
 +    for (i = 0; i < aic->num_busses; i++) {
          s->busses[i].intr_ctrl = 0;
          s->busses[i].intr_status = 0;
          s->busses[i].cmd = 0;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_reset(DeviceState *dev)
  }
  /*
 - * Address Definitions
 + * Address Definitions (AST2400 and AST2500)
   *
   *   0x000 ... 0x03F: Global Register
   *   0x040 ... 0x07F: Device 1
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
      int i;
      SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
      AspeedI2CState *s = ASPEED_I2C(dev);
 +    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
      sysbus_init_irq(sbd, &s->irq);
      memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_i2c_ctrl_ops, s,
                            "aspeed.i2c", 0x1000);
      sysbus_init_mmio(sbd, &s->iomem);
 -    for (i = 0; i < ASPEED_I2C_NR_BUSSES; i++) {
 -        char name[16];
 -        int offset = i < 7 ? 1 : 5;
 +    for (i = 0; i < aic->num_busses; i++) {
 +        char name[32];
 +        int offset = i < aic->gap ? 1 : 5;
          snprintf(name, sizeof(name), "aspeed.i2c.%d", i);
          s->busses[i].controller = s;
          s->busses[i].id = i;
          s->busses[i].bus = i2c_init_bus(dev, name);
          memory_region_init_io(&s->busses[i].mr, OBJECT(dev),
 -                              &aspeed_i2c_bus_ops, &s->busses[i], name, 0x40);
 -        memory_region_add_subregion(&s->iomem, 0x40 * (i + offset),
 +                              &aspeed_i2c_bus_ops, &s->busses[i], name,
 +                              aic->reg_size);
 +        memory_region_add_subregion(&s->iomem, aic->reg_size * (i + offset),
                                      &s->busses[i].mr);
      }
  }
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_i2c_info = {
      .parent        = TYPE_SYS_BUS_DEVICE,
      .instance_size = sizeof(AspeedI2CState),
      .class_init    = aspeed_i2c_class_init,
 +    .class_size = sizeof(AspeedI2CClass),
 +    .abstract   = true,
 +};
 +
-+static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
++static void orangepi_init(MachineState *machine)
 +{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
++    AwH3State *h3;
 +    AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
 +
-+    dc->desc = "ASPEED 2400 I2C Controller";
++    /* BIOS is not supported by this board */
 +    if (bios_name) {
 +        error_report("BIOS not supported for this machine");
 +        exit(1);
 +    }
 +
-+    aic->num_busses = 14;
++    /* This board has fixed size RAM */
-+    aic->reg_size = 0x40;
++    if (machine->ram_size != 1 * GiB) {
-+    aic->gap = 7;
++        error_report("This machine can only be used with 1GiB of RAM");
 +        exit(1);
 +    }
 +
 +    /* Only allow Cortex-A7 for this board */
 +    if (strcmp(machine->cpu_type, ARM_CPU_TYPE_NAME("cortex-a7")) != 0) {
 +        error_report("This board can only be used with cortex-a7 CPU");
 +        exit(1);
 +    }
 +
 +    h3 = AW_H3(object_new(TYPE_AW_H3));
 +    object_property_add_child(OBJECT(machine), "soc", OBJECT(h3),
 +                              &error_abort);
 +    object_unref(OBJECT(h3));
 +
 +    /* Setup timer properties */
 +    object_property_set_int(OBJECT(h3), 32768, "clk0-freq",
 +                            &error_abort);
 +    object_property_set_int(OBJECT(h3), 24 * 1000 * 1000, "clk1-freq",
 +                            &error_abort);
 +
 +    /* Mark H3 object realized */
 +    object_property_set_bool(OBJECT(h3), true, "realized", &error_abort);
 +
 +    /* SDRAM */
 +    memory_region_add_subregion(get_system_memory(), h3->memmap[AW_H3_SDRAM],
 +                                machine->ram);
 +
 +    orangepi_binfo.loader_start = h3->memmap[AW_H3_SDRAM];
 +    orangepi_binfo.ram_size = machine->ram_size;
 +    arm_load_kernel(ARM_CPU(first_cpu), machine, &orangepi_binfo);
 +}
 +
-+static const TypeInfo aspeed_2400_i2c_info = {
++static void orangepi_machine_init(MachineClass *mc)
 +    .name = TYPE_ASPEED_2400_I2C,
 +    .parent = TYPE_ASPEED_I2C,
 +    .class_init = aspeed_2400_i2c_class_init,
 +};
 +
 +static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
 +{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
++    mc->desc = "Orange Pi PC";
-+    AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
++    mc->init = orangepi_init;
-+
++    mc->min_cpus = AW_H3_NUM_CPUS;
-+    dc->desc = "ASPEED 2500 I2C Controller";
++    mc->max_cpus = AW_H3_NUM_CPUS;
-+
++    mc->default_cpus = AW_H3_NUM_CPUS;
-+    aic->num_busses = 14;
++    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a7");
-+    aic->reg_size = 0x40;
++    mc->default_ram_size = 1 * GiB;
-+    aic->gap = 7;
++    mc->default_ram_id = "orangepi.ram";
 +}
 +
-+static const TypeInfo aspeed_2500_i2c_info = {
++DEFINE_MACHINE("orangepi-pc", orangepi_machine_init)
-+    .name = TYPE_ASPEED_2500_I2C,
+diff --git a/MAINTAINERS b/MAINTAINERS
-+    .parent = TYPE_ASPEED_I2C,
+index XXXXXXX..XXXXXXX 100644
-+    .class_init = aspeed_2500_i2c_class_init,
+--- a/MAINTAINERS
- };
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
- static void aspeed_i2c_register_types(void)
+ S: Maintained
- {
+ F: hw/*/allwinner-h3*
-     type_register_static(&aspeed_i2c_info);
+ F: include/hw/*/allwinner-h3*
-+    type_register_static(&aspeed_2400_i2c_info);
++F: hw/arm/orangepi.c
-+    type_register_static(&aspeed_2500_i2c_info);
- }
+ ARM PrimeCell and CMSDK devices
+ M: Peter Maydell <peter.maydell@linaro.org>
  type_init(aspeed_i2c_register_types)
@@ -XXX,XX +XXX,XX @@ type_init(aspeed_i2c_register_types)
  I2CBus *aspeed_i2c_get_bus(DeviceState *dev, int busnr)
  {
      AspeedI2CState *s = ASPEED_I2C(dev);
 +    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
      I2CBus *bus = NULL;
 -    if (busnr >= 0 && busnr < ASPEED_I2C_NR_BUSSES) {
 +    if (busnr >= 0 && busnr < aic->num_busses) {
          bus = s->busses[busnr].bus;
      }
 --
 .20.1

-[PULL 41/68] hw/sd/aspeed_sdhci: New device
+[PULL 14/36] hw/arm/allwinner-h3: add Clock Control Unit
-From: Eddie James <eajames@linux.ibm.com>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-The Aspeed SOCs have two SD/MMC controllers. Add a device that
+The Clock Control Unit is responsible for clock signal generation,
-encapsulates both of these controllers and models the Aspeed-specific
+configuration and distribution in the Allwinner H3 System on Chip.
-registers and behavior.
+This commit adds support for the Clock Control Unit which emulates
 a simple read/write register interface.
-Tested by reading from mmcblk0 in Linux:
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-qemu-system-arm -machine romulus-bmc -nographic \
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
- -drive file=flash-romulus,format=raw,if=mtd \
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
- -device sd-card,drive=sd0 -drive file=_tmp/kernel,format=raw,if=sd,id=sd0
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200311221854.30370-4-nieklinnenbank@gmail.com
 Signed-off-by: Eddie James <eajames@linux.ibm.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Joel Stanley <joel@jms.id.au>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20190925143248.10000-3-clg@kaod.org
 [clg: - changed the controller MMIO window size to 0x1000
       - moved the MMIO mapping of the SDHCI slots at the SoC level
       - merged code to add SD drives on the SD buses at the machine level ]
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/Makefile.objs          |   1 +
+ hw/misc/Makefile.objs              |   1 +
- include/hw/arm/aspeed_soc.h  |   3 +
+ include/hw/arm/allwinner-h3.h      |   3 +
- include/hw/sd/aspeed_sdhci.h |  34 ++++++
+ include/hw/misc/allwinner-h3-ccu.h |  66 ++++++++
- hw/arm/aspeed.c              |  15 ++-
+ hw/arm/allwinner-h3.c              |   9 +-
- hw/arm/aspeed_soc.c          |  23 ++++
+ hw/misc/allwinner-h3-ccu.c         | 242 +++++++++++++++++++++++++++++
- hw/sd/aspeed_sdhci.c         | 198 +++++++++++++++++++++++++++++++++++
+files changed, 320 insertions(+), 1 deletion(-)
-files changed, 273 insertions(+), 1 deletion(-)
+ create mode 100644 include/hw/misc/allwinner-h3-ccu.h
- create mode 100644 include/hw/sd/aspeed_sdhci.h
+ create mode 100644 hw/misc/allwinner-h3-ccu.c
  create mode 100644 hw/sd/aspeed_sdhci.c
-diff --git a/hw/sd/Makefile.objs b/hw/sd/Makefile.objs
+diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/Makefile.objs
+--- a/hw/misc/Makefile.objs
-+++ b/hw/sd/Makefile.objs
++++ b/hw/misc/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MILKYMIST) += milkymist-memcard.o
+@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_MACIO) += macio/
- obj-$(CONFIG_OMAP) += omap_mmc.o
- obj-$(CONFIG_PXA2XX) += pxa2xx_mmci.o
+ common-obj-$(CONFIG_IVSHMEM_DEVICE) += ivshmem.o
- obj-$(CONFIG_RASPI) += bcm2835_sdhost.o
-+obj-$(CONFIG_ASPEED_SOC) += aspeed_sdhci.o
++common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-ccu.o
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+ common-obj-$(CONFIG_REALVIEW) += arm_sysctl.o
  common-obj-$(CONFIG_NSERIES) += cbus.o
  common-obj-$(CONFIG_ECCMEMCTL) += eccmemctl.o
 diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/include/hw/arm/allwinner-h3.h
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/include/hw/arm/allwinner-h3.h
 @@ -XXX,XX +XXX,XX @@
- #include "hw/net/ftgmac100.h"
+ #include "hw/arm/boot.h"
  #include "hw/timer/allwinner-a10-pit.h"
  #include "hw/intc/arm_gic.h"
 +#include "hw/misc/allwinner-h3-ccu.h"
  #include "target/arm/cpu.h"
- #include "hw/gpio/aspeed_gpio.h"
-+#include "hw/sd/aspeed_sdhci.h"
+ /**
  #define ASPEED_SPIS_NUM  2
  #define ASPEED_WDTS_NUM  3
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
      AspeedWDTState wdt[ASPEED_WDTS_NUM];
      FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
      AspeedGPIOState gpio;
 +    AspeedSDHCIState sdhci;
  } AspeedSoCState;
  #define TYPE_ASPEED_SOC "aspeed-soc"
 @@ -XXX,XX +XXX,XX @@ enum {
-     ASPEED_SCU,
+     AW_H3_SRAM_A1,
-     ASPEED_ADC,
+     AW_H3_SRAM_A2,
-     ASPEED_SRAM,
+     AW_H3_SRAM_C,
-+    ASPEED_SDHCI,
++    AW_H3_CCU,
-     ASPEED_GPIO,
+     AW_H3_PIT,
-     ASPEED_RTC,
+     AW_H3_UART0,
-     ASPEED_TIMER1,
+     AW_H3_UART1,
-diff --git a/include/hw/sd/aspeed_sdhci.h b/include/hw/sd/aspeed_sdhci.h
+@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
      ARMCPU cpus[AW_H3_NUM_CPUS];
      const hwaddr *memmap;
      AwA10PITState timer;
 +    AwH3ClockCtlState ccu;
      GICState gic;
      MemoryRegion sram_a1;
      MemoryRegion sram_a2;
 diff --git a/include/hw/misc/allwinner-h3-ccu.h b/include/hw/misc/allwinner-h3-ccu.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/sd/aspeed_sdhci.h
++++ b/include/hw/misc/allwinner-h3-ccu.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Aspeed SD Host Controller
++ * Allwinner H3 Clock Control Unit emulation
-+ * Eddie James <eajames@linux.ibm.com>
++ *
-+ *
++ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
-+ * Copyright (C) 2019 IBM Corp
++ *
-+ * SPDX-License-Identifer: GPL-2.0-or-later
++ * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#ifndef ASPEED_SDHCI_H
++#ifndef HW_MISC_ALLWINNER_H3_CCU_H
-+#define ASPEED_SDHCI_H
++#define HW_MISC_ALLWINNER_H3_CCU_H
 +
-+#include "hw/sd/sdhci.h"
++#include "qom/object.h"
-+
++#include "hw/sysbus.h"
-+#define TYPE_ASPEED_SDHCI "aspeed.sdhci"
++
-+#define ASPEED_SDHCI(obj) OBJECT_CHECK(AspeedSDHCIState, (obj), \
++/**
-+                                       TYPE_ASPEED_SDHCI)
++ * @name Constants
-+
++ * @{
-+#define ASPEED_SDHCI_CAPABILITIES 0x01E80080
++ */
-+#define ASPEED_SDHCI_NUM_SLOTS    2
++
-+#define ASPEED_SDHCI_NUM_REGS     (ASPEED_SDHCI_REG_SIZE / sizeof(uint32_t))
++/** Size of register I/O address space used by CCU device */
-+#define ASPEED_SDHCI_REG_SIZE     0x100
++#define AW_H3_CCU_IOSIZE        (0x400)
 +
-+typedef struct AspeedSDHCIState {
++/** Total number of known registers */
-+    SysBusDevice parent;
++#define AW_H3_CCU_REGS_NUM      (AW_H3_CCU_IOSIZE / sizeof(uint32_t))
 +
-+    SDHCIState slots[ASPEED_SDHCI_NUM_SLOTS];
++/** @} */
 +
 +/**
 + * @name Object model
 + * @{
 + */
 +
 +#define TYPE_AW_H3_CCU    "allwinner-h3-ccu"
 +#define AW_H3_CCU(obj) \
 +    OBJECT_CHECK(AwH3ClockCtlState, (obj), TYPE_AW_H3_CCU)
 +
 +/** @} */
 +
 +/**
 + * Allwinner H3 CCU object instance state.
 + */
 +typedef struct AwH3ClockCtlState {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +    /*< public >*/
 +
 +    /** Maps I/O registers in physical memory */
 +    MemoryRegion iomem;
-+    qemu_irq irq;
++
-+
++    /** Array of hardware registers */
-+    uint32_t regs[ASPEED_SDHCI_NUM_REGS];
++    uint32_t regs[AW_H3_CCU_REGS_NUM];
-+} AspeedSDHCIState;
++
-+
++} AwH3ClockCtlState;
-+#endif /* ASPEED_SDHCI_H */
++
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
++#endif /* HW_MISC_ALLWINNER_H3_CCU_H */
 diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/hw/arm/allwinner-h3.c
-+++ b/hw/arm/aspeed.c
++++ b/hw/arm/allwinner-h3.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
-     AspeedSoCClass *sc;
+     [AW_H3_SRAM_A1]    = 0x00000000,
-     DriveInfo *drive0 = drive_get(IF_MTD, 0, 0);
+     [AW_H3_SRAM_A2]    = 0x00044000,
-     ram_addr_t max_ram_size;
+     [AW_H3_SRAM_C]     = 0x00010000,
-+    int i;
++    [AW_H3_CCU]        = 0x01c20000,
+     [AW_H3_PIT]        = 0x01c20c00,
-     bmc = g_new0(AspeedBoardState, 1);
+     [AW_H3_UART0]      = 0x01c28000,
+     [AW_H3_UART1]      = 0x01c28400,
-@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
-         cfg->i2c_init(bmc);
+     { "usb2-phy",  0x01c1c000, 4 * KiB },
-     }
+     { "usb3-phy",  0x01c1d000, 4 * KiB },
+     { "smc",       0x01c1e000, 4 * KiB },
-+    for (i = 0; i < ARRAY_SIZE(bmc->soc.sdhci.slots); i++) {
+-    { "ccu",       0x01c20000, 1 * KiB },
-+        SDHCIState *sdhci = &bmc->soc.sdhci.slots[i];
+     { "pio",       0x01c20800, 1 * KiB },
-+        DriveInfo *dinfo = drive_get_next(IF_SD);
+     { "owa",       0x01c21000, 1 * KiB },
-+        BlockBackend *blk;
+     { "pwm",       0x01c21400, 1 * KiB },
-+        DeviceState *card;
+@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
-+
+                               "clk0-freq", &error_abort);
-+        blk = dinfo ? blk_by_legacy_dinfo(dinfo) : NULL;
+     object_property_add_alias(obj, "clk1-freq", OBJECT(&s->timer),
-+        card = qdev_create(qdev_get_child_bus(DEVICE(sdhci), "sd-bus"),
+                               "clk1-freq", &error_abort);
-+                           TYPE_SD_CARD);
++
-+        qdev_prop_set_drive(card, "drive", blk, &error_fatal);
++    sysbus_init_child_obj(obj, "ccu", &s->ccu, sizeof(s->ccu),
-+        object_property_set_bool(OBJECT(card), true, "realized", &error_fatal);
++                          TYPE_AW_H3_CCU);
 +    }
 +
      arm_load_kernel(ARM_CPU(first_cpu), machine, &aspeed_board_binfo);
  }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_class_init(ObjectClass *oc, void *data)
+ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
-     mc->desc = board->desc;
+@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
-     mc->init = aspeed_machine_init;
+     memory_region_add_subregion(get_system_memory(), s->memmap[AW_H3_SRAM_C],
-     mc->max_cpus = ASPEED_CPUS_NUM;
+                                 &s->sram_c);
--    mc->no_sdcard = 1;
-     mc->no_floppy = 1;
++    /* Clock Control Unit */
-     mc->no_cdrom = 1;
++    qdev_init_nofail(DEVICE(&s->ccu));
-     mc->no_parallel = 1;
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->ccu), 0, s->memmap[AW_H3_CCU]);
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
++
-index XXXXXXX..XXXXXXX 100644
+     /* UART0. For future clocktree API: All UARTS are connected to APB2_CLK. */
---- a/hw/arm/aspeed_soc.c
+     serial_mm_init(get_system_memory(), s->memmap[AW_H3_UART0], 2,
-+++ b/hw/arm/aspeed_soc.c
+                    qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART0),
-@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2400_memmap[] = {
+diff --git a/hw/misc/allwinner-h3-ccu.c b/hw/misc/allwinner-h3-ccu.c
      [ASPEED_XDMA]   = 0x1E6E7000,
      [ASPEED_ADC]    = 0x1E6E9000,
      [ASPEED_SRAM]   = 0x1E720000,
 +    [ASPEED_SDHCI]  = 0x1E740000,
      [ASPEED_GPIO]   = 0x1E780000,
      [ASPEED_RTC]    = 0x1E781000,
      [ASPEED_TIMER1] = 0x1E782000,
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2500_memmap[] = {
      [ASPEED_XDMA]   = 0x1E6E7000,
      [ASPEED_ADC]    = 0x1E6E9000,
      [ASPEED_SRAM]   = 0x1E720000,
 +    [ASPEED_SDHCI]  = 0x1E740000,
      [ASPEED_GPIO]   = 0x1E780000,
      [ASPEED_RTC]    = 0x1E781000,
      [ASPEED_TIMER1] = 0x1E782000,
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2400_irqmap[] = {
      [ASPEED_ETH1]   = 2,
      [ASPEED_ETH2]   = 3,
      [ASPEED_XDMA]   = 6,
 +    [ASPEED_SDHCI]  = 26,
  };
  #define aspeed_soc_ast2500_irqmap aspeed_soc_ast2400_irqmap
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
      sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
                            typename);
 +
 +    sysbus_init_child_obj(obj, "sdc", OBJECT(&s->sdhci), sizeof(s->sdhci),
 +                          TYPE_ASPEED_SDHCI);
 +
 +    /* Init sd card slot class here so that they're under the correct parent */
 +    for (i = 0; i < ASPEED_SDHCI_NUM_SLOTS; ++i) {
 +        sysbus_init_child_obj(obj, "sdhci[*]", OBJECT(&s->sdhci.slots[i]),
 +                              sizeof(s->sdhci.slots[i]), TYPE_SYSBUS_SDHCI);
 +    }
  }
  static void aspeed_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->info->memmap[ASPEED_GPIO]);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                         aspeed_soc_get_irq(s, ASPEED_GPIO));
 +
 +    /* SDHCI */
 +    object_property_set_bool(OBJECT(&s->sdhci), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
 +                    sc->info->memmap[ASPEED_SDHCI]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
 +                       aspeed_soc_get_irq(s, ASPEED_SDHCI));
  }
  static Property aspeed_soc_properties[] = {
      DEFINE_PROP_UINT32("num-cpus", AspeedSoCState, num_cpus, 0),
 diff --git a/hw/sd/aspeed_sdhci.c b/hw/sd/aspeed_sdhci.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/sd/aspeed_sdhci.c
++++ b/hw/misc/allwinner-h3-ccu.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Aspeed SD Host Controller
++ * Allwinner H3 Clock Control Unit emulation
-+ * Eddie James <eajames@linux.ibm.com>
++ *
-+ *
++ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
-+ * Copyright (C) 2019 IBM Corp
++ *
-+ * SPDX-License-Identifer: GPL-2.0-or-later
++ * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
++#include "qemu/units.h"
++#include "hw/sysbus.h"
++#include "migration/vmstate.h"
 +#include "qemu/log.h"
-+#include "qemu/error-report.h"
++#include "qemu/module.h"
-+#include "hw/sd/aspeed_sdhci.h"
++#include "hw/misc/allwinner-h3-ccu.h"
-+#include "qapi/error.h"
++
-+#include "hw/irq.h"
++/* CCU register offsets */
-+#include "migration/vmstate.h"
++enum {
-+
++    REG_PLL_CPUX             = 0x0000, /* PLL CPUX Control */
-+#define ASPEED_SDHCI_INFO            0x00
++    REG_PLL_AUDIO            = 0x0008, /* PLL Audio Control */
-+#define  ASPEED_SDHCI_INFO_RESET     0x00030000
++    REG_PLL_VIDEO            = 0x0010, /* PLL Video Control */
-+#define ASPEED_SDHCI_DEBOUNCE        0x04
++    REG_PLL_VE               = 0x0018, /* PLL VE Control */
-+#define  ASPEED_SDHCI_DEBOUNCE_RESET 0x00000005
++    REG_PLL_DDR              = 0x0020, /* PLL DDR Control */
-+#define ASPEED_SDHCI_BUS             0x08
++    REG_PLL_PERIPH0          = 0x0028, /* PLL Peripherals 0 Control */
-+#define ASPEED_SDHCI_SDIO_140        0x10
++    REG_PLL_GPU              = 0x0038, /* PLL GPU Control */
-+#define ASPEED_SDHCI_SDIO_148        0x18
++    REG_PLL_PERIPH1          = 0x0044, /* PLL Peripherals 1 Control */
-+#define ASPEED_SDHCI_SDIO_240        0x20
++    REG_PLL_DE               = 0x0048, /* PLL Display Engine Control */
-+#define ASPEED_SDHCI_SDIO_248        0x28
++    REG_CPUX_AXI             = 0x0050, /* CPUX/AXI Configuration */
-+#define ASPEED_SDHCI_WP_POL          0xec
++    REG_APB1                 = 0x0054, /* ARM Peripheral Bus 1 Config */
-+#define ASPEED_SDHCI_CARD_DET        0xf0
++    REG_APB2                 = 0x0058, /* ARM Peripheral Bus 2 Config */
-+#define ASPEED_SDHCI_IRQ_STAT        0xfc
++    REG_DRAM_CFG             = 0x00F4, /* DRAM Configuration */
-+
++    REG_MBUS                 = 0x00FC, /* MBUS Reset */
-+#define TO_REG(addr) ((addr) / sizeof(uint32_t))
++    REG_PLL_TIME0            = 0x0200, /* PLL Stable Time 0 */
-+
++    REG_PLL_TIME1            = 0x0204, /* PLL Stable Time 1 */
-+static uint64_t aspeed_sdhci_read(void *opaque, hwaddr addr, unsigned int size)
++    REG_PLL_CPUX_BIAS        = 0x0220, /* PLL CPUX Bias */
-+{
++    REG_PLL_AUDIO_BIAS       = 0x0224, /* PLL Audio Bias */
-+    uint32_t val = 0;
++    REG_PLL_VIDEO_BIAS       = 0x0228, /* PLL Video Bias */
-+    AspeedSDHCIState *sdhci = opaque;
++    REG_PLL_VE_BIAS          = 0x022C, /* PLL VE Bias */
-+
++    REG_PLL_DDR_BIAS         = 0x0230, /* PLL DDR Bias */
-+    switch (addr) {
++    REG_PLL_PERIPH0_BIAS     = 0x0234, /* PLL Peripherals 0 Bias */
-+    case ASPEED_SDHCI_SDIO_140:
++    REG_PLL_GPU_BIAS         = 0x023C, /* PLL GPU Bias */
-+        val = (uint32_t)sdhci->slots[0].capareg;
++    REG_PLL_PERIPH1_BIAS     = 0x0244, /* PLL Peripherals 1 Bias */
 +    REG_PLL_DE_BIAS          = 0x0248, /* PLL Display Engine Bias */
 +    REG_PLL_CPUX_TUNING      = 0x0250, /* PLL CPUX Tuning */
 +    REG_PLL_DDR_TUNING       = 0x0260, /* PLL DDR Tuning */
 +};
 +
 +#define REG_INDEX(offset)    (offset / sizeof(uint32_t))
 +
 +/* CCU register flags */
 +enum {
 +    REG_DRAM_CFG_UPDATE      = (1 << 16),
 +};
 +
 +enum {
 +    REG_PLL_ENABLE           = (1 << 31),
 +    REG_PLL_LOCK             = (1 << 28),
 +};
 +
 +
 +/* CCU register reset values */
 +enum {
 +    REG_PLL_CPUX_RST         = 0x00001000,
 +    REG_PLL_AUDIO_RST        = 0x00035514,
 +    REG_PLL_VIDEO_RST        = 0x03006207,
 +    REG_PLL_VE_RST           = 0x03006207,
 +    REG_PLL_DDR_RST          = 0x00001000,
 +    REG_PLL_PERIPH0_RST      = 0x00041811,
 +    REG_PLL_GPU_RST          = 0x03006207,
 +    REG_PLL_PERIPH1_RST      = 0x00041811,
 +    REG_PLL_DE_RST           = 0x03006207,
 +    REG_CPUX_AXI_RST         = 0x00010000,
 +    REG_APB1_RST             = 0x00001010,
 +    REG_APB2_RST             = 0x01000000,
 +    REG_DRAM_CFG_RST         = 0x00000000,
 +    REG_MBUS_RST             = 0x80000000,
 +    REG_PLL_TIME0_RST        = 0x000000FF,
 +    REG_PLL_TIME1_RST        = 0x000000FF,
 +    REG_PLL_CPUX_BIAS_RST    = 0x08100200,
 +    REG_PLL_AUDIO_BIAS_RST   = 0x10100000,
 +    REG_PLL_VIDEO_BIAS_RST   = 0x10100000,
 +    REG_PLL_VE_BIAS_RST      = 0x10100000,
 +    REG_PLL_DDR_BIAS_RST     = 0x81104000,
 +    REG_PLL_PERIPH0_BIAS_RST = 0x10100010,
 +    REG_PLL_GPU_BIAS_RST     = 0x10100000,
 +    REG_PLL_PERIPH1_BIAS_RST = 0x10100010,
 +    REG_PLL_DE_BIAS_RST      = 0x10100000,
 +    REG_PLL_CPUX_TUNING_RST  = 0x0A101000,
 +    REG_PLL_DDR_TUNING_RST   = 0x14880000,
 +};
 +
 +static uint64_t allwinner_h3_ccu_read(void *opaque, hwaddr offset,
 +                                      unsigned size)
 +{
 +    const AwH3ClockCtlState *s = AW_H3_CCU(opaque);
 +    const uint32_t idx = REG_INDEX(offset);
 +
 +    switch (offset) {
 +    case 0x308 ... AW_H3_CCU_IOSIZE:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
 +                      __func__, (uint32_t)offset);
 +        return 0;
 +    }
 +
 +    return s->regs[idx];
 +}
 +
 +static void allwinner_h3_ccu_write(void *opaque, hwaddr offset,
 +                                   uint64_t val, unsigned size)
 +{
 +    AwH3ClockCtlState *s = AW_H3_CCU(opaque);
 +    const uint32_t idx = REG_INDEX(offset);
 +
 +    switch (offset) {
 +    case REG_DRAM_CFG:    /* DRAM Configuration */
 +        val &= ~REG_DRAM_CFG_UPDATE;
 +        break;
-+    case ASPEED_SDHCI_SDIO_148:
++    case REG_PLL_CPUX:    /* PLL CPUX Control */
-+        val = (uint32_t)sdhci->slots[0].maxcurr;
++    case REG_PLL_AUDIO:   /* PLL Audio Control */
 +    case REG_PLL_VIDEO:   /* PLL Video Control */
 +    case REG_PLL_VE:      /* PLL VE Control */
 +    case REG_PLL_DDR:     /* PLL DDR Control */
 +    case REG_PLL_PERIPH0: /* PLL Peripherals 0 Control */
 +    case REG_PLL_GPU:     /* PLL GPU Control */
 +    case REG_PLL_PERIPH1: /* PLL Peripherals 1 Control */
 +    case REG_PLL_DE:      /* PLL Display Engine Control */
 +        if (val & REG_PLL_ENABLE) {
 +            val |= REG_PLL_LOCK;
 +        }
 +        break;
-+    case ASPEED_SDHCI_SDIO_240:
++    case 0x308 ... AW_H3_CCU_IOSIZE:
-+        val = (uint32_t)sdhci->slots[1].capareg;
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
-+        break;
++                      __func__, (uint32_t)offset);
 +    case ASPEED_SDHCI_SDIO_248:
 +        val = (uint32_t)sdhci->slots[1].maxcurr;
 +        break;
 +    default:
-+        if (addr < ASPEED_SDHCI_REG_SIZE) {
++        qemu_log_mask(LOG_UNIMP, "%s: unimplemented write offset 0x%04x\n",
-+            val = sdhci->regs[TO_REG(addr)];
++                      __func__, (uint32_t)offset);
-+        } else {
++        break;
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: Out-of-bounds read at 0x%" HWADDR_PRIx "\n",
 +                          __func__, addr);
 +        }
 +    }
 +
-+    return (uint64_t)val;
++    s->regs[idx] = (uint32_t) val;
 +}
 +
-+static void aspeed_sdhci_write(void *opaque, hwaddr addr, uint64_t val,
++static const MemoryRegionOps allwinner_h3_ccu_ops = {
-+                               unsigned int size)
++    .read = allwinner_h3_ccu_read,
-+{
++    .write = allwinner_h3_ccu_write,
-+    AspeedSDHCIState *sdhci = opaque;
++    .endianness = DEVICE_NATIVE_ENDIAN,
-+
++    .valid = {
-+    switch (addr) {
++        .min_access_size = 4,
-+    case ASPEED_SDHCI_SDIO_140:
++        .max_access_size = 4,
-+        sdhci->slots[0].capareg = (uint64_t)(uint32_t)val;
++    },
-+        break;
++    .impl.min_access_size = 4,
-+    case ASPEED_SDHCI_SDIO_148:
++};
-+        sdhci->slots[0].maxcurr = (uint64_t)(uint32_t)val;
++
-+        break;
++static void allwinner_h3_ccu_reset(DeviceState *dev)
-+    case ASPEED_SDHCI_SDIO_240:
++{
-+        sdhci->slots[1].capareg = (uint64_t)(uint32_t)val;
++    AwH3ClockCtlState *s = AW_H3_CCU(dev);
-+        break;
++
-+    case ASPEED_SDHCI_SDIO_248:
++    /* Set default values for registers */
-+        sdhci->slots[1].maxcurr = (uint64_t)(uint32_t)val;
++    s->regs[REG_INDEX(REG_PLL_CPUX)] = REG_PLL_CPUX_RST;
-+        break;
++    s->regs[REG_INDEX(REG_PLL_AUDIO)] = REG_PLL_AUDIO_RST;
-+    default:
++    s->regs[REG_INDEX(REG_PLL_VIDEO)] = REG_PLL_VIDEO_RST;
-+        if (addr < ASPEED_SDHCI_REG_SIZE) {
++    s->regs[REG_INDEX(REG_PLL_VE)] = REG_PLL_VE_RST;
-+            sdhci->regs[TO_REG(addr)] = (uint32_t)val;
++    s->regs[REG_INDEX(REG_PLL_DDR)] = REG_PLL_DDR_RST;
-+        } else {
++    s->regs[REG_INDEX(REG_PLL_PERIPH0)] = REG_PLL_PERIPH0_RST;
-+            qemu_log_mask(LOG_GUEST_ERROR,
++    s->regs[REG_INDEX(REG_PLL_GPU)] = REG_PLL_GPU_RST;
-+                          "%s: Out-of-bounds write at 0x%" HWADDR_PRIx "\n",
++    s->regs[REG_INDEX(REG_PLL_PERIPH1)] = REG_PLL_PERIPH1_RST;
-+                          __func__, addr);
++    s->regs[REG_INDEX(REG_PLL_DE)] = REG_PLL_DE_RST;
-+        }
++    s->regs[REG_INDEX(REG_CPUX_AXI)] = REG_CPUX_AXI_RST;
 +    s->regs[REG_INDEX(REG_APB1)] = REG_APB1_RST;
 +    s->regs[REG_INDEX(REG_APB2)] = REG_APB2_RST;
 +    s->regs[REG_INDEX(REG_DRAM_CFG)] = REG_DRAM_CFG_RST;
 +    s->regs[REG_INDEX(REG_MBUS)] = REG_MBUS_RST;
 +    s->regs[REG_INDEX(REG_PLL_TIME0)] = REG_PLL_TIME0_RST;
 +    s->regs[REG_INDEX(REG_PLL_TIME1)] = REG_PLL_TIME1_RST;
 +    s->regs[REG_INDEX(REG_PLL_CPUX_BIAS)] = REG_PLL_CPUX_BIAS_RST;
 +    s->regs[REG_INDEX(REG_PLL_AUDIO_BIAS)] = REG_PLL_AUDIO_BIAS_RST;
 +    s->regs[REG_INDEX(REG_PLL_VIDEO_BIAS)] = REG_PLL_VIDEO_BIAS_RST;
 +    s->regs[REG_INDEX(REG_PLL_VE_BIAS)] = REG_PLL_VE_BIAS_RST;
 +    s->regs[REG_INDEX(REG_PLL_DDR_BIAS)] = REG_PLL_DDR_BIAS_RST;
 +    s->regs[REG_INDEX(REG_PLL_PERIPH0_BIAS)] = REG_PLL_PERIPH0_BIAS_RST;
 +    s->regs[REG_INDEX(REG_PLL_GPU_BIAS)] = REG_PLL_GPU_BIAS_RST;
 +    s->regs[REG_INDEX(REG_PLL_PERIPH1_BIAS)] = REG_PLL_PERIPH1_BIAS_RST;
 +    s->regs[REG_INDEX(REG_PLL_DE_BIAS)] = REG_PLL_DE_BIAS_RST;
 +    s->regs[REG_INDEX(REG_PLL_CPUX_TUNING)] = REG_PLL_CPUX_TUNING_RST;
 +    s->regs[REG_INDEX(REG_PLL_DDR_TUNING)] = REG_PLL_DDR_TUNING_RST;
 +}
 +
 +static void allwinner_h3_ccu_init(Object *obj)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    AwH3ClockCtlState *s = AW_H3_CCU(obj);
 +
 +    /* Memory mapping */
 +    memory_region_init_io(&s->iomem, OBJECT(s), &allwinner_h3_ccu_ops, s,
 +                          TYPE_AW_H3_CCU, AW_H3_CCU_IOSIZE);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +}
 +
 +static const VMStateDescription allwinner_h3_ccu_vmstate = {
 +    .name = "allwinner-h3-ccu",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(regs, AwH3ClockCtlState, AW_H3_CCU_REGS_NUM),
 +        VMSTATE_END_OF_LIST()
 +    }
-+}
++};
 +
-+static const MemoryRegionOps aspeed_sdhci_ops = {
++static void allwinner_h3_ccu_class_init(ObjectClass *klass, void *data)
-+    .read = aspeed_sdhci_read,
++{
-+    .write = aspeed_sdhci_write,
++    DeviceClass *dc = DEVICE_CLASS(klass);
-+    .endianness = DEVICE_NATIVE_ENDIAN,
++
-+    .valid.min_access_size = 4,
++    dc->reset = allwinner_h3_ccu_reset;
-+    .valid.max_access_size = 4,
++    dc->vmsd = &allwinner_h3_ccu_vmstate;
-+};
++}
 +
-+static void aspeed_sdhci_set_irq(void *opaque, int n, int level)
++static const TypeInfo allwinner_h3_ccu_info = {
-+{
++    .name          = TYPE_AW_H3_CCU,
 +    AspeedSDHCIState *sdhci = opaque;
 +
 +    if (level) {
 +        sdhci->regs[TO_REG(ASPEED_SDHCI_IRQ_STAT)] |= BIT(n);
 +
 +        qemu_irq_raise(sdhci->irq);
 +    } else {
 +        sdhci->regs[TO_REG(ASPEED_SDHCI_IRQ_STAT)] &= ~BIT(n);
 +
 +        qemu_irq_lower(sdhci->irq);
 +    }
 +}
 +
 +static void aspeed_sdhci_realize(DeviceState *dev, Error **errp)
 +{
 +    Error *err = NULL;
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 +    AspeedSDHCIState *sdhci = ASPEED_SDHCI(dev);
 +
 +    /* Create input irqs for the slots */
 +    qdev_init_gpio_in_named_with_opaque(DEVICE(sbd), aspeed_sdhci_set_irq,
 +                                        sdhci, NULL, ASPEED_SDHCI_NUM_SLOTS);
 +
 +    sysbus_init_irq(sbd, &sdhci->irq);
 +    memory_region_init_io(&sdhci->iomem, OBJECT(sdhci), &aspeed_sdhci_ops,
 +                          sdhci, TYPE_ASPEED_SDHCI, 0x1000);
 +    sysbus_init_mmio(sbd, &sdhci->iomem);
 +
 +    for (int i = 0; i < ASPEED_SDHCI_NUM_SLOTS; ++i) {
 +        Object *sdhci_slot = OBJECT(&sdhci->slots[i]);
 +        SysBusDevice *sbd_slot = SYS_BUS_DEVICE(&sdhci->slots[i]);
 +
 +        object_property_set_int(sdhci_slot, 2, "sd-spec-version", &err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +
 +        object_property_set_uint(sdhci_slot, ASPEED_SDHCI_CAPABILITIES,
 +                                 "capareg", &err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +
 +        object_property_set_bool(sdhci_slot, true, "realized", &err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +
 +        sysbus_connect_irq(sbd_slot, 0, qdev_get_gpio_in(DEVICE(sbd), i));
 +        memory_region_add_subregion(&sdhci->iomem, (i + 1) * 0x100,
 +                                    &sdhci->slots[i].iomem);
 +    }
 +}
 +
 +static void aspeed_sdhci_reset(DeviceState *dev)
 +{
 +    AspeedSDHCIState *sdhci = ASPEED_SDHCI(dev);
 +
 +    memset(sdhci->regs, 0, ASPEED_SDHCI_REG_SIZE);
 +    sdhci->regs[TO_REG(ASPEED_SDHCI_INFO)] = ASPEED_SDHCI_INFO_RESET;
 +    sdhci->regs[TO_REG(ASPEED_SDHCI_DEBOUNCE)] = ASPEED_SDHCI_DEBOUNCE_RESET;
 +}
 +
 +static const VMStateDescription vmstate_aspeed_sdhci = {
 +    .name = TYPE_ASPEED_SDHCI,
 +    .version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(regs, AspeedSDHCIState, ASPEED_SDHCI_NUM_REGS),
 +        VMSTATE_END_OF_LIST(),
 +    },
 +};
 +
 +static void aspeed_sdhci_class_init(ObjectClass *classp, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(classp);
 +
 +    dc->realize = aspeed_sdhci_realize;
 +    dc->reset = aspeed_sdhci_reset;
 +    dc->vmsd = &vmstate_aspeed_sdhci;
 +}
 +
 +static TypeInfo aspeed_sdhci_info = {
 +    .name          = TYPE_ASPEED_SDHCI,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .instance_size = sizeof(AspeedSDHCIState),
++    .instance_init = allwinner_h3_ccu_init,
-+    .class_init    = aspeed_sdhci_class_init,
++    .instance_size = sizeof(AwH3ClockCtlState),
-+};
++    .class_init    = allwinner_h3_ccu_class_init,
-+
++};
-+static void aspeed_sdhci_register_types(void)
++
-+{
++static void allwinner_h3_ccu_register(void)
-+    type_register_static(&aspeed_sdhci_info);
++{
-+}
++    type_register_static(&allwinner_h3_ccu_info);
-+
++}
-+type_init(aspeed_sdhci_register_types)
++
 +type_init(allwinner_h3_ccu_register)
 --
 .20.1

-[PULL 56/68] aspeed: Introduce an object class per SoC
+[PULL 15/36] hw/arm/allwinner-h3: add USB host controller
-From: Cédric Le Goater <clg@kaod.org>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-It prepares ground for the AST2600.
+The Allwinner H3 System on Chip contains multiple USB 2.0 bus
 connections which provide software access using the Enhanced
 Host Controller Interface (EHCI) and Open Host Controller
 Interface (OHCI) interfaces. This commit adds support for
 both interfaces in the Allwinner H3 System on Chip.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 20190925143248.10000-18-clg@kaod.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20200311221854.30370-5-nieklinnenbank@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed_soc.h |   9 +--
+ hw/usb/hcd-ehci.h             |  1 +
- hw/arm/aspeed.c             |   4 +-
+ include/hw/arm/allwinner-h3.h |  8 +++++++
- hw/arm/aspeed_soc.c         | 148 +++++++++++++++++++-----------------
+ hw/arm/allwinner-h3.c         | 44 +++++++++++++++++++++++++++++++++++
-files changed, 84 insertions(+), 77 deletions(-)
+ hw/usb/hcd-ehci-sysbus.c      | 17 ++++++++++++++
  hw/arm/Kconfig                |  2 ++
 files changed, 72 insertions(+)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/hw/usb/hcd-ehci.h
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/hw/usb/hcd-ehci.h
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
+@@ -XXX,XX +XXX,XX @@ typedef struct EHCIPCIState {
- #define TYPE_ASPEED_SOC "aspeed-soc"
+ #define TYPE_SYS_BUS_EHCI "sysbus-ehci-usb"
- #define ASPEED_SOC(obj) OBJECT_CHECK(AspeedSoCState, (obj), TYPE_ASPEED_SOC)
+ #define TYPE_PLATFORM_EHCI "platform-ehci-usb"
+ #define TYPE_EXYNOS4210_EHCI "exynos4210-ehci-usb"
--typedef struct AspeedSoCInfo {
++#define TYPE_AW_H3_EHCI "aw-h3-ehci-usb"
-+typedef struct AspeedSoCClass {
+ #define TYPE_TEGRA2_EHCI "tegra2-ehci-usb"
-+    DeviceClass parent_class;
+ #define TYPE_PPC4xx_EHCI "ppc4xx-ehci-usb"
  #define TYPE_FUSBH200_EHCI "fusbh200-ehci-usb"
 diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/allwinner-h3.h
 +++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@ enum {
      AW_H3_SRAM_A1,
      AW_H3_SRAM_A2,
      AW_H3_SRAM_C,
 +    AW_H3_EHCI0,
 +    AW_H3_OHCI0,
 +    AW_H3_EHCI1,
 +    AW_H3_OHCI1,
 +    AW_H3_EHCI2,
 +    AW_H3_OHCI2,
 +    AW_H3_EHCI3,
 +    AW_H3_OHCI3,
      AW_H3_CCU,
      AW_H3_PIT,
      AW_H3_UART0,
 diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/allwinner-h3.c
 +++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "hw/char/serial.h"
  #include "hw/misc/unimp.h"
 +#include "hw/usb/hcd-ehci.h"
  #include "sysemu/sysemu.h"
  #include "hw/arm/allwinner-h3.h"
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
      [AW_H3_SRAM_A1]    = 0x00000000,
      [AW_H3_SRAM_A2]    = 0x00044000,
      [AW_H3_SRAM_C]     = 0x00010000,
 +    [AW_H3_EHCI0]      = 0x01c1a000,
 +    [AW_H3_OHCI0]      = 0x01c1a400,
 +    [AW_H3_EHCI1]      = 0x01c1b000,
 +    [AW_H3_OHCI1]      = 0x01c1b400,
 +    [AW_H3_EHCI2]      = 0x01c1c000,
 +    [AW_H3_OHCI2]      = 0x01c1c400,
 +    [AW_H3_EHCI3]      = 0x01c1d000,
 +    [AW_H3_OHCI3]      = 0x01c1d400,
      [AW_H3_CCU]        = 0x01c20000,
      [AW_H3_PIT]        = 0x01c20c00,
      [AW_H3_UART0]      = 0x01c28000,
@@ -XXX,XX +XXX,XX @@ enum {
      AW_H3_GIC_SPI_UART3     =  3,
      AW_H3_GIC_SPI_TIMER0    = 18,
      AW_H3_GIC_SPI_TIMER1    = 19,
 +    AW_H3_GIC_SPI_EHCI0     = 72,
 +    AW_H3_GIC_SPI_OHCI0     = 73,
 +    AW_H3_GIC_SPI_EHCI1     = 74,
 +    AW_H3_GIC_SPI_OHCI1     = 75,
 +    AW_H3_GIC_SPI_EHCI2     = 76,
 +    AW_H3_GIC_SPI_OHCI2     = 77,
 +    AW_H3_GIC_SPI_EHCI3     = 78,
 +    AW_H3_GIC_SPI_OHCI3     = 79,
  };
  /* Allwinner H3 general constants */
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
      qdev_init_nofail(DEVICE(&s->ccu));
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->ccu), 0, s->memmap[AW_H3_CCU]);
 +    /* Universal Serial Bus */
 +    sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI0],
 +                         qdev_get_gpio_in(DEVICE(&s->gic),
 +                                          AW_H3_GIC_SPI_EHCI0));
 +    sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI1],
 +                         qdev_get_gpio_in(DEVICE(&s->gic),
 +                                          AW_H3_GIC_SPI_EHCI1));
 +    sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI2],
 +                         qdev_get_gpio_in(DEVICE(&s->gic),
 +                                          AW_H3_GIC_SPI_EHCI2));
 +    sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI3],
 +                         qdev_get_gpio_in(DEVICE(&s->gic),
 +                                          AW_H3_GIC_SPI_EHCI3));
 +
-     const char *name;
++    sysbus_create_simple("sysbus-ohci", s->memmap[AW_H3_OHCI0],
-     const char *cpu_type;
++                         qdev_get_gpio_in(DEVICE(&s->gic),
-     uint32_t silicon_rev;
++                                          AW_H3_GIC_SPI_OHCI0));
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
++    sysbus_create_simple("sysbus-ohci", s->memmap[AW_H3_OHCI1],
-     const int *irqmap;
++                         qdev_get_gpio_in(DEVICE(&s->gic),
-     const hwaddr *memmap;
++                                          AW_H3_GIC_SPI_OHCI1));
-     uint32_t num_cpus;
++    sysbus_create_simple("sysbus-ohci", s->memmap[AW_H3_OHCI2],
--} AspeedSoCInfo;
++                         qdev_get_gpio_in(DEVICE(&s->gic),
--
++                                          AW_H3_GIC_SPI_OHCI2));
--typedef struct AspeedSoCClass {
++    sysbus_create_simple("sysbus-ohci", s->memmap[AW_H3_OHCI3],
--    DeviceClass parent_class;
++                         qdev_get_gpio_in(DEVICE(&s->gic),
--    AspeedSoCInfo *info;
++                                          AW_H3_GIC_SPI_OHCI3));
- } AspeedSoCClass;
++
+     /* UART0. For future clocktree API: All UARTS are connected to APB2_CLK. */
- #define ASPEED_SOC_CLASS(klass)                                         \
+     serial_mm_init(get_system_memory(), s->memmap[AW_H3_UART0], 2,
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+                    qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART0),
 diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/hw/usb/hcd-ehci-sysbus.c
-+++ b/hw/arm/aspeed.c
++++ b/hw/usb/hcd-ehci-sysbus.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo ehci_exynos4210_type_info = {
-     memory_region_allocate_system_memory(&bmc->ram, NULL, "ram", ram_size);
+     .class_init    = ehci_exynos4210_class_init,
      memory_region_add_subregion(&bmc->ram_container, 0, &bmc->ram);
      memory_region_add_subregion(get_system_memory(),
 -                                sc->info->memmap[ASPEED_SDRAM],
 +                                sc->memmap[ASPEED_SDRAM],
                                  &bmc->ram_container);
      max_ram_size = object_property_get_uint(OBJECT(&bmc->soc), "max-ram-size",
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
      }
      aspeed_board_binfo.ram_size = ram_size;
 -    aspeed_board_binfo.loader_start = sc->info->memmap[ASPEED_SDRAM];
 +    aspeed_board_binfo.loader_start = sc->memmap[ASPEED_SDRAM];
      aspeed_board_binfo.nb_cpus = bmc->soc.num_cpus;
      if (cfg->i2c_init) {
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2400_irqmap[] = {
  #define aspeed_soc_ast2500_irqmap aspeed_soc_ast2400_irqmap
 -static const AspeedSoCInfo aspeed_socs[] = {
 -    {
 -        .name         = "ast2400-a1",
 -        .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
 -        .silicon_rev  = AST2400_A1_SILICON_REV,
 -        .sram_size    = 0x8000,
 -        .spis_num     = 1,
 -        .wdts_num     = 2,
 -        .irqmap       = aspeed_soc_ast2400_irqmap,
 -        .memmap       = aspeed_soc_ast2400_memmap,
 -        .num_cpus     = 1,
 -    }, {
 -        .name         = "ast2500-a1",
 -        .cpu_type     = ARM_CPU_TYPE_NAME("arm1176"),
 -        .silicon_rev  = AST2500_A1_SILICON_REV,
 -        .sram_size    = 0x9000,
 -        .spis_num     = 2,
 -        .wdts_num     = 3,
 -        .irqmap       = aspeed_soc_ast2500_irqmap,
 -        .memmap       = aspeed_soc_ast2500_memmap,
 -        .num_cpus     = 1,
 -    },
 -};
 -
  static qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int ctrl)
  {
      AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 -    return qdev_get_gpio_in(DEVICE(&s->vic), sc->info->irqmap[ctrl]);
 +    return qdev_get_gpio_in(DEVICE(&s->vic), sc->irqmap[ctrl]);
  }
  static void aspeed_soc_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      char socname[8];
      char typename[64];
 -    if (sscanf(sc->info->name, "%7s", socname) != 1) {
 +    if (sscanf(sc->name, "%7s", socname) != 1) {
          g_assert_not_reached();
      }
 -    for (i = 0; i < sc->info->num_cpus; i++) {
 +    for (i = 0; i < sc->num_cpus; i++) {
          object_initialize_child(obj, "cpu[*]", OBJECT(&s->cpu[i]),
 -                                sizeof(s->cpu[i]), sc->info->cpu_type,
 +                                sizeof(s->cpu[i]), sc->cpu_type,
                                  &error_abort, NULL);
      }
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      sysbus_init_child_obj(obj, "scu", OBJECT(&s->scu), sizeof(s->scu),
                            typename);
      qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev",
 -                         sc->info->silicon_rev);
 +                         sc->silicon_rev);
      object_property_add_alias(obj, "hw-strap1", OBJECT(&s->scu),
                                "hw-strap1", &error_abort);
      object_property_add_alias(obj, "hw-strap2", OBJECT(&s->scu),
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      object_property_add_alias(obj, "dram", OBJECT(&s->fmc), "dram",
                                &error_abort);
 -    for (i = 0; i < sc->info->spis_num; i++) {
 +    for (i = 0; i < sc->spis_num; i++) {
          snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
          sysbus_init_child_obj(obj, "spi[*]", OBJECT(&s->spi[i]),
                                sizeof(s->spi[i]), typename);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      object_property_add_alias(obj, "max-ram-size", OBJECT(&s->sdmc),
                                "max-ram-size", &error_abort);
 -    for (i = 0; i < sc->info->wdts_num; i++) {
 +    for (i = 0; i < sc->wdts_num; i++) {
          snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
          sysbus_init_child_obj(obj, "wdt[*]", OBJECT(&s->wdt[i]),
                                sizeof(s->wdt[i]), typename);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      Error *err = NULL, *local_err = NULL;
      /* IO space */
 -    create_unimplemented_device("aspeed_soc.io", sc->info->memmap[ASPEED_IOMEM],
 +    create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_IOMEM],
                                  ASPEED_SOC_IOMEM_SIZE);
 -    if (s->num_cpus > sc->info->num_cpus) {
 +    if (s->num_cpus > sc->num_cpus) {
          warn_report("%s: invalid number of CPUs %d, using default %d",
 -                    sc->info->name, s->num_cpus, sc->info->num_cpus);
 -        s->num_cpus = sc->info->num_cpus;
 +                    sc->name, s->num_cpus, sc->num_cpus);
 +        s->num_cpus = sc->num_cpus;
      }
      /* CPU */
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      /* SRAM */
      memory_region_init_ram(&s->sram, OBJECT(dev), "aspeed.sram",
 -                           sc->info->sram_size, &err);
 +                           sc->sram_size, &err);
      if (err) {
          error_propagate(errp, err);
          return;
      }
      memory_region_add_subregion(get_system_memory(),
 -                                sc->info->memmap[ASPEED_SRAM], &s->sram);
 +                                sc->memmap[ASPEED_SRAM], &s->sram);
      /* SCU */
      object_property_set_bool(OBJECT(&s->scu), true, "realized", &err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          error_propagate(errp, err);
          return;
      }
 -    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->info->memmap[ASPEED_SCU]);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_SCU]);
      /* VIC */
      object_property_set_bool(OBJECT(&s->vic), true, "realized", &err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          error_propagate(errp, err);
          return;
      }
 -    sysbus_mmio_map(SYS_BUS_DEVICE(&s->vic), 0, sc->info->memmap[ASPEED_VIC]);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->vic), 0, sc->memmap[ASPEED_VIC]);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->vic), 0,
                         qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ));
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->vic), 1,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          error_propagate(errp, err);
          return;
      }
 -    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, sc->info->memmap[ASPEED_RTC]);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_RTC]);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
                         aspeed_soc_get_irq(s, ASPEED_RTC));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          return;
      }
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->timerctrl), 0,
 -                    sc->info->memmap[ASPEED_TIMER1]);
 +                    sc->memmap[ASPEED_TIMER1]);
      for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
          qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_TIMER1 + i);
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->timerctrl), i, irq);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      /* UART - attach an 8250 to the IO space as our UART5 */
      if (serial_hd(0)) {
          qemu_irq uart5 = aspeed_soc_get_irq(s, ASPEED_UART5);
 -        serial_mm_init(get_system_memory(), sc->info->memmap[ASPEED_UART5], 2,
 +        serial_mm_init(get_system_memory(), sc->memmap[ASPEED_UART5], 2,
                         uart5, 38400, serial_hd(0), DEVICE_LITTLE_ENDIAN);
      }
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          error_propagate(errp, err);
          return;
      }
 -    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->info->memmap[ASPEED_I2C]);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_I2C]);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c), 0,
                         aspeed_soc_get_irq(s, ASPEED_I2C));
      /* FMC, The number of CS is set at the board level */
 -    object_property_set_int(OBJECT(&s->fmc), sc->info->memmap[ASPEED_SDRAM],
 +    object_property_set_int(OBJECT(&s->fmc), sc->memmap[ASPEED_SDRAM],
                              "sdram-base", &err);
      if (err) {
          error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          error_propagate(errp, err);
          return;
      }
 -    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->info->memmap[ASPEED_FMC]);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_FMC]);
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 1,
                      s->fmc.ctrl->flash_window_base);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                         aspeed_soc_get_irq(s, ASPEED_FMC));
      /* SPI */
 -    for (i = 0; i < sc->info->spis_num; i++) {
 +    for (i = 0; i < sc->spis_num; i++) {
          object_property_set_int(OBJECT(&s->spi[i]), 1, "num-cs", &err);
          object_property_set_bool(OBJECT(&s->spi[i]), true, "realized",
                                   &local_err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
              return;
          }
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
 -                        sc->info->memmap[ASPEED_SPI1 + i]);
 +                        sc->memmap[ASPEED_SPI1 + i]);
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 1,
                          s->spi[i].ctrl->flash_window_base);
      }
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          error_propagate(errp, err);
          return;
      }
 -    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, sc->info->memmap[ASPEED_SDMC]);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, sc->memmap[ASPEED_SDMC]);
      /* Watch dog */
 -    for (i = 0; i < sc->info->wdts_num; i++) {
 +    for (i = 0; i < sc->wdts_num; i++) {
          AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(&s->wdt[i]);
          object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
              return;
          }
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
 -                        sc->info->memmap[ASPEED_WDT] + i * awc->offset);
 +                        sc->memmap[ASPEED_WDT] + i * awc->offset);
      }
      /* Net */
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
             return;
          }
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
 -                        sc->info->memmap[ASPEED_ETH1 + i]);
 +                        sc->memmap[ASPEED_ETH1 + i]);
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                             aspeed_soc_get_irq(s, ASPEED_ETH1 + i));
      }
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          return;
      }
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->xdma), 0,
 -                    sc->info->memmap[ASPEED_XDMA]);
 +                    sc->memmap[ASPEED_XDMA]);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
                         aspeed_soc_get_irq(s, ASPEED_XDMA));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          error_propagate(errp, err);
          return;
      }
 -    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->info->memmap[ASPEED_GPIO]);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_GPIO]);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                         aspeed_soc_get_irq(s, ASPEED_GPIO));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          return;
      }
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
 -                    sc->info->memmap[ASPEED_SDHCI]);
 +                    sc->memmap[ASPEED_SDHCI]);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
                         aspeed_soc_get_irq(s, ASPEED_SDHCI));
  }
@@ -XXX,XX +XXX,XX @@ static Property aspeed_soc_properties[] = {
  static void aspeed_soc_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 -    AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
 -    sc->info = (AspeedSoCInfo *) data;
      dc->realize = aspeed_soc_realize;
      /* Reason: Uses serial_hds and nd_table in realize() directly */
      dc->user_creatable = false;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_class_init(ObjectClass *oc, void *data)
  static const TypeInfo aspeed_soc_type_info = {
      .name           = TYPE_ASPEED_SOC,
      .parent         = TYPE_DEVICE,
 -    .instance_init  = aspeed_soc_init,
      .instance_size  = sizeof(AspeedSoCState),
      .class_size     = sizeof(AspeedSoCClass),
 +    .class_init     = aspeed_soc_class_init,
      .abstract       = true,
  };
--static void aspeed_soc_register_types(void)
++static void ehci_aw_h3_class_init(ObjectClass *oc, void *data)
-+static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
++{
- {
++    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
--    int i;
++    DeviceClass *dc = DEVICE_CLASS(oc);
-+    AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
++
++    sec->capsbase = 0x0;
--    type_register_static(&aspeed_soc_type_info);
++    sec->opregbase = 0x10;
--    for (i = 0; i < ARRAY_SIZE(aspeed_socs); ++i) {
++    set_bit(DEVICE_CATEGORY_USB, dc->categories);
--        TypeInfo ti = {
++}
--            .name       = aspeed_socs[i].name,
++
--            .parent     = TYPE_ASPEED_SOC,
++static const TypeInfo ehci_aw_h3_type_info = {
--            .class_init = aspeed_soc_class_init,
++    .name          = TYPE_AW_H3_EHCI,
--            .class_data = (void *) &aspeed_socs[i],
++    .parent        = TYPE_SYS_BUS_EHCI,
--        };
++    .class_init    = ehci_aw_h3_class_init,
 -        type_register(&ti);
 -    }
 +    sc->name         = "ast2400-a1";
 +    sc->cpu_type     = ARM_CPU_TYPE_NAME("arm926");
 +    sc->silicon_rev  = AST2400_A1_SILICON_REV;
 +    sc->sram_size    = 0x8000;
 +    sc->spis_num     = 1;
 +    sc->wdts_num     = 2;
 +    sc->irqmap       = aspeed_soc_ast2400_irqmap;
 +    sc->memmap       = aspeed_soc_ast2400_memmap;
 +    sc->num_cpus     = 1;
  }
 +static const TypeInfo aspeed_soc_ast2400_type_info = {
 +    .name           = "ast2400-a1",
 +    .parent         = TYPE_ASPEED_SOC,
 +    .instance_init  = aspeed_soc_init,
 +    .instance_size  = sizeof(AspeedSoCState),
 +    .class_init     = aspeed_soc_ast2400_class_init,
 +};
 +
-+static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
+ static void ehci_tegra2_class_init(ObjectClass *oc, void *data)
-+{
+ {
-+    AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
+     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
-+
+@@ -XXX,XX +XXX,XX @@ static void ehci_sysbus_register_types(void)
-+    sc->name         = "ast2500-a1";
+     type_register_static(&ehci_type_info);
-+    sc->cpu_type     = ARM_CPU_TYPE_NAME("arm1176");
+     type_register_static(&ehci_platform_type_info);
-+    sc->silicon_rev  = AST2500_A1_SILICON_REV;
+     type_register_static(&ehci_exynos4210_type_info);
-+    sc->sram_size    = 0x9000;
++    type_register_static(&ehci_aw_h3_type_info);
-+    sc->spis_num     = 2;
+     type_register_static(&ehci_tegra2_type_info);
-+    sc->wdts_num     = 3;
+     type_register_static(&ehci_ppc4xx_type_info);
-+    sc->irqmap       = aspeed_soc_ast2500_irqmap;
+     type_register_static(&ehci_fusbh200_type_info);
-+    sc->memmap       = aspeed_soc_ast2500_memmap;
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-+    sc->num_cpus     = 1;
+index XXXXXXX..XXXXXXX 100644
-+}
+--- a/hw/arm/Kconfig
-+
++++ b/hw/arm/Kconfig
-+static const TypeInfo aspeed_soc_ast2500_type_info = {
+@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
-+    .name           = "ast2500-a1",
+     select ARM_TIMER
-+    .parent         = TYPE_ASPEED_SOC,
+     select ARM_GIC
-+    .instance_init  = aspeed_soc_init,
+     select UNIMP
-+    .instance_size  = sizeof(AspeedSoCState),
++    select USB_OHCI
-+    .class_init     = aspeed_soc_ast2500_class_init,
++    select USB_EHCI_SYSBUS
-+};
-+static void aspeed_soc_register_types(void)
+ config RASPI
-+{
+     bool
 +    type_register_static(&aspeed_soc_type_info);
 +    type_register_static(&aspeed_soc_ast2400_type_info);
 +    type_register_static(&aspeed_soc_ast2500_type_info);
 +};
 +
  type_init(aspeed_soc_register_types)
 --
 .20.1

-[PULL 43/68] aspeed/timer: Introduce an object class per SoC
+[PULL 16/36] hw/arm/allwinner-h3: add System Control module
-From: Cédric Le Goater <clg@kaod.org>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-The most important changes will be on the register range 0x34 - 0x3C
+The Allwinner H3 System on Chip has an System Control
-memops. Introduce class read/write operations to handle the
+module that provides system wide generic controls and
-differences between SoCs.
+device information. This commit adds support for the
+Allwinner H3 System Control module.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-Message-id: 20190925143248.10000-5-clg@kaod.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20200311221854.30370-6-nieklinnenbank@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/timer/aspeed_timer.h |  15 +++++
+ hw/misc/Makefile.objs                  |   1 +
- hw/arm/aspeed_soc.c             |   3 +-
+ include/hw/arm/allwinner-h3.h          |   3 +
- hw/timer/aspeed_timer.c         | 107 ++++++++++++++++++++++++++++----
+ include/hw/misc/allwinner-h3-sysctrl.h |  67 ++++++++++++
-files changed, 113 insertions(+), 12 deletions(-)
+ hw/arm/allwinner-h3.c                  |   9 +-
+ hw/misc/allwinner-h3-sysctrl.c         | 140 +++++++++++++++++++++++++
-diff --git a/include/hw/timer/aspeed_timer.h b/include/hw/timer/aspeed_timer.h
+files changed, 219 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/misc/allwinner-h3-sysctrl.h
  create mode 100644 hw/misc/allwinner-h3-sysctrl.c
 diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/timer/aspeed_timer.h
+--- a/hw/misc/Makefile.objs
-+++ b/include/hw/timer/aspeed_timer.h
++++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_MACIO) += macio/
  common-obj-$(CONFIG_IVSHMEM_DEVICE) += ivshmem.o
  common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-ccu.o
 +common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-sysctrl.o
  common-obj-$(CONFIG_REALVIEW) += arm_sysctl.o
  common-obj-$(CONFIG_NSERIES) += cbus.o
  common-obj-$(CONFIG_ECCMEMCTL) += eccmemctl.o
 diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/allwinner-h3.h
 +++ b/include/hw/arm/allwinner-h3.h
 @@ -XXX,XX +XXX,XX @@
- #define ASPEED_TIMER(obj) \
+ #include "hw/timer/allwinner-a10-pit.h"
-     OBJECT_CHECK(AspeedTimerCtrlState, (obj), TYPE_ASPEED_TIMER);
+ #include "hw/intc/arm_gic.h"
- #define TYPE_ASPEED_TIMER "aspeed.timer"
+ #include "hw/misc/allwinner-h3-ccu.h"
-+#define TYPE_ASPEED_2400_TIMER TYPE_ASPEED_TIMER "-ast2400"
++#include "hw/misc/allwinner-h3-sysctrl.h"
-+#define TYPE_ASPEED_2500_TIMER TYPE_ASPEED_TIMER "-ast2500"
+ #include "target/arm/cpu.h"
-+
- #define ASPEED_TIMER_NR_TIMERS 8
+ /**
+@@ -XXX,XX +XXX,XX @@ enum {
- typedef struct AspeedTimer {
+     AW_H3_SRAM_A1,
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedTimerCtrlState {
+     AW_H3_SRAM_A2,
-     AspeedSCUState *scu;
+     AW_H3_SRAM_C,
- } AspeedTimerCtrlState;
++    AW_H3_SYSCTRL,
+     AW_H3_EHCI0,
-+#define ASPEED_TIMER_CLASS(klass) \
+     AW_H3_OHCI0,
-+     OBJECT_CLASS_CHECK(AspeedTimerClass, (klass), TYPE_ASPEED_TIMER)
+     AW_H3_EHCI1,
-+#define ASPEED_TIMER_GET_CLASS(obj) \
+@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
-+     OBJECT_GET_CLASS(AspeedTimerClass, (obj), TYPE_ASPEED_TIMER)
+     const hwaddr *memmap;
-+
+     AwA10PITState timer;
-+typedef struct AspeedTimerClass {
+     AwH3ClockCtlState ccu;
-+    SysBusDeviceClass parent_class;
++    AwH3SysCtrlState sysctrl;
-+
+     GICState gic;
-+    uint64_t (*read)(AspeedTimerCtrlState *s, hwaddr offset);
+     MemoryRegion sram_a1;
-+    void (*write)(AspeedTimerCtrlState *s, hwaddr offset, uint64_t value);
+     MemoryRegion sram_a2;
-+} AspeedTimerClass;
+diff --git a/include/hw/misc/allwinner-h3-sysctrl.h b/include/hw/misc/allwinner-h3-sysctrl.h
-+
+new file mode 100644
- #endif /* ASPEED_TIMER_H */
+index XXXXXXX..XXXXXXX
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
+--- /dev/null
 +++ b/include/hw/misc/allwinner-h3-sysctrl.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Allwinner H3 System Control emulation
 + *
 + * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#ifndef HW_MISC_ALLWINNER_H3_SYSCTRL_H
 +#define HW_MISC_ALLWINNER_H3_SYSCTRL_H
 +
 +#include "qom/object.h"
 +#include "hw/sysbus.h"
 +
 +/**
 + * @name Constants
 + * @{
 + */
 +
 +/** Highest register address used by System Control device */
 +#define AW_H3_SYSCTRL_REGS_MAXADDR   (0x30)
 +
 +/** Total number of known registers */
 +#define AW_H3_SYSCTRL_REGS_NUM       ((AW_H3_SYSCTRL_REGS_MAXADDR / \
 +                                      sizeof(uint32_t)) + 1)
 +
 +/** @} */
 +
 +/**
 + * @name Object model
 + * @{
 + */
 +
 +#define TYPE_AW_H3_SYSCTRL    "allwinner-h3-sysctrl"
 +#define AW_H3_SYSCTRL(obj) \
 +    OBJECT_CHECK(AwH3SysCtrlState, (obj), TYPE_AW_H3_SYSCTRL)
 +
 +/** @} */
 +
 +/**
 + * Allwinner H3 System Control object instance state
 + */
 +typedef struct AwH3SysCtrlState {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +    /*< public >*/
 +
 +    /** Maps I/O registers in physical memory */
 +    MemoryRegion iomem;
 +
 +    /** Array of hardware registers */
 +    uint32_t regs[AW_H3_SYSCTRL_REGS_NUM];
 +
 +} AwH3SysCtrlState;
 +
 +#endif /* HW_MISC_ALLWINNER_H3_SYSCTRL_H */
 diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
+--- a/hw/arm/allwinner-h3.c
-+++ b/hw/arm/aspeed_soc.c
++++ b/hw/arm/allwinner-h3.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
-     sysbus_init_child_obj(obj, "rtc", OBJECT(&s->rtc), sizeof(s->rtc),
+     [AW_H3_SRAM_A1]    = 0x00000000,
-                           TYPE_ASPEED_RTC);
+     [AW_H3_SRAM_A2]    = 0x00044000,
+     [AW_H3_SRAM_C]     = 0x00010000,
-+    snprintf(typename, sizeof(typename), "aspeed.timer-%s", socname);
++    [AW_H3_SYSCTRL]    = 0x01c00000,
-     sysbus_init_child_obj(obj, "timerctrl", OBJECT(&s->timerctrl),
+     [AW_H3_EHCI0]      = 0x01c1a000,
--                          sizeof(s->timerctrl), TYPE_ASPEED_TIMER);
+     [AW_H3_OHCI0]      = 0x01c1a400,
-+                          sizeof(s->timerctrl), typename);
+     [AW_H3_EHCI1]      = 0x01c1b000,
-     object_property_add_const_link(OBJECT(&s->timerctrl), "scu",
+@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
-                                    OBJECT(&s->scu), &error_abort);
+ } unimplemented[] = {
+     { "d-engine",  0x01000000, 4 * MiB },
-diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
+     { "d-inter",   0x01400000, 128 * KiB },
-index XXXXXXX..XXXXXXX 100644
+-    { "syscon",    0x01c00000, 4 * KiB },
---- a/hw/timer/aspeed_timer.c
+     { "dma",       0x01c02000, 4 * KiB },
-+++ b/hw/timer/aspeed_timer.c
+     { "nfdc",      0x01c03000, 4 * KiB },
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_timer_read(void *opaque, hwaddr offset, unsigned size)
+     { "ts",        0x01c06000, 4 * KiB },
-     case 0x40 ... 0x8c: /* Timers 5 - 8 */
+@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
-         value = aspeed_timer_get_value(&s->timers[(offset >> 4) - 1], reg);
-         break;
+     sysbus_init_child_obj(obj, "ccu", &s->ccu, sizeof(s->ccu),
--    /* Illegal */
+                           TYPE_AW_H3_CCU);
--    case 0x38:
++
--    case 0x3C:
++    sysbus_init_child_obj(obj, "sysctrl", &s->sysctrl, sizeof(s->sysctrl),
-     default:
++                          TYPE_AW_H3_SYSCTRL);
 -        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
 -                __func__, offset);
 -        value = 0;
 +        value = ASPEED_TIMER_GET_CLASS(s)->read(s, offset);
          break;
      }
      trace_aspeed_timer_read(offset, size, value);
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_write(void *opaque, hwaddr offset, uint64_t value,
      case 0x40 ... 0x8c:
          aspeed_timer_set_value(s, (offset >> TIMER_NR_REGS) - 1, reg, tv);
          break;
 -    /* Illegal */
 -    case 0x38:
 -    case 0x3C:
      default:
 -        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
 -                __func__, offset);
 +        ASPEED_TIMER_GET_CLASS(s)->write(s, offset, value);
          break;
      }
  }
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_timer_ops = {
-     .valid.unaligned = false,
+ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
- };
+@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
+     qdev_init_nofail(DEVICE(&s->ccu));
-+static uint64_t aspeed_2400_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ccu), 0, s->memmap[AW_H3_CCU]);
-+{
-+    uint64_t value;
++    /* System Control */
 +    qdev_init_nofail(DEVICE(&s->sysctrl));
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysctrl), 0, s->memmap[AW_H3_SYSCTRL]);
 +
      /* Universal Serial Bus */
      sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI0],
                           qdev_get_gpio_in(DEVICE(&s->gic),
 diff --git a/hw/misc/allwinner-h3-sysctrl.c b/hw/misc/allwinner-h3-sysctrl.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/allwinner-h3-sysctrl.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Allwinner H3 System Control emulation
 + *
 + * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/units.h"
 +#include "hw/sysbus.h"
 +#include "migration/vmstate.h"
 +#include "qemu/log.h"
 +#include "qemu/module.h"
 +#include "hw/misc/allwinner-h3-sysctrl.h"
 +
 +/* System Control register offsets */
 +enum {
 +    REG_VER               = 0x24,  /* Version */
 +    REG_EMAC_PHY_CLK      = 0x30,  /* EMAC PHY Clock */
 +};
 +
 +#define REG_INDEX(offset)   (offset / sizeof(uint32_t))
 +
 +/* System Control register reset values */
 +enum {
 +    REG_VER_RST           = 0x0,
 +    REG_EMAC_PHY_CLK_RST  = 0x58000,
 +};
 +
 +static uint64_t allwinner_h3_sysctrl_read(void *opaque, hwaddr offset,
 +                                          unsigned size)
 +{
 +    const AwH3SysCtrlState *s = AW_H3_SYSCTRL(opaque);
 +    const uint32_t idx = REG_INDEX(offset);
 +
 +    if (idx >= AW_H3_SYSCTRL_REGS_NUM) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
 +                      __func__, (uint32_t)offset);
 +        return 0;
 +    }
 +
 +    return s->regs[idx];
 +}
 +
 +static void allwinner_h3_sysctrl_write(void *opaque, hwaddr offset,
 +                                       uint64_t val, unsigned size)
 +{
 +    AwH3SysCtrlState *s = AW_H3_SYSCTRL(opaque);
 +    const uint32_t idx = REG_INDEX(offset);
 +
 +    if (idx >= AW_H3_SYSCTRL_REGS_NUM) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
 +                      __func__, (uint32_t)offset);
 +        return;
 +    }
 +
 +    switch (offset) {
-+    case 0x38:
++    case REG_VER:       /* Version */
-+    case 0x3C:
++        break;
 +    default:
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
++        s->regs[idx] = (uint32_t) val;
 +                __func__, offset);
 +        value = 0;
 +        break;
 +    }
-+    return value;
++}
-+}
++
-+
++static const MemoryRegionOps allwinner_h3_sysctrl_ops = {
-+static void aspeed_2400_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
++    .read = allwinner_h3_sysctrl_read,
-+                                    uint64_t value)
++    .write = allwinner_h3_sysctrl_write,
-+{
++    .endianness = DEVICE_NATIVE_ENDIAN,
-+    switch (offset) {
++    .valid = {
-+    case 0x38:
++        .min_access_size = 4,
-+    case 0x3C:
++        .max_access_size = 4,
-+    default:
++    },
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
++    .impl.min_access_size = 4,
-+                __func__, offset);
++};
-+        break;
++
 +static void allwinner_h3_sysctrl_reset(DeviceState *dev)
 +{
 +    AwH3SysCtrlState *s = AW_H3_SYSCTRL(dev);
 +
 +    /* Set default values for registers */
 +    s->regs[REG_INDEX(REG_VER)] = REG_VER_RST;
 +    s->regs[REG_INDEX(REG_EMAC_PHY_CLK)] = REG_EMAC_PHY_CLK_RST;
 +}
 +
 +static void allwinner_h3_sysctrl_init(Object *obj)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    AwH3SysCtrlState *s = AW_H3_SYSCTRL(obj);
 +
 +    /* Memory mapping */
 +    memory_region_init_io(&s->iomem, OBJECT(s), &allwinner_h3_sysctrl_ops, s,
 +                           TYPE_AW_H3_SYSCTRL, 4 * KiB);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +}
 +
 +static const VMStateDescription allwinner_h3_sysctrl_vmstate = {
 +    .name = "allwinner-h3-sysctrl",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(regs, AwH3SysCtrlState, AW_H3_SYSCTRL_REGS_NUM),
 +        VMSTATE_END_OF_LIST()
 +    }
-+}
++};
 +
-+static uint64_t aspeed_2500_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
++static void allwinner_h3_sysctrl_class_init(ObjectClass *klass, void *data)
 +{
 +    uint64_t value;
 +
 +    switch (offset) {
 +    case 0x38:
 +    case 0x3C:
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
 +                __func__, offset);
 +        value = 0;
 +        break;
 +    }
 +    return value;
 +}
 +
 +static void aspeed_2500_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
 +                                    uint64_t value)
 +{
 +    switch (offset) {
 +    case 0x38:
 +    case 0x3C:
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
 +                __func__, offset);
 +        break;
 +    }
 +}
 +
  static void aspeed_init_one_timer(AspeedTimerCtrlState *s, uint8_t id)
  {
      AspeedTimer *t = &s->timers[id];
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_timer_info = {
      .parent = TYPE_SYS_BUS_DEVICE,
      .instance_size = sizeof(AspeedTimerCtrlState),
      .class_init = timer_class_init,
 +    .class_size = sizeof(AspeedTimerClass),
 +    .abstract   = true,
 +};
 +
 +static void aspeed_2400_timer_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
-+    AspeedTimerClass *awc = ASPEED_TIMER_CLASS(klass);
++
-+
++    dc->reset = allwinner_h3_sysctrl_reset;
-+    dc->desc = "ASPEED 2400 Timer";
++    dc->vmsd = &allwinner_h3_sysctrl_vmstate;
-+    awc->read = aspeed_2400_timer_read;
++}
-+    awc->write = aspeed_2400_timer_write;
++
-+}
++static const TypeInfo allwinner_h3_sysctrl_info = {
-+
++    .name          = TYPE_AW_H3_SYSCTRL,
-+static const TypeInfo aspeed_2400_timer_info = {
++    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .name = TYPE_ASPEED_2400_TIMER,
++    .instance_init = allwinner_h3_sysctrl_init,
-+    .parent = TYPE_ASPEED_TIMER,
++    .instance_size = sizeof(AwH3SysCtrlState),
-+    .class_init = aspeed_2400_timer_class_init,
++    .class_init    = allwinner_h3_sysctrl_class_init,
 +};
 +
-+static void aspeed_2500_timer_class_init(ObjectClass *klass, void *data)
++static void allwinner_h3_sysctrl_register(void)
 +{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
++    type_register_static(&allwinner_h3_sysctrl_info);
-+    AspeedTimerClass *awc = ASPEED_TIMER_CLASS(klass);
++}
 +
-+    dc->desc = "ASPEED 2500 Timer";
++type_init(allwinner_h3_sysctrl_register)
 +    awc->read = aspeed_2500_timer_read;
 +    awc->write = aspeed_2500_timer_write;
 +}
 +
 +static const TypeInfo aspeed_2500_timer_info = {
 +    .name = TYPE_ASPEED_2500_TIMER,
 +    .parent = TYPE_ASPEED_TIMER,
 +    .class_init = aspeed_2500_timer_class_init,
  };
  static void aspeed_timer_register_types(void)
  {
      type_register_static(&aspeed_timer_info);
 +    type_register_static(&aspeed_2400_timer_info);
 +    type_register_static(&aspeed_2500_timer_info);
  }
  type_init(aspeed_timer_register_types)
 --
 .20.1

-[PULL 61/68] aspeed: add support for the Aspeed MII controller of the AST2600
+[PULL 17/36] hw/arm/allwinner: add CPU Configuration module
-From: Cédric Le Goater <clg@kaod.org>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-The AST2600 SoC has an extra controller to set the PHY registers.
+Various Allwinner System on Chip designs contain multiple processors
+that can be configured and reset using the generic CPU Configuration
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+module interface. This commit adds support for the Allwinner CPU
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+configuration interface which emulates the following features:
-Message-id: 20190925143248.10000-23-clg@kaod.org
  * CPU reset
  * CPU status
 Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20200311221854.30370-7-nieklinnenbank@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed_soc.h |   5 ++
+ hw/misc/Makefile.objs              |   1 +
- include/hw/net/ftgmac100.h  |  17 ++++
+ include/hw/arm/allwinner-h3.h      |   3 +
- hw/arm/aspeed_ast2600.c     |  20 +++++
+ include/hw/misc/allwinner-cpucfg.h |  52 ++++++
- hw/net/ftgmac100.c          | 162 ++++++++++++++++++++++++++++++++++++
+ hw/arm/allwinner-h3.c              |   9 +-
-files changed, 204 insertions(+)
+ hw/misc/allwinner-cpucfg.c         | 282 +++++++++++++++++++++++++++++
+ hw/misc/trace-events               |   5 +
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+files changed, 351 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/misc/allwinner-cpucfg.h
  create mode 100644 hw/misc/allwinner-cpucfg.c
 diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/hw/misc/Makefile.objs
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/hw/misc/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
+@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_MACIO) += macio/
-     AspeedSDMCState sdmc;
+ common-obj-$(CONFIG_IVSHMEM_DEVICE) += ivshmem.o
-     AspeedWDTState wdt[ASPEED_WDTS_NUM];
-     FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
+ common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-ccu.o
-+    AspeedMiiState mii[ASPEED_MACS_NUM];
++obj-$(CONFIG_ALLWINNER_H3) += allwinner-cpucfg.o
-     AspeedGPIOState gpio;
+ common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-sysctrl.o
-     AspeedGPIOState gpio_1_8v;
+ common-obj-$(CONFIG_REALVIEW) += arm_sysctl.o
-     AspeedSDHCIState sdhci;
+ common-obj-$(CONFIG_NSERIES) += cbus.o
 diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/allwinner-h3.h
 +++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/timer/allwinner-a10-pit.h"
  #include "hw/intc/arm_gic.h"
  #include "hw/misc/allwinner-h3-ccu.h"
 +#include "hw/misc/allwinner-cpucfg.h"
  #include "hw/misc/allwinner-h3-sysctrl.h"
  #include "target/arm/cpu.h"
 @@ -XXX,XX +XXX,XX @@ enum {
-     ASPEED_ETH2,
+     AW_H3_GIC_CPU,
-     ASPEED_ETH3,
+     AW_H3_GIC_HYP,
-     ASPEED_ETH4,
+     AW_H3_GIC_VCPU,
-+    ASPEED_MII1,
++    AW_H3_CPUCFG,
-+    ASPEED_MII2,
+     AW_H3_SDRAM
 +    ASPEED_MII3,
 +    ASPEED_MII4,
      ASPEED_SDRAM,
      ASPEED_XDMA,
  };
-diff --git a/include/hw/net/ftgmac100.h b/include/hw/net/ftgmac100.h
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
---- a/include/hw/net/ftgmac100.h
+     const hwaddr *memmap;
-+++ b/include/hw/net/ftgmac100.h
+     AwA10PITState timer;
-@@ -XXX,XX +XXX,XX @@ typedef struct FTGMAC100State {
+     AwH3ClockCtlState ccu;
-     uint32_t rxdes0_edorr;
++    AwCpuCfgState cpucfg;
- } FTGMAC100State;
+     AwH3SysCtrlState sysctrl;
+     GICState gic;
-+#define TYPE_ASPEED_MII "aspeed-mmi"
+     MemoryRegion sram_a1;
-+#define ASPEED_MII(obj) OBJECT_CHECK(AspeedMiiState, (obj), TYPE_ASPEED_MII)
+diff --git a/include/hw/misc/allwinner-cpucfg.h b/include/hw/misc/allwinner-cpucfg.h
-+
+new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/misc/allwinner-cpucfg.h
@@ -XXX,XX +XXX,XX @@
 +/*
-+ * AST2600 MII controller
++ * Allwinner CPU Configuration Module emulation
 + *
 + * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
-+typedef struct AspeedMiiState {
++
 +#ifndef HW_MISC_ALLWINNER_CPUCFG_H
 +#define HW_MISC_ALLWINNER_CPUCFG_H
 +
 +#include "qom/object.h"
 +#include "hw/sysbus.h"
 +
 +/**
 + * Object model
 + * @{
 + */
 +
 +#define TYPE_AW_CPUCFG   "allwinner-cpucfg"
 +#define AW_CPUCFG(obj) \
 +    OBJECT_CHECK(AwCpuCfgState, (obj), TYPE_AW_CPUCFG)
 +
 +/** @} */
 +
 +/**
 + * Allwinner CPU Configuration Module instance state
 + */
 +typedef struct AwCpuCfgState {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
-+
++    /*< public >*/
 +    FTGMAC100State *nic;
 +
 +    MemoryRegion iomem;
-+    uint32_t phycr;
++    uint32_t gen_ctrl;
-+    uint32_t phydata;
++    uint32_t super_standby;
-+} AspeedMiiState;
++    uint32_t entry_addr;
 +
- #endif
++} AwCpuCfgState;
-diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
++
 +#endif /* HW_MISC_ALLWINNER_CPUCFG_H */
 diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast2600.c
+--- a/hw/arm/allwinner-h3.c
-+++ b/hw/arm/aspeed_ast2600.c
++++ b/hw/arm/allwinner-h3.c
-@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
+@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
-     [ASPEED_FMC]       = 0x1E620000,
+     [AW_H3_GIC_CPU]    = 0x01c82000,
-     [ASPEED_SPI1]      = 0x1E630000,
+     [AW_H3_GIC_HYP]    = 0x01c84000,
-     [ASPEED_SPI2]      = 0x1E641000,
+     [AW_H3_GIC_VCPU]   = 0x01c86000,
-+    [ASPEED_MII1]      = 0x1E650000,
++    [AW_H3_CPUCFG]     = 0x01f01c00,
-+    [ASPEED_MII2]      = 0x1E650008,
+     [AW_H3_SDRAM]      = 0x40000000
-+    [ASPEED_MII3]      = 0x1E650010,
+ };
-+    [ASPEED_MII4]      = 0x1E650018,
-     [ASPEED_ETH1]      = 0x1E660000,
+@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
-     [ASPEED_ETH3]      = 0x1E670000,
+     { "r_wdog",    0x01f01000, 1 * KiB },
-     [ASPEED_ETH2]      = 0x1E680000,
+     { "r_prcm",    0x01f01400, 1 * KiB },
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
+     { "r_twd",     0x01f01800, 1 * KiB },
-     for (i = 0; i < sc->macs_num; i++) {
+-    { "r_cpucfg",  0x01f01c00, 1 * KiB },
-         sysbus_init_child_obj(obj, "ftgmac100[*]", OBJECT(&s->ftgmac100[i]),
+     { "r_cir-rx",  0x01f02000, 1 * KiB },
-                               sizeof(s->ftgmac100[i]), TYPE_FTGMAC100);
+     { "r_twi",     0x01f02400, 1 * KiB },
-+
+     { "r_uart",    0x01f02800, 1 * KiB },
-+        sysbus_init_child_obj(obj, "mii[*]", &s->mii[i], sizeof(s->mii[i]),
+@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
-+                              TYPE_ASPEED_MII);
-+        object_property_add_const_link(OBJECT(&s->mii[i]), "nic",
+     sysbus_init_child_obj(obj, "sysctrl", &s->sysctrl, sizeof(s->sysctrl),
-+                                       OBJECT(&s->ftgmac100[i]),
+                           TYPE_AW_H3_SYSCTRL);
-+                                       &error_abort);
++
-     }
++    sysbus_init_child_obj(obj, "cpucfg", &s->cpucfg, sizeof(s->cpucfg),
++                          TYPE_AW_CPUCFG);
-     sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
+ }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-                         sc->memmap[ASPEED_ETH1 + i]);
+ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
-         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
+@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
-                            aspeed_soc_get_irq(s, ASPEED_ETH1 + i));
+     qdev_init_nofail(DEVICE(&s->sysctrl));
-+
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysctrl), 0, s->memmap[AW_H3_SYSCTRL]);
-+        object_property_set_bool(OBJECT(&s->mii[i]), true, "realized",
-+                                 &err);
++    /* CPU Configuration */
-+        if (err) {
++    qdev_init_nofail(DEVICE(&s->cpucfg));
-+            error_propagate(errp, err);
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->cpucfg), 0, s->memmap[AW_H3_CPUCFG]);
-+            return;
++
-+        }
+     /* Universal Serial Bus */
-+
+     sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI0],
-+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->mii[i]), 0,
+                          qdev_get_gpio_in(DEVICE(&s->gic),
-+                        sc->memmap[ASPEED_MII1 + i]);
+diff --git a/hw/misc/allwinner-cpucfg.c b/hw/misc/allwinner-cpucfg.c
-     }
+new file mode 100644
+index XXXXXXX..XXXXXXX
-     /* XDMA */
+--- /dev/null
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
++++ b/hw/misc/allwinner-cpucfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/ftgmac100.c
 +++ b/hw/net/ftgmac100.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/irq.h"
- #include "hw/net/ftgmac100.h"
- #include "sysemu/dma.h"
-+#include "qapi/error.h"
- #include "qemu/log.h"
- #include "qemu/module.h"
- #include "net/checksum.h"
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo ftgmac100_info = {
-     .class_init = ftgmac100_class_init,
- };
 +/*
-+ * AST2600 MII controller
++ * Allwinner CPU Configuration Module emulation
 + *
 + * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
-+#define ASPEED_MII_PHYCR_FIRE        BIT(31)
++
-+#define ASPEED_MII_PHYCR_ST_22       BIT(28)
++#include "qemu/osdep.h"
-+#define ASPEED_MII_PHYCR_OP(x)       ((x) & (ASPEED_MII_PHYCR_OP_WRITE | \
++#include "qemu/units.h"
-+                                             ASPEED_MII_PHYCR_OP_READ))
++#include "hw/sysbus.h"
-+#define ASPEED_MII_PHYCR_OP_WRITE    BIT(26)
++#include "migration/vmstate.h"
-+#define ASPEED_MII_PHYCR_OP_READ     BIT(27)
++#include "qemu/log.h"
-+#define ASPEED_MII_PHYCR_DATA(x)     (x & 0xffff)
++#include "qemu/module.h"
-+#define ASPEED_MII_PHYCR_PHY(x)      (((x) >> 21) & 0x1f)
++#include "qemu/error-report.h"
-+#define ASPEED_MII_PHYCR_REG(x)      (((x) >> 16) & 0x1f)
++#include "qemu/timer.h"
-+
++#include "hw/core/cpu.h"
-+#define ASPEED_MII_PHYDATA_IDLE      BIT(16)
++#include "target/arm/arm-powerctl.h"
-+
++#include "target/arm/cpu.h"
-+static void aspeed_mii_transition(AspeedMiiState *s, bool fire)
++#include "hw/misc/allwinner-cpucfg.h"
-+{
++#include "trace.h"
-+    if (fire) {
++
-+        s->phycr |= ASPEED_MII_PHYCR_FIRE;
++/* CPUCFG register offsets */
-+        s->phydata &= ~ASPEED_MII_PHYDATA_IDLE;
++enum {
-+    } else {
++    REG_CPUS_RST_CTRL       = 0x0000, /* CPUs Reset Control */
-+        s->phycr &= ~ASPEED_MII_PHYCR_FIRE;
++    REG_CPU0_RST_CTRL       = 0x0040, /* CPU#0 Reset Control */
-+        s->phydata |= ASPEED_MII_PHYDATA_IDLE;
++    REG_CPU0_CTRL           = 0x0044, /* CPU#0 Control */
-+    }
++    REG_CPU0_STATUS         = 0x0048, /* CPU#0 Status */
-+}
++    REG_CPU1_RST_CTRL       = 0x0080, /* CPU#1 Reset Control */
-+
++    REG_CPU1_CTRL           = 0x0084, /* CPU#1 Control */
-+static void aspeed_mii_do_phy_ctl(AspeedMiiState *s)
++    REG_CPU1_STATUS         = 0x0088, /* CPU#1 Status */
-+{
++    REG_CPU2_RST_CTRL       = 0x00C0, /* CPU#2 Reset Control */
-+    uint8_t reg;
++    REG_CPU2_CTRL           = 0x00C4, /* CPU#2 Control */
-+    uint16_t data;
++    REG_CPU2_STATUS         = 0x00C8, /* CPU#2 Status */
-+
++    REG_CPU3_RST_CTRL       = 0x0100, /* CPU#3 Reset Control */
-+    if (!(s->phycr & ASPEED_MII_PHYCR_ST_22)) {
++    REG_CPU3_CTRL           = 0x0104, /* CPU#3 Control */
-+        aspeed_mii_transition(s, !ASPEED_MII_PHYCR_FIRE);
++    REG_CPU3_STATUS         = 0x0108, /* CPU#3 Status */
-+        qemu_log_mask(LOG_UNIMP, "%s: unsupported ST code\n", __func__);
++    REG_CPU_SYS_RST         = 0x0140, /* CPU System Reset */
 +    REG_CLK_GATING          = 0x0144, /* CPU Clock Gating */
 +    REG_GEN_CTRL            = 0x0184, /* General Control */
 +    REG_SUPER_STANDBY       = 0x01A0, /* Super Standby Flag */
 +    REG_ENTRY_ADDR          = 0x01A4, /* Reset Entry Address */
 +    REG_DBG_EXTERN          = 0x01E4, /* Debug External */
 +    REG_CNT64_CTRL          = 0x0280, /* 64-bit Counter Control */
 +    REG_CNT64_LOW           = 0x0284, /* 64-bit Counter Low */
 +    REG_CNT64_HIGH          = 0x0288, /* 64-bit Counter High */
 +};
 +
 +/* CPUCFG register flags */
 +enum {
 +    CPUX_RESET_RELEASED     = ((1 << 1) | (1 << 0)),
 +    CPUX_STATUS_SMP         = (1 << 0),
 +    CPU_SYS_RESET_RELEASED  = (1 << 0),
 +    CLK_GATING_ENABLE       = ((1 << 8) | 0xF),
 +};
 +
 +/* CPUCFG register reset values */
 +enum {
 +    REG_CLK_GATING_RST      = 0x0000010F,
 +    REG_GEN_CTRL_RST        = 0x00000020,
 +    REG_SUPER_STANDBY_RST   = 0x0,
 +    REG_CNT64_CTRL_RST      = 0x0,
 +};
 +
 +/* CPUCFG constants */
 +enum {
 +    CPU_EXCEPTION_LEVEL_ON_RESET = 3, /* EL3 */
 +};
 +
 +static void allwinner_cpucfg_cpu_reset(AwCpuCfgState *s, uint8_t cpu_id)
 +{
 +    int ret;
 +
 +    trace_allwinner_cpucfg_cpu_reset(cpu_id, s->entry_addr);
 +
 +    ARMCPU *target_cpu = ARM_CPU(arm_get_cpu_by_id(cpu_id));
 +    if (!target_cpu) {
 +        /*
 +         * Called with a bogus value for cpu_id. Guest error will
 +         * already have been logged, we can simply return here.
 +         */
 +        return;
 +    }
-+
++    bool target_aa64 = arm_feature(&target_cpu->env, ARM_FEATURE_AARCH64);
-+    /* Nothing to do */
++
-+    if (!(s->phycr & ASPEED_MII_PHYCR_FIRE)) {
++    ret = arm_set_cpu_on(cpu_id, s->entry_addr, 0,
 +                         CPU_EXCEPTION_LEVEL_ON_RESET, target_aa64);
 +    if (ret != QEMU_ARM_POWERCTL_RET_SUCCESS) {
 +        error_report("%s: failed to bring up CPU %d: err %d",
 +                     __func__, cpu_id, ret);
 +        return;
 +    }
-+
++}
-+    reg = ASPEED_MII_PHYCR_REG(s->phycr);
++
-+    data = ASPEED_MII_PHYCR_DATA(s->phycr);
++static uint64_t allwinner_cpucfg_read(void *opaque, hwaddr offset,
-+
++                                      unsigned size)
-+    switch (ASPEED_MII_PHYCR_OP(s->phycr)) {
++{
-+    case ASPEED_MII_PHYCR_OP_WRITE:
++    const AwCpuCfgState *s = AW_CPUCFG(opaque);
-+        do_phy_write(s->nic, reg, data);
++    uint64_t val = 0;
-+        break;
++
-+    case ASPEED_MII_PHYCR_OP_READ:
++    switch (offset) {
-+        s->phydata = (s->phydata & ~0xffff) | do_phy_read(s->nic, reg);
++    case REG_CPUS_RST_CTRL:     /* CPUs Reset Control */
 +    case REG_CPU_SYS_RST:       /* CPU System Reset */
 +        val = CPU_SYS_RESET_RELEASED;
 +        break;
 +    case REG_CPU0_RST_CTRL:     /* CPU#0 Reset Control */
 +    case REG_CPU1_RST_CTRL:     /* CPU#1 Reset Control */
 +    case REG_CPU2_RST_CTRL:     /* CPU#2 Reset Control */
 +    case REG_CPU3_RST_CTRL:     /* CPU#3 Reset Control */
 +        val = CPUX_RESET_RELEASED;
 +        break;
 +    case REG_CPU0_CTRL:         /* CPU#0 Control */
 +    case REG_CPU1_CTRL:         /* CPU#1 Control */
 +    case REG_CPU2_CTRL:         /* CPU#2 Control */
 +    case REG_CPU3_CTRL:         /* CPU#3 Control */
 +        val = 0;
 +        break;
 +    case REG_CPU0_STATUS:       /* CPU#0 Status */
 +    case REG_CPU1_STATUS:       /* CPU#1 Status */
 +    case REG_CPU2_STATUS:       /* CPU#2 Status */
 +    case REG_CPU3_STATUS:       /* CPU#3 Status */
 +        val = CPUX_STATUS_SMP;
 +        break;
 +    case REG_CLK_GATING:        /* CPU Clock Gating */
 +        val = CLK_GATING_ENABLE;
 +        break;
 +    case REG_GEN_CTRL:          /* General Control */
 +        val = s->gen_ctrl;
 +        break;
 +    case REG_SUPER_STANDBY:     /* Super Standby Flag */
 +        val = s->super_standby;
 +        break;
 +    case REG_ENTRY_ADDR:        /* Reset Entry Address */
 +        val = s->entry_addr;
 +        break;
 +    case REG_DBG_EXTERN:        /* Debug External */
 +    case REG_CNT64_CTRL:        /* 64-bit Counter Control */
 +    case REG_CNT64_LOW:         /* 64-bit Counter Low */
 +    case REG_CNT64_HIGH:        /* 64-bit Counter High */
 +        qemu_log_mask(LOG_UNIMP, "%s: unimplemented register at 0x%04x\n",
 +                      __func__, (uint32_t)offset);
 +        break;
 +    default:
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid OP code %08x\n",
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
-+                      __func__, s->phycr);
++                      __func__, (uint32_t)offset);
 +        break;
 +    }
 +
-+    aspeed_mii_transition(s, !ASPEED_MII_PHYCR_FIRE);
++    trace_allwinner_cpucfg_read(offset, val, size);
-+}
++
-+
++    return val;
-+static uint64_t aspeed_mii_read(void *opaque, hwaddr addr, unsigned size)
++}
-+{
++
-+    AspeedMiiState *s = ASPEED_MII(opaque);
++static void allwinner_cpucfg_write(void *opaque, hwaddr offset,
-+
++                                   uint64_t val, unsigned size)
-+    switch (addr) {
++{
-+    case 0x0:
++    AwCpuCfgState *s = AW_CPUCFG(opaque);
-+        return s->phycr;
++
-+    case 0x4:
++    trace_allwinner_cpucfg_write(offset, val, size);
-+        return s->phydata;
++
 +    switch (offset) {
 +    case REG_CPUS_RST_CTRL:     /* CPUs Reset Control */
 +    case REG_CPU_SYS_RST:       /* CPU System Reset */
 +        break;
 +    case REG_CPU0_RST_CTRL:     /* CPU#0 Reset Control */
 +    case REG_CPU1_RST_CTRL:     /* CPU#1 Reset Control */
 +    case REG_CPU2_RST_CTRL:     /* CPU#2 Reset Control */
 +    case REG_CPU3_RST_CTRL:     /* CPU#3 Reset Control */
 +        if (val) {
 +            allwinner_cpucfg_cpu_reset(s, (offset - REG_CPU0_RST_CTRL) >> 6);
 +        }
 +        break;
 +    case REG_CPU0_CTRL:         /* CPU#0 Control */
 +    case REG_CPU1_CTRL:         /* CPU#1 Control */
 +    case REG_CPU2_CTRL:         /* CPU#2 Control */
 +    case REG_CPU3_CTRL:         /* CPU#3 Control */
 +    case REG_CPU0_STATUS:       /* CPU#0 Status */
 +    case REG_CPU1_STATUS:       /* CPU#1 Status */
 +    case REG_CPU2_STATUS:       /* CPU#2 Status */
 +    case REG_CPU3_STATUS:       /* CPU#3 Status */
 +    case REG_CLK_GATING:        /* CPU Clock Gating */
 +        break;
 +    case REG_GEN_CTRL:          /* General Control */
 +        s->gen_ctrl = val;
 +        break;
 +    case REG_SUPER_STANDBY:     /* Super Standby Flag */
 +        s->super_standby = val;
 +        break;
 +    case REG_ENTRY_ADDR:        /* Reset Entry Address */
 +        s->entry_addr = val;
 +        break;
 +    case REG_DBG_EXTERN:        /* Debug External */
 +    case REG_CNT64_CTRL:        /* 64-bit Counter Control */
 +    case REG_CNT64_LOW:         /* 64-bit Counter Low */
 +    case REG_CNT64_HIGH:        /* 64-bit Counter High */
 +        qemu_log_mask(LOG_UNIMP, "%s: unimplemented register at 0x%04x\n",
 +                      __func__, (uint32_t)offset);
 +        break;
 +    default:
-+        g_assert_not_reached();
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
 +                      __func__, (uint32_t)offset);
 +        break;
 +    }
 +}
 +
-+static void aspeed_mii_write(void *opaque, hwaddr addr,
++static const MemoryRegionOps allwinner_cpucfg_ops = {
-+                             uint64_t value, unsigned size)
++    .read = allwinner_cpucfg_read,
-+{
++    .write = allwinner_cpucfg_write,
-+    AspeedMiiState *s = ASPEED_MII(opaque);
++    .endianness = DEVICE_NATIVE_ENDIAN,
-+
++    .valid = {
-+    switch (addr) {
++        .min_access_size = 4,
-+    case 0x0:
++        .max_access_size = 4,
-+        s->phycr = value & ~(s->phycr & ASPEED_MII_PHYCR_FIRE);
++    },
-+        break;
++    .impl.min_access_size = 4,
-+    case 0x4:
++};
-+        s->phydata = value & ~(0xffff | ASPEED_MII_PHYDATA_IDLE);
++
-+        break;
++static void allwinner_cpucfg_reset(DeviceState *dev)
-+    default:
++{
-+        g_assert_not_reached();
++    AwCpuCfgState *s = AW_CPUCFG(dev);
-+    }
++
-+
++    /* Set default values for registers */
-+    aspeed_mii_transition(s, !!(s->phycr & ASPEED_MII_PHYCR_FIRE));
++    s->gen_ctrl = REG_GEN_CTRL_RST;
-+    aspeed_mii_do_phy_ctl(s);
++    s->super_standby = REG_SUPER_STANDBY_RST;
-+}
++    s->entry_addr = 0;
-+
++}
-+static const MemoryRegionOps aspeed_mii_ops = {
++
-+    .read = aspeed_mii_read,
++static void allwinner_cpucfg_init(Object *obj)
-+    .write = aspeed_mii_write,
++{
-+    .valid.min_access_size = 4,
++    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-+    .valid.max_access_size = 4,
++    AwCpuCfgState *s = AW_CPUCFG(obj);
-+    .endianness = DEVICE_LITTLE_ENDIAN,
++
-+};
++    /* Memory mapping */
-+
++    memory_region_init_io(&s->iomem, OBJECT(s), &allwinner_cpucfg_ops, s,
-+static void aspeed_mii_reset(DeviceState *dev)
++                          TYPE_AW_CPUCFG, 1 * KiB);
 +{
 +    AspeedMiiState *s = ASPEED_MII(dev);
 +
 +    s->phycr = 0;
 +    s->phydata = 0;
 +
 +    aspeed_mii_transition(s, !!(s->phycr & ASPEED_MII_PHYCR_FIRE));
 +};
 +
 +static void aspeed_mii_realize(DeviceState *dev, Error **errp)
 +{
 +    AspeedMiiState *s = ASPEED_MII(dev);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 +    Object *obj;
 +    Error *local_err = NULL;
 +
 +    obj = object_property_get_link(OBJECT(dev), "nic", &local_err);
 +    if (!obj) {
 +        error_propagate(errp, local_err);
 +        error_prepend(errp, "required link 'nic' not found: ");
 +        return;
 +    }
 +
 +    s->nic = FTGMAC100(obj);
 +
 +    memory_region_init_io(&s->iomem, OBJECT(dev), &aspeed_mii_ops, s,
 +                          TYPE_ASPEED_MII, 0x8);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +}
 +
-+static const VMStateDescription vmstate_aspeed_mii = {
++static const VMStateDescription allwinner_cpucfg_vmstate = {
-+    .name = TYPE_ASPEED_MII,
++    .name = "allwinner-cpucfg",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
-+        VMSTATE_UINT32(phycr, FTGMAC100State),
++        VMSTATE_UINT32(gen_ctrl, AwCpuCfgState),
-+        VMSTATE_UINT32(phydata, FTGMAC100State),
++        VMSTATE_UINT32(super_standby, AwCpuCfgState),
 +        VMSTATE_UINT32(entry_addr, AwCpuCfgState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
-+static void aspeed_mii_class_init(ObjectClass *klass, void *data)
++
 +static void allwinner_cpucfg_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
-+    dc->vmsd = &vmstate_aspeed_mii;
++    dc->reset = allwinner_cpucfg_reset;
-+    dc->reset = aspeed_mii_reset;
++    dc->vmsd = &allwinner_cpucfg_vmstate;
-+    dc->realize = aspeed_mii_realize;
++}
-+    dc->desc = "Aspeed MII controller";
++
-+}
++static const TypeInfo allwinner_cpucfg_info = {
-+
++    .name          = TYPE_AW_CPUCFG,
-+static const TypeInfo aspeed_mii_info = {
++    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .name = TYPE_ASPEED_MII,
++    .instance_init = allwinner_cpucfg_init,
-+    .parent = TYPE_SYS_BUS_DEVICE,
++    .instance_size = sizeof(AwCpuCfgState),
-+    .instance_size = sizeof(AspeedMiiState),
++    .class_init    = allwinner_cpucfg_class_init,
-+    .class_init = aspeed_mii_class_init,
++};
-+};
++
-+
++static void allwinner_cpucfg_register(void)
- static void ftgmac100_register_types(void)
++{
- {
++    type_register_static(&allwinner_cpucfg_info);
-     type_register_static(&ftgmac100_info);
++}
-+    type_register_static(&aspeed_mii_info);
++
- }
++type_init(allwinner_cpucfg_register)
+diff --git a/hw/misc/trace-events b/hw/misc/trace-events
- type_init(ftgmac100_register_types)
+index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@
  # See docs/devel/tracing.txt for syntax documentation.
 +# allwinner-cpucfg.c
 +allwinner_cpucfg_cpu_reset(uint8_t cpu_id, uint32_t reset_addr) "id %u, reset_addr 0x%" PRIu32
 +allwinner_cpucfg_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +allwinner_cpucfg_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +
  # eccmemctl.c
  ecc_mem_writel_mer(uint32_t val) "Write memory enable 0x%08x"
  ecc_mem_writel_mdr(uint32_t val) "Write memory delay 0x%08x"
 --
 .20.1

-[PULL 45/68] aspeed/timer: Add AST2600 support
+[PULL 18/36] hw/arm/allwinner: add Security Identifier device
-From: Cédric Le Goater <clg@kaod.org>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-The AST2600 timer has a third control register that is used to
+The Security Identifier device found in various Allwinner System on Chip
-implement a set-to-clear feature for the main control register.
+designs gives applications a per-board unique identifier. This commit
+adds support for the Allwinner Security Identifier using a 128-bit
-On the AST2600, it is not configurable via 0x38 (control register 3)
+UUID value as input.
-as it is on the AST2500.
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-Based on previous work from Joel Stanley.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20200311221854.30370-8-nieklinnenbank@gmail.com
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Joel Stanley <joel@jms.id.au>
 Message-id: 20190925143248.10000-7-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/timer/aspeed_timer.h |  1 +
+ hw/misc/Makefile.objs           |   1 +
- hw/timer/aspeed_timer.c         | 51 +++++++++++++++++++++++++++++++++
+ include/hw/arm/allwinner-h3.h   |   3 +
-files changed, 52 insertions(+)
+ include/hw/misc/allwinner-sid.h |  60 ++++++++++++
+ hw/arm/allwinner-h3.c           |  11 ++-
-diff --git a/include/hw/timer/aspeed_timer.h b/include/hw/timer/aspeed_timer.h
+ hw/arm/orangepi.c               |   8 ++
-index XXXXXXX..XXXXXXX 100644
+ hw/misc/allwinner-sid.c         | 168 ++++++++++++++++++++++++++++++++
---- a/include/hw/timer/aspeed_timer.h
+ hw/misc/trace-events            |   4 +
-+++ b/include/hw/timer/aspeed_timer.h
+files changed, 254 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/misc/allwinner-sid.h
  create mode 100644 hw/misc/allwinner-sid.c
 diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/Makefile.objs
 +++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_IVSHMEM_DEVICE) += ivshmem.o
  common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-ccu.o
  obj-$(CONFIG_ALLWINNER_H3) += allwinner-cpucfg.o
  common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-sysctrl.o
 +common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-sid.o
  common-obj-$(CONFIG_REALVIEW) += arm_sysctl.o
  common-obj-$(CONFIG_NSERIES) += cbus.o
  common-obj-$(CONFIG_ECCMEMCTL) += eccmemctl.o
 diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/allwinner-h3.h
 +++ b/include/hw/arm/allwinner-h3.h
 @@ -XXX,XX +XXX,XX @@
- #define TYPE_ASPEED_TIMER "aspeed.timer"
+ #include "hw/misc/allwinner-h3-ccu.h"
- #define TYPE_ASPEED_2400_TIMER TYPE_ASPEED_TIMER "-ast2400"
+ #include "hw/misc/allwinner-cpucfg.h"
- #define TYPE_ASPEED_2500_TIMER TYPE_ASPEED_TIMER "-ast2500"
+ #include "hw/misc/allwinner-h3-sysctrl.h"
-+#define TYPE_ASPEED_2600_TIMER TYPE_ASPEED_TIMER "-ast2600"
++#include "hw/misc/allwinner-sid.h"
+ #include "target/arm/cpu.h"
- #define ASPEED_TIMER_NR_TIMERS 8
+ /**
-diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
+@@ -XXX,XX +XXX,XX @@ enum {
-index XXXXXXX..XXXXXXX 100644
+     AW_H3_SRAM_A2,
---- a/hw/timer/aspeed_timer.c
+     AW_H3_SRAM_C,
-+++ b/hw/timer/aspeed_timer.c
+     AW_H3_SYSCTRL,
-@@ -XXX,XX +XXX,XX @@ static void aspeed_2500_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
++    AW_H3_SID,
-     }
+     AW_H3_EHCI0,
      AW_H3_OHCI0,
      AW_H3_EHCI1,
@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
      AwH3ClockCtlState ccu;
      AwCpuCfgState cpucfg;
      AwH3SysCtrlState sysctrl;
 +    AwSidState sid;
      GICState gic;
      MemoryRegion sram_a1;
      MemoryRegion sram_a2;
 diff --git a/include/hw/misc/allwinner-sid.h b/include/hw/misc/allwinner-sid.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/misc/allwinner-sid.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Allwinner Security ID emulation
 + *
 + * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#ifndef HW_MISC_ALLWINNER_SID_H
 +#define HW_MISC_ALLWINNER_SID_H
 +
 +#include "qom/object.h"
 +#include "hw/sysbus.h"
 +#include "qemu/uuid.h"
 +
 +/**
 + * Object model
 + * @{
 + */
 +
 +#define TYPE_AW_SID    "allwinner-sid"
 +#define AW_SID(obj) \
 +    OBJECT_CHECK(AwSidState, (obj), TYPE_AW_SID)
 +
 +/** @} */
 +
 +/**
 + * Allwinner Security ID object instance state
 + */
 +typedef struct AwSidState {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +    /*< public >*/
 +
 +    /** Maps I/O registers in physical memory */
 +    MemoryRegion iomem;
 +
 +    /** Control register defines how and what to read */
 +    uint32_t control;
 +
 +    /** RdKey register contains the data retrieved by the device */
 +    uint32_t rdkey;
 +
 +    /** Stores the emulated device identifier */
 +    QemuUUID identifier;
 +
 +} AwSidState;
 +
 +#endif /* HW_MISC_ALLWINNER_SID_H */
 diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/allwinner-h3.c
 +++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
      [AW_H3_SRAM_A2]    = 0x00044000,
      [AW_H3_SRAM_C]     = 0x00010000,
      [AW_H3_SYSCTRL]    = 0x01c00000,
 +    [AW_H3_SID]        = 0x01c14000,
      [AW_H3_EHCI0]      = 0x01c1a000,
      [AW_H3_OHCI0]      = 0x01c1a400,
      [AW_H3_EHCI1]      = 0x01c1b000,
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
      { "mmc0",      0x01c0f000, 4 * KiB },
      { "mmc1",      0x01c10000, 4 * KiB },
      { "mmc2",      0x01c11000, 4 * KiB },
 -    { "sid",       0x01c14000, 1 * KiB },
      { "crypto",    0x01c15000, 4 * KiB },
      { "msgbox",    0x01c17000, 4 * KiB },
      { "spinlock",  0x01c18000, 4 * KiB },
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
      sysbus_init_child_obj(obj, "cpucfg", &s->cpucfg, sizeof(s->cpucfg),
                            TYPE_AW_CPUCFG);
 +
 +    sysbus_init_child_obj(obj, "sid", &s->sid, sizeof(s->sid),
 +                          TYPE_AW_SID);
 +    object_property_add_alias(obj, "identifier", OBJECT(&s->sid),
 +                              "identifier", &error_abort);
  }
-+static uint64_t aspeed_2600_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
+ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
-+{
+@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
-+    uint64_t value;
+     qdev_init_nofail(DEVICE(&s->cpucfg));
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->cpucfg), 0, s->memmap[AW_H3_CPUCFG]);
 +    /* Security Identifier */
 +    qdev_init_nofail(DEVICE(&s->sid));
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sid), 0, s->memmap[AW_H3_SID]);
 +
      /* Universal Serial Bus */
      sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI0],
                           qdev_get_gpio_in(DEVICE(&s->gic),
 diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/orangepi.c
 +++ b/hw/arm/orangepi.c
@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)
      object_property_set_int(OBJECT(h3), 24 * 1000 * 1000, "clk1-freq",
                              &error_abort);
 +    /* Setup SID properties. Currently using a default fixed SID identifier. */
 +    if (qemu_uuid_is_null(&h3->sid.identifier)) {
 +        qdev_prop_set_string(DEVICE(h3), "identifier",
 +                             "02c00081-1111-2222-3333-000044556677");
 +    } else if (ldl_be_p(&h3->sid.identifier.data[0]) != 0x02c00081) {
 +        warn_report("Security Identifier value does not include H3 prefix");
 +    }
 +
      /* Mark H3 object realized */
      object_property_set_bool(OBJECT(h3), true, "realized", &error_abort);
 diff --git a/hw/misc/allwinner-sid.c b/hw/misc/allwinner-sid.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/allwinner-sid.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Allwinner Security ID emulation
 + *
 + * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/units.h"
 +#include "hw/sysbus.h"
 +#include "migration/vmstate.h"
 +#include "qemu/log.h"
 +#include "qemu/module.h"
 +#include "qemu/guest-random.h"
 +#include "qapi/error.h"
 +#include "hw/qdev-properties.h"
 +#include "hw/misc/allwinner-sid.h"
 +#include "trace.h"
 +
 +/* SID register offsets */
 +enum {
 +    REG_PRCTL = 0x40,   /* Control */
 +    REG_RDKEY = 0x60,   /* Read Key */
 +};
 +
 +/* SID register flags */
 +enum {
 +    REG_PRCTL_WRITE   = 0x0002, /* Unknown write flag */
 +    REG_PRCTL_OP_LOCK = 0xAC00, /* Lock operation */
 +};
 +
 +static uint64_t allwinner_sid_read(void *opaque, hwaddr offset,
 +                                   unsigned size)
 +{
 +    const AwSidState *s = AW_SID(opaque);
 +    uint64_t val = 0;
 +
 +    switch (offset) {
-+    case 0x38:
++    case REG_PRCTL:    /* Control */
-+    case 0x3C:
++        val = s->control;
 +        break;
 +    case REG_RDKEY:    /* Read Key */
 +        val = s->rdkey;
 +        break;
 +    default:
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
-+                __func__, offset);
++                      __func__, (uint32_t)offset);
-+        value = 0;
++        return 0;
 +        break;
 +    }
-+    return value;
++
-+}
++    trace_allwinner_sid_read(offset, val, size);
 +
-+static void aspeed_2600_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
++    return val;
-+                                    uint64_t value)
++}
-+{
++
-+    const uint32_t tv = (uint32_t)(value & 0xFFFFFFFF);
++static void allwinner_sid_write(void *opaque, hwaddr offset,
 +                                uint64_t val, unsigned size)
 +{
 +    AwSidState *s = AW_SID(opaque);
 +
 +    trace_allwinner_sid_write(offset, val, size);
 +
 +    switch (offset) {
-+    case 0x3C:
++    case REG_PRCTL:    /* Control */
-+        aspeed_timer_set_ctrl(s, s->ctrl & ~tv);
++        s->control = val;
-+        break;
++
-+
++        if ((s->control & REG_PRCTL_OP_LOCK) &&
-+    case 0x38:
++            (s->control & REG_PRCTL_WRITE)) {
 +            uint32_t id = s->control >> 16;
 +
 +            if (id <= sizeof(QemuUUID) - sizeof(s->rdkey)) {
 +                s->rdkey = ldl_be_p(&s->identifier.data[id]);
 +            }
 +        }
 +        s->control &= ~REG_PRCTL_WRITE;
 +        break;
 +    case REG_RDKEY:    /* Read Key */
 +        break;
 +    default:
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
-+                __func__, offset);
++                      __func__, (uint32_t)offset);
 +        break;
 +    }
 +}
 +
- static void aspeed_init_one_timer(AspeedTimerCtrlState *s, uint8_t id)
++static const MemoryRegionOps allwinner_sid_ops = {
- {
++    .read = allwinner_sid_read,
-     AspeedTimer *t = &s->timers[id];
++    .write = allwinner_sid_write,
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_2500_timer_info = {
++    .endianness = DEVICE_NATIVE_ENDIAN,
-     .class_init = aspeed_2500_timer_class_init,
++    .valid = {
- };
++        .min_access_size = 4,
++        .max_access_size = 4,
-+static void aspeed_2600_timer_class_init(ObjectClass *klass, void *data)
++    },
 +    .impl.min_access_size = 4,
 +};
 +
 +static void allwinner_sid_reset(DeviceState *dev)
 +{
 +    AwSidState *s = AW_SID(dev);
 +
 +    /* Set default values for registers */
 +    s->control = 0;
 +    s->rdkey = 0;
 +}
 +
 +static void allwinner_sid_init(Object *obj)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    AwSidState *s = AW_SID(obj);
 +
 +    /* Memory mapping */
 +    memory_region_init_io(&s->iomem, OBJECT(s), &allwinner_sid_ops, s,
 +                           TYPE_AW_SID, 1 * KiB);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +}
 +
 +static Property allwinner_sid_properties[] = {
 +    DEFINE_PROP_UUID_NODEFAULT("identifier", AwSidState, identifier),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
 +static const VMStateDescription allwinner_sid_vmstate = {
 +    .name = "allwinner-sid",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(control, AwSidState),
 +        VMSTATE_UINT32(rdkey, AwSidState),
 +        VMSTATE_UINT8_ARRAY_V(identifier.data, AwSidState, sizeof(QemuUUID), 1),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void allwinner_sid_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
-+    AspeedTimerClass *awc = ASPEED_TIMER_CLASS(klass);
++
-+
++    dc->reset = allwinner_sid_reset;
-+    dc->desc = "ASPEED 2600 Timer";
++    dc->vmsd = &allwinner_sid_vmstate;
-+    awc->read = aspeed_2600_timer_read;
++    device_class_set_props(dc, allwinner_sid_properties);
-+    awc->write = aspeed_2600_timer_write;
++}
-+}
++
-+
++static const TypeInfo allwinner_sid_info = {
-+static const TypeInfo aspeed_2600_timer_info = {
++    .name          = TYPE_AW_SID,
-+    .name = TYPE_ASPEED_2600_TIMER,
++    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .parent = TYPE_ASPEED_TIMER,
++    .instance_init = allwinner_sid_init,
-+    .class_init = aspeed_2600_timer_class_init,
++    .instance_size = sizeof(AwSidState),
-+};
++    .class_init    = allwinner_sid_class_init,
-+
++};
- static void aspeed_timer_register_types(void)
++
- {
++static void allwinner_sid_register(void)
-     type_register_static(&aspeed_timer_info);
++{
-     type_register_static(&aspeed_2400_timer_info);
++    type_register_static(&allwinner_sid_info);
-     type_register_static(&aspeed_2500_timer_info);
++}
-+    type_register_static(&aspeed_2600_timer_info);
++
- }
++type_init(allwinner_sid_register)
+diff --git a/hw/misc/trace-events b/hw/misc/trace-events
- type_init(aspeed_timer_register_types)
+index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ allwinner_cpucfg_cpu_reset(uint8_t cpu_id, uint32_t reset_addr) "id %u, reset_ad
  allwinner_cpucfg_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
  allwinner_cpucfg_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +# allwinner-sid.c
 +allwinner_sid_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +allwinner_sid_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +
  # eccmemctl.c
  ecc_mem_writel_mer(uint32_t val) "Write memory enable 0x%08x"
  ecc_mem_writel_mdr(uint32_t val) "Write memory delay 0x%08x"
 --
 .20.1

-[PULL 01/68] linux headers: update against v5.4-rc1
+[PULL 19/36] hw/arm/allwinner: add SD/MMC host controller
-From: Eric Auger <eric.auger@redhat.com>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-Update the headers against commit:
+The Allwinner System on Chip families sun4i and above contain
-f1a7b3fac05 ("timer-of: don't use conditional expression
+an integrated storage controller for Secure Digital (SD) and
-with mixed 'void' types")
+Multi Media Card (MMC) interfaces. This commit adds support
 for the Allwinner SD/MMC storage controller with the following
 emulated features:
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+ * DMA transfers
-Acked-by: Marc Zyngier <maz@kernel.org>
+ * Direct FIFO I/O
-Message-id: 20191003154640.22451-2-eric.auger@redhat.com
+ * Short/Long format command responses
  * Auto-Stop command (CMD12)
  * Insert & remove card detection
 The following boards are extended with the SD host controller:
  * Cubieboard (hw/arm/cubieboard.c)
  * Orange Pi PC (hw/arm/orangepi.c)
 Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20200311221854.30370-9-nieklinnenbank@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/standard-headers/asm-x86/bootparam.h  |   2 +
+ hw/sd/Makefile.objs              |   1 +
- include/standard-headers/asm-x86/kvm_para.h   |   1 +
+ include/hw/arm/allwinner-a10.h   |   2 +
- include/standard-headers/linux/ethtool.h      |  24 +++
+ include/hw/arm/allwinner-h3.h    |   3 +
- include/standard-headers/linux/pci_regs.h     |  19 +-
+ include/hw/sd/allwinner-sdhost.h | 135 +++++
- include/standard-headers/linux/virtio_fs.h    |  19 ++
+ hw/arm/allwinner-a10.c           |  11 +
- include/standard-headers/linux/virtio_ids.h   |   2 +
+ hw/arm/allwinner-h3.c            |  15 +-
- include/standard-headers/linux/virtio_iommu.h | 165 ++++++++++++++++++
+ hw/arm/cubieboard.c              |  15 +
- include/standard-headers/linux/virtio_pmem.h  |   6 +-
+ hw/arm/orangepi.c                |  16 +
- linux-headers/asm-arm/kvm.h                   |  16 +-
+ hw/sd/allwinner-sdhost.c         | 854 +++++++++++++++++++++++++++++++
- linux-headers/asm-arm/unistd-common.h         |   2 +
+ hw/arm/Kconfig                   |   1 +
- linux-headers/asm-arm64/kvm.h                 |  21 ++-
+ hw/sd/trace-events               |   7 +
- linux-headers/asm-generic/mman-common.h       |  18 +-
+files changed, 1059 insertions(+), 1 deletion(-)
- linux-headers/asm-generic/mman.h              |  10 +-
+ create mode 100644 include/hw/sd/allwinner-sdhost.h
- linux-headers/asm-generic/unistd.h            |  10 +-
+ create mode 100644 hw/sd/allwinner-sdhost.c
  linux-headers/asm-mips/mman.h                 |   3 +
  linux-headers/asm-mips/unistd_n32.h           |   1 +
  linux-headers/asm-mips/unistd_n64.h           |   1 +
  linux-headers/asm-mips/unistd_o32.h           |   1 +
  linux-headers/asm-powerpc/mman.h              |   6 +-
  linux-headers/asm-powerpc/unistd_32.h         |   2 +
  linux-headers/asm-powerpc/unistd_64.h         |   2 +
  linux-headers/asm-s390/kvm.h                  |   6 +
  linux-headers/asm-s390/unistd_32.h            |   2 +
  linux-headers/asm-s390/unistd_64.h            |   2 +
  linux-headers/asm-x86/kvm.h                   |  28 ++-
  linux-headers/asm-x86/unistd.h                |   2 +-
  linux-headers/asm-x86/unistd_32.h             |   2 +
  linux-headers/asm-x86/unistd_64.h             |   2 +
  linux-headers/asm-x86/unistd_x32.h            |   2 +
  linux-headers/linux/kvm.h                     |  12 +-
  linux-headers/linux/psp-sev.h                 |   5 +-
  linux-headers/linux/vfio.h                    |  71 +++++---
 files changed, 406 insertions(+), 59 deletions(-)
  create mode 100644 include/standard-headers/linux/virtio_fs.h
  create mode 100644 include/standard-headers/linux/virtio_iommu.h
-diff --git a/include/standard-headers/asm-x86/bootparam.h b/include/standard-headers/asm-x86/bootparam.h
+diff --git a/hw/sd/Makefile.objs b/hw/sd/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/asm-x86/bootparam.h
+--- a/hw/sd/Makefile.objs
-+++ b/include/standard-headers/asm-x86/bootparam.h
++++ b/hw/sd/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SD) += sd.o core.o sdmmc-internal.o
  common-obj-$(CONFIG_SDHCI) += sdhci.o
  common-obj-$(CONFIG_SDHCI_PCI) += sdhci-pci.o
 +common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-sdhost.o
  common-obj-$(CONFIG_MILKYMIST) += milkymist-memcard.o
  common-obj-$(CONFIG_OMAP) += omap_mmc.o
  common-obj-$(CONFIG_PXA2XX) += pxa2xx_mmci.o
 diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/allwinner-a10.h
 +++ b/include/hw/arm/allwinner-a10.h
 @@ -XXX,XX +XXX,XX @@
- #define XLF_EFI_HANDOVER_32        (1<<2)
+ #include "hw/timer/allwinner-a10-pit.h"
- #define XLF_EFI_HANDOVER_64        (1<<3)
+ #include "hw/intc/allwinner-a10-pic.h"
- #define XLF_EFI_KEXEC            (1<<4)
+ #include "hw/net/allwinner_emac.h"
-+#define XLF_5LEVEL            (1<<5)
++#include "hw/sd/allwinner-sdhost.h"
-+#define XLF_5LEVEL_ENABLED        (1<<6)
+ #include "hw/ide/ahci.h"
+ #include "hw/usb/hcd-ohci.h"
+ #include "hw/usb/hcd-ehci.h"
- #endif /* _ASM_X86_BOOTPARAM_H */
+@@ -XXX,XX +XXX,XX @@ typedef struct AwA10State {
-diff --git a/include/standard-headers/asm-x86/kvm_para.h b/include/standard-headers/asm-x86/kvm_para.h
+     AwA10PICState intc;
      AwEmacState emac;
      AllwinnerAHCIState sata;
 +    AwSdHostState mmc0;
      MemoryRegion sram_a;
      EHCISysBusState ehci[AW_A10_NUM_USB];
      OHCISysBusState ohci[AW_A10_NUM_USB];
 diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/asm-x86/kvm_para.h
+--- a/include/hw/arm/allwinner-h3.h
-+++ b/include/standard-headers/asm-x86/kvm_para.h
++++ b/include/hw/arm/allwinner-h3.h
 @@ -XXX,XX +XXX,XX @@
- #define KVM_FEATURE_ASYNC_PF_VMEXIT    10
+ #include "hw/misc/allwinner-cpucfg.h"
- #define KVM_FEATURE_PV_SEND_IPI    11
+ #include "hw/misc/allwinner-h3-sysctrl.h"
- #define KVM_FEATURE_POLL_CONTROL    12
+ #include "hw/misc/allwinner-sid.h"
-+#define KVM_FEATURE_PV_SCHED_YIELD    13
++#include "hw/sd/allwinner-sdhost.h"
+ #include "target/arm/cpu.h"
- #define KVM_HINTS_REALTIME      0
+ /**
-diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
+@@ -XXX,XX +XXX,XX @@ enum {
-index XXXXXXX..XXXXXXX 100644
+     AW_H3_SRAM_A2,
---- a/include/standard-headers/linux/ethtool.h
+     AW_H3_SRAM_C,
-+++ b/include/standard-headers/linux/ethtool.h
+     AW_H3_SYSCTRL,
-@@ -XXX,XX +XXX,XX @@ struct ethtool_tunable {
++    AW_H3_MMC0,
- #define ETHTOOL_PHY_FAST_LINK_DOWN_ON    0
+     AW_H3_SID,
- #define ETHTOOL_PHY_FAST_LINK_DOWN_OFF    0xff
+     AW_H3_EHCI0,
+     AW_H3_OHCI0,
-+/* Energy Detect Power Down (EDPD) is a feature supported by some PHYs, where
+@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
-+ * the PHY's RX & TX blocks are put into a low-power mode when there is no
+     AwCpuCfgState cpucfg;
-+ * link detected (typically cable is un-plugged). For RX, only a minimal
+     AwH3SysCtrlState sysctrl;
-+ * link-detection is available, and for TX the PHY wakes up to send link pulses
+     AwSidState sid;
-+ * to avoid any lock-ups in case the peer PHY may also be running in EDPD mode.
++    AwSdHostState mmc0;
-+ *
+     GICState gic;
-+ * Some PHYs may support configuration of the wake-up interval for TX pulses,
+     MemoryRegion sram_a1;
-+ * and some PHYs may support only disabling TX pulses entirely. For the latter
+     MemoryRegion sram_a2;
-+ * a special value is required (ETHTOOL_PHY_EDPD_NO_TX) so that this can be
+diff --git a/include/hw/sd/allwinner-sdhost.h b/include/hw/sd/allwinner-sdhost.h
 + * configured from userspace (should the user want it).
 + *
 + * The interval units for TX wake-up are in milliseconds, since this should
 + * cover a reasonable range of intervals:
 + *  - from 1 millisecond, which does not sound like much of a power-saver
 + *  - to ~65 seconds which is quite a lot to wait for a link to come up when
 + *    plugging a cable
 + */
 +#define ETHTOOL_PHY_EDPD_DFLT_TX_MSECS        0xffff
 +#define ETHTOOL_PHY_EDPD_NO_TX            0xfffe
 +#define ETHTOOL_PHY_EDPD_DISABLE        0
 +
  enum phy_tunable_id {
      ETHTOOL_PHY_ID_UNSPEC,
      ETHTOOL_PHY_DOWNSHIFT,
      ETHTOOL_PHY_FAST_LINK_DOWN,
 +    ETHTOOL_PHY_EDPD,
      /*
       * Add your fresh new phy tunable attribute above and remember to update
       * phy_tunable_strings[] in net/core/ethtool.c
@@ -XXX,XX +XXX,XX @@ enum ethtool_link_mode_bit_indices {
      ETHTOOL_LINK_MODE_200000baseLR4_ER4_FR4_Full_BIT = 64,
      ETHTOOL_LINK_MODE_200000baseDR4_Full_BIT     = 65,
      ETHTOOL_LINK_MODE_200000baseCR4_Full_BIT     = 66,
 +    ETHTOOL_LINK_MODE_100baseT1_Full_BIT         = 67,
 +    ETHTOOL_LINK_MODE_1000baseT1_Full_BIT         = 68,
      /* must be last entry */
      __ETHTOOL_LINK_MODE_MASK_NBITS
 diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/standard-headers/linux/pci_regs.h
 +++ b/include/standard-headers/linux/pci_regs.h
@@ -XXX,XX +XXX,XX @@
  #define  PCI_EXP_LNKCAP_SLS_5_0GB 0x00000002 /* LNKCAP2 SLS Vector bit 1 */
  #define  PCI_EXP_LNKCAP_SLS_8_0GB 0x00000003 /* LNKCAP2 SLS Vector bit 2 */
  #define  PCI_EXP_LNKCAP_SLS_16_0GB 0x00000004 /* LNKCAP2 SLS Vector bit 3 */
 +#define  PCI_EXP_LNKCAP_SLS_32_0GB 0x00000005 /* LNKCAP2 SLS Vector bit 4 */
  #define  PCI_EXP_LNKCAP_MLW    0x000003f0 /* Maximum Link Width */
  #define  PCI_EXP_LNKCAP_ASPMS    0x00000c00 /* ASPM Support */
  #define  PCI_EXP_LNKCAP_L0SEL    0x00007000 /* L0s Exit Latency */
@@ -XXX,XX +XXX,XX @@
  #define  PCI_EXP_LNKSTA_CLS_5_0GB 0x0002 /* Current Link Speed 5.0GT/s */
  #define  PCI_EXP_LNKSTA_CLS_8_0GB 0x0003 /* Current Link Speed 8.0GT/s */
  #define  PCI_EXP_LNKSTA_CLS_16_0GB 0x0004 /* Current Link Speed 16.0GT/s */
 +#define  PCI_EXP_LNKSTA_CLS_32_0GB 0x0005 /* Current Link Speed 32.0GT/s */
  #define  PCI_EXP_LNKSTA_NLW    0x03f0    /* Negotiated Link Width */
  #define  PCI_EXP_LNKSTA_NLW_X1    0x0010    /* Current Link Width x1 */
  #define  PCI_EXP_LNKSTA_NLW_X2    0x0020    /* Current Link Width x2 */
@@ -XXX,XX +XXX,XX @@
  #define  PCI_EXP_SLTCTL_CCIE    0x0010    /* Command Completed Interrupt Enable */
  #define  PCI_EXP_SLTCTL_HPIE    0x0020    /* Hot-Plug Interrupt Enable */
  #define  PCI_EXP_SLTCTL_AIC    0x00c0    /* Attention Indicator Control */
 +#define  PCI_EXP_SLTCTL_ATTN_IND_SHIFT 6      /* Attention Indicator shift */
  #define  PCI_EXP_SLTCTL_ATTN_IND_ON    0x0040 /* Attention Indicator on */
  #define  PCI_EXP_SLTCTL_ATTN_IND_BLINK 0x0080 /* Attention Indicator blinking */
  #define  PCI_EXP_SLTCTL_ATTN_IND_OFF   0x00c0 /* Attention Indicator off */
@@ -XXX,XX +XXX,XX @@
  #define  PCI_EXP_LNKCAP2_SLS_5_0GB    0x00000004 /* Supported Speed 5GT/s */
  #define  PCI_EXP_LNKCAP2_SLS_8_0GB    0x00000008 /* Supported Speed 8GT/s */
  #define  PCI_EXP_LNKCAP2_SLS_16_0GB    0x00000010 /* Supported Speed 16GT/s */
 +#define  PCI_EXP_LNKCAP2_SLS_32_0GB    0x00000020 /* Supported Speed 32GT/s */
  #define  PCI_EXP_LNKCAP2_CROSSLINK    0x00000100 /* Crosslink supported */
  #define PCI_EXP_LNKCTL2        48    /* Link Control 2 */
  #define  PCI_EXP_LNKCTL2_TLS        0x000f
@@ -XXX,XX +XXX,XX @@
  #define  PCI_EXP_LNKCTL2_TLS_5_0GT    0x0002 /* Supported Speed 5GT/s */
  #define  PCI_EXP_LNKCTL2_TLS_8_0GT    0x0003 /* Supported Speed 8GT/s */
  #define  PCI_EXP_LNKCTL2_TLS_16_0GT    0x0004 /* Supported Speed 16GT/s */
 +#define  PCI_EXP_LNKCTL2_TLS_32_0GT    0x0005 /* Supported Speed 32GT/s */
  #define PCI_EXP_LNKSTA2        50    /* Link Status 2 */
  #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2    52    /* v2 endpoints with link end here */
  #define PCI_EXP_SLTCAP2        52    /* Slot Capabilities 2 */
@@ -XXX,XX +XXX,XX @@
  #define PCI_EXT_CAP_ID_DPC    0x1D    /* Downstream Port Containment */
  #define PCI_EXT_CAP_ID_L1SS    0x1E    /* L1 PM Substates */
  #define PCI_EXT_CAP_ID_PTM    0x1F    /* Precision Time Measurement */
 -#define PCI_EXT_CAP_ID_MAX    PCI_EXT_CAP_ID_PTM
 +#define PCI_EXT_CAP_ID_DLF    0x25    /* Data Link Feature */
 +#define PCI_EXT_CAP_ID_PL_16GT    0x26    /* Physical Layer 16.0 GT/s */
 +#define PCI_EXT_CAP_ID_MAX    PCI_EXT_CAP_ID_PL_16GT
  #define PCI_EXT_CAP_DSN_SIZEOF    12
  #define PCI_EXT_CAP_MCAST_ENDPOINT_SIZEOF 40
@@ -XXX,XX +XXX,XX @@
  #define  PCI_L1SS_CTL1_LTR_L12_TH_SCALE    0xe0000000  /* LTR_L1.2_THRESHOLD_Scale */
  #define PCI_L1SS_CTL2        0x0c    /* Control 2 Register */
 +/* Data Link Feature */
 +#define PCI_DLF_CAP        0x04    /* Capabilities Register */
 +#define  PCI_DLF_EXCHANGE_ENABLE    0x80000000  /* Data Link Feature Exchange Enable */
 +
 +/* Physical Layer 16.0 GT/s */
 +#define PCI_PL_16GT_LE_CTRL    0x20    /* Lane Equalization Control Register */
 +#define  PCI_PL_16GT_LE_CTRL_DSP_TX_PRESET_MASK        0x0000000F
 +#define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_MASK        0x000000F0
 +#define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_SHIFT    4
 +
  #endif /* LINUX_PCI_REGS_H */
 diff --git a/include/standard-headers/linux/virtio_fs.h b/include/standard-headers/linux/virtio_fs.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/standard-headers/linux/virtio_fs.h
++++ b/include/hw/sd/allwinner-sdhost.h
 @@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
++/*
-+
++ * Allwinner (sun4i and above) SD Host Controller emulation
-+#ifndef _LINUX_VIRTIO_FS_H
++ *
-+#define _LINUX_VIRTIO_FS_H
++ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
-+
++ *
-+#include "standard-headers/linux/types.h"
++ * This program is free software: you can redistribute it and/or modify
-+#include "standard-headers/linux/virtio_ids.h"
++ * it under the terms of the GNU General Public License as published by
-+#include "standard-headers/linux/virtio_config.h"
++ * the Free Software Foundation, either version 2 of the License, or
-+#include "standard-headers/linux/virtio_types.h"
++ * (at your option) any later version.
-+
++ *
-+struct virtio_fs_config {
++ * This program is distributed in the hope that it will be useful,
-+    /* Filesystem name (UTF-8, not NUL-terminated, padded with NULs) */
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+    uint8_t tag[36];
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+
++ * GNU General Public License for more details.
-+    /* Number of request queues */
++ *
-+    uint32_t num_request_queues;
++ * You should have received a copy of the GNU General Public License
-+} QEMU_PACKED;
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+
++ */
-+#endif /* _LINUX_VIRTIO_FS_H */
++
-diff --git a/include/standard-headers/linux/virtio_ids.h b/include/standard-headers/linux/virtio_ids.h
++#ifndef HW_SD_ALLWINNER_SDHOST_H
 +#define HW_SD_ALLWINNER_SDHOST_H
 +
 +#include "qom/object.h"
 +#include "hw/sysbus.h"
 +#include "hw/sd/sd.h"
 +
 +/**
 + * Object model types
 + * @{
 + */
 +
 +/** Generic Allwinner SD Host Controller (abstract) */
 +#define TYPE_AW_SDHOST "allwinner-sdhost"
 +
 +/** Allwinner sun4i family (A10, A12) */
 +#define TYPE_AW_SDHOST_SUN4I TYPE_AW_SDHOST "-sun4i"
 +
 +/** Allwinner sun5i family and newer (A13, H2+, H3, etc) */
 +#define TYPE_AW_SDHOST_SUN5I TYPE_AW_SDHOST "-sun5i"
 +
 +/** @} */
 +
 +/**
 + * Object model macros
 + * @{
 + */
 +
 +#define AW_SDHOST(obj) \
 +    OBJECT_CHECK(AwSdHostState, (obj), TYPE_AW_SDHOST)
 +#define AW_SDHOST_CLASS(klass) \
 +     OBJECT_CLASS_CHECK(AwSdHostClass, (klass), TYPE_AW_SDHOST)
 +#define AW_SDHOST_GET_CLASS(obj) \
 +     OBJECT_GET_CLASS(AwSdHostClass, (obj), TYPE_AW_SDHOST)
 +
 +/** @} */
 +
 +/**
 + * Allwinner SD Host Controller object instance state.
 + */
 +typedef struct AwSdHostState {
 +    /*< private >*/
 +    SysBusDevice busdev;
 +    /*< public >*/
 +
 +    /** Secure Digital (SD) bus, which connects to SD card (if present) */
 +    SDBus sdbus;
 +
 +    /** Maps I/O registers in physical memory */
 +    MemoryRegion iomem;
 +
 +    /** Interrupt output signal to notify CPU */
 +    qemu_irq irq;
 +
 +    /** Number of bytes left in current DMA transfer */
 +    uint32_t transfer_cnt;
 +
 +    /**
 +     * @name Hardware Registers
 +     * @{
 +     */
 +
 +    uint32_t global_ctl;        /**< Global Control */
 +    uint32_t clock_ctl;         /**< Clock Control */
 +    uint32_t timeout;           /**< Timeout */
 +    uint32_t bus_width;         /**< Bus Width */
 +    uint32_t block_size;        /**< Block Size */
 +    uint32_t byte_count;        /**< Byte Count */
 +
 +    uint32_t command;           /**< Command */
 +    uint32_t command_arg;       /**< Command Argument */
 +    uint32_t response[4];       /**< Command Response */
 +
 +    uint32_t irq_mask;          /**< Interrupt Mask */
 +    uint32_t irq_status;        /**< Raw Interrupt Status */
 +    uint32_t status;            /**< Status */
 +
 +    uint32_t fifo_wlevel;       /**< FIFO Water Level */
 +    uint32_t fifo_func_sel;     /**< FIFO Function Select */
 +    uint32_t debug_enable;      /**< Debug Enable */
 +    uint32_t auto12_arg;        /**< Auto Command 12 Argument */
 +    uint32_t newtiming_set;     /**< SD New Timing Set */
 +    uint32_t newtiming_debug;   /**< SD New Timing Debug */
 +    uint32_t hardware_rst;      /**< Hardware Reset */
 +    uint32_t dmac;              /**< Internal DMA Controller Control */
 +    uint32_t desc_base;         /**< Descriptor List Base Address */
 +    uint32_t dmac_status;       /**< Internal DMA Controller Status */
 +    uint32_t dmac_irq;          /**< Internal DMA Controller IRQ Enable */
 +    uint32_t card_threshold;    /**< Card Threshold Control */
 +    uint32_t startbit_detect;   /**< eMMC DDR Start Bit Detection Control */
 +    uint32_t response_crc;      /**< Response CRC */
 +    uint32_t data_crc[8];       /**< Data CRC */
 +    uint32_t status_crc;        /**< Status CRC */
 +
 +    /** @} */
 +
 +} AwSdHostState;
 +
 +/**
 + * Allwinner SD Host Controller class-level struct.
 + *
 + * This struct is filled by each sunxi device specific code
 + * such that the generic code can use this struct to support
 + * all devices.
 + */
 +typedef struct AwSdHostClass {
 +    /*< private >*/
 +    SysBusDeviceClass parent_class;
 +    /*< public >*/
 +
 +    /** Maximum buffer size in bytes per DMA descriptor */
 +    size_t max_desc_size;
 +
 +} AwSdHostClass;
 +
 +#endif /* HW_SD_ALLWINNER_SDHOST_H */
 diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/linux/virtio_ids.h
+--- a/hw/arm/allwinner-a10.c
-+++ b/include/standard-headers/linux/virtio_ids.h
++++ b/hw/arm/allwinner-a10.c
 @@ -XXX,XX +XXX,XX @@
- #define VIRTIO_ID_INPUT        18 /* virtio input */
+ #include "hw/boards.h"
- #define VIRTIO_ID_VSOCK        19 /* virtio vsock transport */
+ #include "hw/usb/hcd-ohci.h"
- #define VIRTIO_ID_CRYPTO       20 /* virtio crypto */
-+#define VIRTIO_ID_IOMMU        23 /* virtio IOMMU */
++#define AW_A10_MMC0_BASE        0x01c0f000
-+#define VIRTIO_ID_FS           26 /* virtio filesystem */
+ #define AW_A10_PIC_REG_BASE     0x01c20400
- #define VIRTIO_ID_PMEM         27 /* virtio pmem */
+ #define AW_A10_PIT_REG_BASE     0x01c20c00
+ #define AW_A10_UART0_REG_BASE   0x01c28000
- #endif /* _LINUX_VIRTIO_IDS_H */
+@@ -XXX,XX +XXX,XX @@ static void aw_a10_init(Object *obj)
-diff --git a/include/standard-headers/linux/virtio_iommu.h b/include/standard-headers/linux/virtio_iommu.h
+                                   sizeof(s->ohci[i]), TYPE_SYSBUS_OHCI);
          }
      }
 +
 +    sysbus_init_child_obj(obj, "mmc0", &s->mmc0, sizeof(s->mmc0),
 +                          TYPE_AW_SDHOST_SUN4I);
  }
  static void aw_a10_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
                                 qdev_get_gpio_in(dev, 64 + i));
          }
      }
 +
 +    /* SD/MMC */
 +    qdev_init_nofail(DEVICE(&s->mmc0));
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->mmc0), 0, AW_A10_MMC0_BASE);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->mmc0), 0, qdev_get_gpio_in(dev, 32));
 +    object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->mmc0),
 +                              "sd-bus", &error_abort);
  }
  static void aw_a10_class_init(ObjectClass *oc, void *data)
 diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/allwinner-h3.c
 +++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
      [AW_H3_SRAM_A2]    = 0x00044000,
      [AW_H3_SRAM_C]     = 0x00010000,
      [AW_H3_SYSCTRL]    = 0x01c00000,
 +    [AW_H3_MMC0]       = 0x01c0f000,
      [AW_H3_SID]        = 0x01c14000,
      [AW_H3_EHCI0]      = 0x01c1a000,
      [AW_H3_OHCI0]      = 0x01c1a400,
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
      { "lcd0",      0x01c0c000, 4 * KiB },
      { "lcd1",      0x01c0d000, 4 * KiB },
      { "ve",        0x01c0e000, 4 * KiB },
 -    { "mmc0",      0x01c0f000, 4 * KiB },
      { "mmc1",      0x01c10000, 4 * KiB },
      { "mmc2",      0x01c11000, 4 * KiB },
      { "crypto",    0x01c15000, 4 * KiB },
@@ -XXX,XX +XXX,XX @@ enum {
      AW_H3_GIC_SPI_UART3     =  3,
      AW_H3_GIC_SPI_TIMER0    = 18,
      AW_H3_GIC_SPI_TIMER1    = 19,
 +    AW_H3_GIC_SPI_MMC0      = 60,
      AW_H3_GIC_SPI_EHCI0     = 72,
      AW_H3_GIC_SPI_OHCI0     = 73,
      AW_H3_GIC_SPI_EHCI1     = 74,
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
                            TYPE_AW_SID);
      object_property_add_alias(obj, "identifier", OBJECT(&s->sid),
                                "identifier", &error_abort);
 +
 +    sysbus_init_child_obj(obj, "mmc0", &s->mmc0, sizeof(s->mmc0),
 +                          TYPE_AW_SDHOST_SUN5I);
  }
  static void allwinner_h3_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
      qdev_init_nofail(DEVICE(&s->sid));
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->sid), 0, s->memmap[AW_H3_SID]);
 +    /* SD/MMC */
 +    qdev_init_nofail(DEVICE(&s->mmc0));
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->mmc0), 0, s->memmap[AW_H3_MMC0]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->mmc0), 0,
 +                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_MMC0));
 +
 +    object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->mmc0),
 +                              "sd-bus", &error_abort);
 +
      /* Universal Serial Bus */
      sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI0],
                           qdev_get_gpio_in(DEVICE(&s->gic),
 diff --git a/hw/arm/cubieboard.c b/hw/arm/cubieboard.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/cubieboard.c
 +++ b/hw/arm/cubieboard.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/sysemu.h"
  #include "hw/sysbus.h"
  #include "hw/boards.h"
 +#include "hw/qdev-properties.h"
  #include "hw/arm/allwinner-a10.h"
  static struct arm_boot_info cubieboard_binfo = {
@@ -XXX,XX +XXX,XX @@ static void cubieboard_init(MachineState *machine)
  {
      AwA10State *a10;
      Error *err = NULL;
 +    DriveInfo *di;
 +    BlockBackend *blk;
 +    BusState *bus;
 +    DeviceState *carddev;
      /* BIOS is not supported by this board */
      if (bios_name) {
@@ -XXX,XX +XXX,XX @@ static void cubieboard_init(MachineState *machine)
          exit(1);
      }
 +    /* Retrieve SD bus */
 +    di = drive_get_next(IF_SD);
 +    blk = di ? blk_by_legacy_dinfo(di) : NULL;
 +    bus = qdev_get_child_bus(DEVICE(a10), "sd-bus");
 +
 +    /* Plug in SD card */
 +    carddev = qdev_create(bus, TYPE_SD_CARD);
 +    qdev_prop_set_drive(carddev, "drive", blk, &error_fatal);
 +    object_property_set_bool(OBJECT(carddev), true, "realized", &error_fatal);
 +
      memory_region_add_subregion(get_system_memory(), AW_A10_SDRAM_BASE,
                                  machine->ram);
 diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/orangepi.c
 +++ b/hw/arm/orangepi.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info orangepi_binfo = {
  static void orangepi_init(MachineState *machine)
  {
      AwH3State *h3;
 +    DriveInfo *di;
 +    BlockBackend *blk;
 +    BusState *bus;
 +    DeviceState *carddev;
      /* BIOS is not supported by this board */
      if (bios_name) {
@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)
      /* Mark H3 object realized */
      object_property_set_bool(OBJECT(h3), true, "realized", &error_abort);
 +    /* Retrieve SD bus */
 +    di = drive_get_next(IF_SD);
 +    blk = di ? blk_by_legacy_dinfo(di) : NULL;
 +    bus = qdev_get_child_bus(DEVICE(h3), "sd-bus");
 +
 +    /* Plug in SD card */
 +    carddev = qdev_create(bus, TYPE_SD_CARD);
 +    qdev_prop_set_drive(carddev, "drive", blk, &error_fatal);
 +    object_property_set_bool(OBJECT(carddev), true, "realized", &error_fatal);
 +
      /* SDRAM */
      memory_region_add_subregion(get_system_memory(), h3->memmap[AW_H3_SDRAM],
                                  machine->ram);
@@ -XXX,XX +XXX,XX @@ static void orangepi_machine_init(MachineClass *mc)
  {
      mc->desc = "Orange Pi PC";
      mc->init = orangepi_init;
 +    mc->block_default_type = IF_SD;
 +    mc->units_per_default_bus = 1;
      mc->min_cpus = AW_H3_NUM_CPUS;
      mc->max_cpus = AW_H3_NUM_CPUS;
      mc->default_cpus = AW_H3_NUM_CPUS;
 diff --git a/hw/sd/allwinner-sdhost.c b/hw/sd/allwinner-sdhost.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/standard-headers/linux/virtio_iommu.h
++++ b/hw/sd/allwinner-sdhost.c
 @@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: BSD-3-Clause */
 +/*
-+ * Virtio-iommu definition v0.12
++ * Allwinner (sun4i and above) SD Host Controller emulation
 + *
-+ * Copyright (C) 2019 Arm Ltd.
++ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
-+#ifndef _LINUX_VIRTIO_IOMMU_H
++
-+#define _LINUX_VIRTIO_IOMMU_H
++#include "qemu/osdep.h"
-+
++#include "qemu/log.h"
-+#include "standard-headers/linux/types.h"
++#include "qemu/module.h"
-+
++#include "qemu/units.h"
-+/* Feature bits */
++#include "sysemu/blockdev.h"
-+#define VIRTIO_IOMMU_F_INPUT_RANGE        0
++#include "hw/irq.h"
-+#define VIRTIO_IOMMU_F_DOMAIN_RANGE        1
++#include "hw/sd/allwinner-sdhost.h"
-+#define VIRTIO_IOMMU_F_MAP_UNMAP        2
++#include "migration/vmstate.h"
-+#define VIRTIO_IOMMU_F_BYPASS            3
++#include "trace.h"
-+#define VIRTIO_IOMMU_F_PROBE            4
++
-+#define VIRTIO_IOMMU_F_MMIO            5
++#define TYPE_AW_SDHOST_BUS "allwinner-sdhost-bus"
-+
++#define AW_SDHOST_BUS(obj) \
-+struct virtio_iommu_range_64 {
++    OBJECT_CHECK(SDBus, (obj), TYPE_AW_SDHOST_BUS)
-+    uint64_t                    start;
++
-+    uint64_t                    end;
++/* SD Host register offsets */
 +enum {
 +    REG_SD_GCTL       = 0x00,  /* Global Control */
 +    REG_SD_CKCR       = 0x04,  /* Clock Control */
 +    REG_SD_TMOR       = 0x08,  /* Timeout */
 +    REG_SD_BWDR       = 0x0C,  /* Bus Width */
 +    REG_SD_BKSR       = 0x10,  /* Block Size */
 +    REG_SD_BYCR       = 0x14,  /* Byte Count */
 +    REG_SD_CMDR       = 0x18,  /* Command */
 +    REG_SD_CAGR       = 0x1C,  /* Command Argument */
 +    REG_SD_RESP0      = 0x20,  /* Response Zero */
 +    REG_SD_RESP1      = 0x24,  /* Response One */
 +    REG_SD_RESP2      = 0x28,  /* Response Two */
 +    REG_SD_RESP3      = 0x2C,  /* Response Three */
 +    REG_SD_IMKR       = 0x30,  /* Interrupt Mask */
 +    REG_SD_MISR       = 0x34,  /* Masked Interrupt Status */
 +    REG_SD_RISR       = 0x38,  /* Raw Interrupt Status */
 +    REG_SD_STAR       = 0x3C,  /* Status */
 +    REG_SD_FWLR       = 0x40,  /* FIFO Water Level */
 +    REG_SD_FUNS       = 0x44,  /* FIFO Function Select */
 +    REG_SD_DBGC       = 0x50,  /* Debug Enable */
 +    REG_SD_A12A       = 0x58,  /* Auto command 12 argument */
 +    REG_SD_NTSR       = 0x5C,  /* SD NewTiming Set */
 +    REG_SD_SDBG       = 0x60,  /* SD newTiming Set Debug */
 +    REG_SD_HWRST      = 0x78,  /* Hardware Reset Register */
 +    REG_SD_DMAC       = 0x80,  /* Internal DMA Controller Control */
 +    REG_SD_DLBA       = 0x84,  /* Descriptor List Base Address */
 +    REG_SD_IDST       = 0x88,  /* Internal DMA Controller Status */
 +    REG_SD_IDIE       = 0x8C,  /* Internal DMA Controller IRQ Enable */
 +    REG_SD_THLDC      = 0x100, /* Card Threshold Control */
 +    REG_SD_DSBD       = 0x10C, /* eMMC DDR Start Bit Detection Control */
 +    REG_SD_RES_CRC    = 0x110, /* Response CRC from card/eMMC */
 +    REG_SD_DATA7_CRC  = 0x114, /* CRC Data 7 from card/eMMC */
 +    REG_SD_DATA6_CRC  = 0x118, /* CRC Data 6 from card/eMMC */
 +    REG_SD_DATA5_CRC  = 0x11C, /* CRC Data 5 from card/eMMC */
 +    REG_SD_DATA4_CRC  = 0x120, /* CRC Data 4 from card/eMMC */
 +    REG_SD_DATA3_CRC  = 0x124, /* CRC Data 3 from card/eMMC */
 +    REG_SD_DATA2_CRC  = 0x128, /* CRC Data 2 from card/eMMC */
 +    REG_SD_DATA1_CRC  = 0x12C, /* CRC Data 1 from card/eMMC */
 +    REG_SD_DATA0_CRC  = 0x130, /* CRC Data 0 from card/eMMC */
 +    REG_SD_CRC_STA    = 0x134, /* CRC status from card/eMMC during write */
 +    REG_SD_FIFO       = 0x200, /* Read/Write FIFO */
 +};
 +
-+struct virtio_iommu_range_32 {
++/* SD Host register flags */
-+    uint32_t                    start;
++enum {
-+    uint32_t                    end;
++    SD_GCTL_FIFO_AC_MOD     = (1 << 31),
 +    SD_GCTL_DDR_MOD_SEL     = (1 << 10),
 +    SD_GCTL_CD_DBC_ENB      = (1 << 8),
 +    SD_GCTL_DMA_ENB         = (1 << 5),
 +    SD_GCTL_INT_ENB         = (1 << 4),
 +    SD_GCTL_DMA_RST         = (1 << 2),
 +    SD_GCTL_FIFO_RST        = (1 << 1),
 +    SD_GCTL_SOFT_RST        = (1 << 0),
 +};
 +
-+struct virtio_iommu_config {
++enum {
-+    /* Supported page sizes */
++    SD_CMDR_LOAD            = (1 << 31),
-+    uint64_t                    page_size_mask;
++    SD_CMDR_CLKCHANGE       = (1 << 21),
-+    /* Supported IOVA range */
++    SD_CMDR_WRITE           = (1 << 10),
-+    struct virtio_iommu_range_64        input_range;
++    SD_CMDR_AUTOSTOP        = (1 << 12),
-+    /* Max domain ID size */
++    SD_CMDR_DATA            = (1 << 9),
-+    struct virtio_iommu_range_32        domain_range;
++    SD_CMDR_RESPONSE_LONG   = (1 << 7),
-+    /* Probe buffer size */
++    SD_CMDR_RESPONSE        = (1 << 6),
-+    uint32_t                    probe_size;
++    SD_CMDR_CMDID_MASK      = (0x3f),
 +};
 +
-+/* Request types */
++enum {
-+#define VIRTIO_IOMMU_T_ATTACH            0x01
++    SD_RISR_CARD_REMOVE     = (1 << 31),
-+#define VIRTIO_IOMMU_T_DETACH            0x02
++    SD_RISR_CARD_INSERT     = (1 << 30),
-+#define VIRTIO_IOMMU_T_MAP            0x03
++    SD_RISR_SDIO_INTR       = (1 << 16),
-+#define VIRTIO_IOMMU_T_UNMAP            0x04
++    SD_RISR_AUTOCMD_DONE    = (1 << 14),
-+#define VIRTIO_IOMMU_T_PROBE            0x05
++    SD_RISR_DATA_COMPLETE   = (1 << 3),
-+
++    SD_RISR_CMD_COMPLETE    = (1 << 2),
-+/* Status types */
++    SD_RISR_NO_RESPONSE     = (1 << 1),
 +#define VIRTIO_IOMMU_S_OK            0x00
 +#define VIRTIO_IOMMU_S_IOERR            0x01
 +#define VIRTIO_IOMMU_S_UNSUPP            0x02
 +#define VIRTIO_IOMMU_S_DEVERR            0x03
 +#define VIRTIO_IOMMU_S_INVAL            0x04
 +#define VIRTIO_IOMMU_S_RANGE            0x05
 +#define VIRTIO_IOMMU_S_NOENT            0x06
 +#define VIRTIO_IOMMU_S_FAULT            0x07
 +#define VIRTIO_IOMMU_S_NOMEM            0x08
 +
 +struct virtio_iommu_req_head {
 +    uint8_t                    type;
 +    uint8_t                    reserved[3];
 +};
 +
-+struct virtio_iommu_req_tail {
++enum {
-+    uint8_t                    status;
++    SD_STAR_CARD_PRESENT    = (1 << 8),
 +    uint8_t                    reserved[3];
 +};
 +
-+struct virtio_iommu_req_attach {
++enum {
-+    struct virtio_iommu_req_head        head;
++    SD_IDST_INT_SUMMARY     = (1 << 8),
-+    uint32_t                    domain;
++    SD_IDST_RECEIVE_IRQ     = (1 << 1),
-+    uint32_t                    endpoint;
++    SD_IDST_TRANSMIT_IRQ    = (1 << 0),
-+    uint8_t                    reserved[8];
++    SD_IDST_IRQ_MASK        = (1 << 1) | (1 << 0) | (1 << 8),
-+    struct virtio_iommu_req_tail        tail;
++    SD_IDST_WR_MASK         = (0x3ff),
 +};
 +
-+struct virtio_iommu_req_detach {
++/* SD Host register reset values */
-+    struct virtio_iommu_req_head        head;
++enum {
-+    uint32_t                    domain;
++    REG_SD_GCTL_RST         = 0x00000300,
-+    uint32_t                    endpoint;
++    REG_SD_CKCR_RST         = 0x0,
-+    uint8_t                    reserved[8];
++    REG_SD_TMOR_RST         = 0xFFFFFF40,
-+    struct virtio_iommu_req_tail        tail;
++    REG_SD_BWDR_RST         = 0x0,
 +    REG_SD_BKSR_RST         = 0x00000200,
 +    REG_SD_BYCR_RST         = 0x00000200,
 +    REG_SD_CMDR_RST         = 0x0,
 +    REG_SD_CAGR_RST         = 0x0,
 +    REG_SD_RESP_RST         = 0x0,
 +    REG_SD_IMKR_RST         = 0x0,
 +    REG_SD_MISR_RST         = 0x0,
 +    REG_SD_RISR_RST         = 0x0,
 +    REG_SD_STAR_RST         = 0x00000100,
 +    REG_SD_FWLR_RST         = 0x000F0000,
 +    REG_SD_FUNS_RST         = 0x0,
 +    REG_SD_DBGC_RST         = 0x0,
 +    REG_SD_A12A_RST         = 0x0000FFFF,
 +    REG_SD_NTSR_RST         = 0x00000001,
 +    REG_SD_SDBG_RST         = 0x0,
 +    REG_SD_HWRST_RST        = 0x00000001,
 +    REG_SD_DMAC_RST         = 0x0,
 +    REG_SD_DLBA_RST         = 0x0,
 +    REG_SD_IDST_RST         = 0x0,
 +    REG_SD_IDIE_RST         = 0x0,
 +    REG_SD_THLDC_RST        = 0x0,
 +    REG_SD_DSBD_RST         = 0x0,
 +    REG_SD_RES_CRC_RST      = 0x0,
 +    REG_SD_DATA_CRC_RST     = 0x0,
 +    REG_SD_CRC_STA_RST      = 0x0,
 +    REG_SD_FIFO_RST         = 0x0,
 +};
 +
-+#define VIRTIO_IOMMU_MAP_F_READ            (1 << 0)
++/* Data transfer descriptor for DMA */
-+#define VIRTIO_IOMMU_MAP_F_WRITE        (1 << 1)
++typedef struct TransferDescriptor {
-+#define VIRTIO_IOMMU_MAP_F_MMIO            (1 << 2)
++    uint32_t status; /* Status flags */
-+
++    uint32_t size;   /* Data buffer size */
-+#define VIRTIO_IOMMU_MAP_F_MASK            (VIRTIO_IOMMU_MAP_F_READ |    \
++    uint32_t addr;   /* Data buffer address */
-+                         VIRTIO_IOMMU_MAP_F_WRITE |    \
++    uint32_t next;   /* Physical address of next descriptor */
-+                         VIRTIO_IOMMU_MAP_F_MMIO)
++} TransferDescriptor;
 +
-+struct virtio_iommu_req_map {
++/* Data transfer descriptor flags */
-+    struct virtio_iommu_req_head        head;
++enum {
-+    uint32_t                    domain;
++    DESC_STATUS_HOLD   = (1 << 31), /* Set when descriptor is in use by DMA */
-+    uint64_t                    virt_start;
++    DESC_STATUS_ERROR  = (1 << 30), /* Set when DMA transfer error occurred */
-+    uint64_t                    virt_end;
++    DESC_STATUS_CHAIN  = (1 << 4),  /* Indicates chained descriptor. */
-+    uint64_t                    phys_start;
++    DESC_STATUS_FIRST  = (1 << 3),  /* Set on the first descriptor */
-+    uint32_t                    flags;
++    DESC_STATUS_LAST   = (1 << 2),  /* Set on the last descriptor */
-+    struct virtio_iommu_req_tail        tail;
++    DESC_STATUS_NOIRQ  = (1 << 1),  /* Skip raising interrupt after transfer */
 +    DESC_SIZE_MASK     = (0xfffffffc)
 +};
 +
-+struct virtio_iommu_req_unmap {
++static void allwinner_sdhost_update_irq(AwSdHostState *s)
-+    struct virtio_iommu_req_head        head;
++{
-+    uint32_t                    domain;
++    uint32_t irq;
-+    uint64_t                    virt_start;
++
-+    uint64_t                    virt_end;
++    if (s->global_ctl & SD_GCTL_INT_ENB) {
-+    uint8_t                    reserved[4];
++        irq = s->irq_status & s->irq_mask;
-+    struct virtio_iommu_req_tail        tail;
++    } else {
 +        irq = 0;
 +    }
 +
 +    trace_allwinner_sdhost_update_irq(irq);
 +    qemu_set_irq(s->irq, irq);
 +}
 +
 +static void allwinner_sdhost_update_transfer_cnt(AwSdHostState *s,
 +                                                 uint32_t bytes)
 +{
 +    if (s->transfer_cnt > bytes) {
 +        s->transfer_cnt -= bytes;
 +    } else {
 +        s->transfer_cnt = 0;
 +    }
 +
 +    if (!s->transfer_cnt) {
 +        s->irq_status |= SD_RISR_DATA_COMPLETE;
 +    }
 +}
 +
 +static void allwinner_sdhost_set_inserted(DeviceState *dev, bool inserted)
 +{
 +    AwSdHostState *s = AW_SDHOST(dev);
 +
 +    trace_allwinner_sdhost_set_inserted(inserted);
 +
 +    if (inserted) {
 +        s->irq_status |= SD_RISR_CARD_INSERT;
 +        s->irq_status &= ~SD_RISR_CARD_REMOVE;
 +        s->status |= SD_STAR_CARD_PRESENT;
 +    } else {
 +        s->irq_status &= ~SD_RISR_CARD_INSERT;
 +        s->irq_status |= SD_RISR_CARD_REMOVE;
 +        s->status &= ~SD_STAR_CARD_PRESENT;
 +    }
 +
 +    allwinner_sdhost_update_irq(s);
 +}
 +
 +static void allwinner_sdhost_send_command(AwSdHostState *s)
 +{
 +    SDRequest request;
 +    uint8_t resp[16];
 +    int rlen;
 +
 +    /* Auto clear load flag */
 +    s->command &= ~SD_CMDR_LOAD;
 +
 +    /* Clock change does not actually interact with the SD bus */
 +    if (!(s->command & SD_CMDR_CLKCHANGE)) {
 +
 +        /* Prepare request */
 +        request.cmd = s->command & SD_CMDR_CMDID_MASK;
 +        request.arg = s->command_arg;
 +
 +        /* Send request to SD bus */
 +        rlen = sdbus_do_command(&s->sdbus, &request, resp);
 +        if (rlen < 0) {
 +            goto error;
 +        }
 +
 +        /* If the command has a response, store it in the response registers */
 +        if ((s->command & SD_CMDR_RESPONSE)) {
 +            if (rlen == 4 && !(s->command & SD_CMDR_RESPONSE_LONG)) {
 +                s->response[0] = ldl_be_p(&resp[0]);
 +                s->response[1] = s->response[2] = s->response[3] = 0;
 +
 +            } else if (rlen == 16 && (s->command & SD_CMDR_RESPONSE_LONG)) {
 +                s->response[0] = ldl_be_p(&resp[12]);
 +                s->response[1] = ldl_be_p(&resp[8]);
 +                s->response[2] = ldl_be_p(&resp[4]);
 +                s->response[3] = ldl_be_p(&resp[0]);
 +            } else {
 +                goto error;
 +            }
 +        }
 +    }
 +
 +    /* Set interrupt status bits */
 +    s->irq_status |= SD_RISR_CMD_COMPLETE;
 +    return;
 +
 +error:
 +    s->irq_status |= SD_RISR_NO_RESPONSE;
 +}
 +
 +static void allwinner_sdhost_auto_stop(AwSdHostState *s)
 +{
 +    /*
 +     * The stop command (CMD12) ensures the SD bus
 +     * returns to the transfer state.
 +     */
 +    if ((s->command & SD_CMDR_AUTOSTOP) && (s->transfer_cnt == 0)) {
 +        /* First save current command registers */
 +        uint32_t saved_cmd = s->command;
 +        uint32_t saved_arg = s->command_arg;
 +
 +        /* Prepare stop command (CMD12) */
 +        s->command &= ~SD_CMDR_CMDID_MASK;
 +        s->command |= 12; /* CMD12 */
 +        s->command_arg = 0;
 +
 +        /* Put the command on SD bus */
 +        allwinner_sdhost_send_command(s);
 +
 +        /* Restore command values */
 +        s->command = saved_cmd;
 +        s->command_arg = saved_arg;
 +
 +        /* Set IRQ status bit for automatic stop done */
 +        s->irq_status |= SD_RISR_AUTOCMD_DONE;
 +    }
 +}
 +
 +static uint32_t allwinner_sdhost_process_desc(AwSdHostState *s,
 +                                              hwaddr desc_addr,
 +                                              TransferDescriptor *desc,
 +                                              bool is_write, uint32_t max_bytes)
 +{
 +    AwSdHostClass *klass = AW_SDHOST_GET_CLASS(s);
 +    uint32_t num_done = 0;
 +    uint32_t num_bytes = max_bytes;
 +    uint8_t buf[1024];
 +
 +    /* Read descriptor */
 +    cpu_physical_memory_read(desc_addr, desc, sizeof(*desc));
 +    if (desc->size == 0) {
 +        desc->size = klass->max_desc_size;
 +    } else if (desc->size > klass->max_desc_size) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA descriptor buffer size "
 +                      " is out-of-bounds: %" PRIu32 " > %zu",
 +                      __func__, desc->size, klass->max_desc_size);
 +        desc->size = klass->max_desc_size;
 +    }
 +    if (desc->size < num_bytes) {
 +        num_bytes = desc->size;
 +    }
 +
 +    trace_allwinner_sdhost_process_desc(desc_addr, desc->size,
 +                                        is_write, max_bytes);
 +
 +    while (num_done < num_bytes) {
 +        /* Try to completely fill the local buffer */
 +        uint32_t buf_bytes = num_bytes - num_done;
 +        if (buf_bytes > sizeof(buf)) {
 +            buf_bytes = sizeof(buf);
 +        }
 +
 +        /* Write to SD bus */
 +        if (is_write) {
 +            cpu_physical_memory_read((desc->addr & DESC_SIZE_MASK) + num_done,
 +                                      buf, buf_bytes);
 +
 +            for (uint32_t i = 0; i < buf_bytes; i++) {
 +                sdbus_write_data(&s->sdbus, buf[i]);
 +            }
 +
 +        /* Read from SD bus */
 +        } else {
 +            for (uint32_t i = 0; i < buf_bytes; i++) {
 +                buf[i] = sdbus_read_data(&s->sdbus);
 +            }
 +            cpu_physical_memory_write((desc->addr & DESC_SIZE_MASK) + num_done,
 +                                       buf, buf_bytes);
 +        }
 +        num_done += buf_bytes;
 +    }
 +
 +    /* Clear hold flag and flush descriptor */
 +    desc->status &= ~DESC_STATUS_HOLD;
 +    cpu_physical_memory_write(desc_addr, desc, sizeof(*desc));
 +
 +    return num_done;
 +}
 +
 +static void allwinner_sdhost_dma(AwSdHostState *s)
 +{
 +    TransferDescriptor desc;
 +    hwaddr desc_addr = s->desc_base;
 +    bool is_write = (s->command & SD_CMDR_WRITE);
 +    uint32_t bytes_done = 0;
 +
 +    /* Check if DMA can be performed */
 +    if (s->byte_count == 0 || s->block_size == 0 ||
 +      !(s->global_ctl & SD_GCTL_DMA_ENB)) {
 +        return;
 +    }
 +
 +    /*
 +     * For read operations, data must be available on the SD bus
 +     * If not, it is an error and we should not act at all
 +     */
 +    if (!is_write && !sdbus_data_ready(&s->sdbus)) {
 +        return;
 +    }
 +
 +    /* Process the DMA descriptors until all data is copied */
 +    while (s->byte_count > 0) {
 +        bytes_done = allwinner_sdhost_process_desc(s, desc_addr, &desc,
 +                                                   is_write, s->byte_count);
 +        allwinner_sdhost_update_transfer_cnt(s, bytes_done);
 +
 +        if (bytes_done <= s->byte_count) {
 +            s->byte_count -= bytes_done;
 +        } else {
 +            s->byte_count = 0;
 +        }
 +
 +        if (desc.status & DESC_STATUS_LAST) {
 +            break;
 +        } else {
 +            desc_addr = desc.next;
 +        }
 +    }
 +
 +    /* Raise IRQ to signal DMA is completed */
 +    s->irq_status |= SD_RISR_DATA_COMPLETE | SD_RISR_SDIO_INTR;
 +
 +    /* Update DMAC bits */
 +    s->dmac_status |= SD_IDST_INT_SUMMARY;
 +
 +    if (is_write) {
 +        s->dmac_status |= SD_IDST_TRANSMIT_IRQ;
 +    } else {
 +        s->dmac_status |= SD_IDST_RECEIVE_IRQ;
 +    }
 +}
 +
 +static uint64_t allwinner_sdhost_read(void *opaque, hwaddr offset,
 +                                      unsigned size)
 +{
 +    AwSdHostState *s = AW_SDHOST(opaque);
 +    uint32_t res = 0;
 +
 +    switch (offset) {
 +    case REG_SD_GCTL:      /* Global Control */
 +        res = s->global_ctl;
 +        break;
 +    case REG_SD_CKCR:      /* Clock Control */
 +        res = s->clock_ctl;
 +        break;
 +    case REG_SD_TMOR:      /* Timeout */
 +        res = s->timeout;
 +        break;
 +    case REG_SD_BWDR:      /* Bus Width */
 +        res = s->bus_width;
 +        break;
 +    case REG_SD_BKSR:      /* Block Size */
 +        res = s->block_size;
 +        break;
 +    case REG_SD_BYCR:      /* Byte Count */
 +        res = s->byte_count;
 +        break;
 +    case REG_SD_CMDR:      /* Command */
 +        res = s->command;
 +        break;
 +    case REG_SD_CAGR:      /* Command Argument */
 +        res = s->command_arg;
 +        break;
 +    case REG_SD_RESP0:     /* Response Zero */
 +        res = s->response[0];
 +        break;
 +    case REG_SD_RESP1:     /* Response One */
 +        res = s->response[1];
 +        break;
 +    case REG_SD_RESP2:     /* Response Two */
 +        res = s->response[2];
 +        break;
 +    case REG_SD_RESP3:     /* Response Three */
 +        res = s->response[3];
 +        break;
 +    case REG_SD_IMKR:      /* Interrupt Mask */
 +        res = s->irq_mask;
 +        break;
 +    case REG_SD_MISR:      /* Masked Interrupt Status */
 +        res = s->irq_status & s->irq_mask;
 +        break;
 +    case REG_SD_RISR:      /* Raw Interrupt Status */
 +        res = s->irq_status;
 +        break;
 +    case REG_SD_STAR:      /* Status */
 +        res = s->status;
 +        break;
 +    case REG_SD_FWLR:      /* FIFO Water Level */
 +        res = s->fifo_wlevel;
 +        break;
 +    case REG_SD_FUNS:      /* FIFO Function Select */
 +        res = s->fifo_func_sel;
 +        break;
 +    case REG_SD_DBGC:      /* Debug Enable */
 +        res = s->debug_enable;
 +        break;
 +    case REG_SD_A12A:      /* Auto command 12 argument */
 +        res = s->auto12_arg;
 +        break;
 +    case REG_SD_NTSR:      /* SD NewTiming Set */
 +        res = s->newtiming_set;
 +        break;
 +    case REG_SD_SDBG:      /* SD newTiming Set Debug */
 +        res = s->newtiming_debug;
 +        break;
 +    case REG_SD_HWRST:     /* Hardware Reset Register */
 +        res = s->hardware_rst;
 +        break;
 +    case REG_SD_DMAC:      /* Internal DMA Controller Control */
 +        res = s->dmac;
 +        break;
 +    case REG_SD_DLBA:      /* Descriptor List Base Address */
 +        res = s->desc_base;
 +        break;
 +    case REG_SD_IDST:      /* Internal DMA Controller Status */
 +        res = s->dmac_status;
 +        break;
 +    case REG_SD_IDIE:      /* Internal DMA Controller Interrupt Enable */
 +        res = s->dmac_irq;
 +        break;
 +    case REG_SD_THLDC:     /* Card Threshold Control */
 +        res = s->card_threshold;
 +        break;
 +    case REG_SD_DSBD:      /* eMMC DDR Start Bit Detection Control */
 +        res = s->startbit_detect;
 +        break;
 +    case REG_SD_RES_CRC:   /* Response CRC from card/eMMC */
 +        res = s->response_crc;
 +        break;
 +    case REG_SD_DATA7_CRC: /* CRC Data 7 from card/eMMC */
 +    case REG_SD_DATA6_CRC: /* CRC Data 6 from card/eMMC */
 +    case REG_SD_DATA5_CRC: /* CRC Data 5 from card/eMMC */
 +    case REG_SD_DATA4_CRC: /* CRC Data 4 from card/eMMC */
 +    case REG_SD_DATA3_CRC: /* CRC Data 3 from card/eMMC */
 +    case REG_SD_DATA2_CRC: /* CRC Data 2 from card/eMMC */
 +    case REG_SD_DATA1_CRC: /* CRC Data 1 from card/eMMC */
 +    case REG_SD_DATA0_CRC: /* CRC Data 0 from card/eMMC */
 +        res = s->data_crc[((offset - REG_SD_DATA7_CRC) / sizeof(uint32_t))];
 +        break;
 +    case REG_SD_CRC_STA:   /* CRC status from card/eMMC in write operation */
 +        res = s->status_crc;
 +        break;
 +    case REG_SD_FIFO:      /* Read/Write FIFO */
 +        if (sdbus_data_ready(&s->sdbus)) {
 +            res = sdbus_read_data(&s->sdbus);
 +            res |= sdbus_read_data(&s->sdbus) << 8;
 +            res |= sdbus_read_data(&s->sdbus) << 16;
 +            res |= sdbus_read_data(&s->sdbus) << 24;
 +            allwinner_sdhost_update_transfer_cnt(s, sizeof(uint32_t));
 +            allwinner_sdhost_auto_stop(s);
 +            allwinner_sdhost_update_irq(s);
 +        } else {
 +            qemu_log_mask(LOG_GUEST_ERROR, "%s: no data ready on SD bus\n",
 +                          __func__);
 +        }
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset %"
 +                      HWADDR_PRIx"\n", __func__, offset);
 +        res = 0;
 +        break;
 +    }
 +
 +    trace_allwinner_sdhost_read(offset, res, size);
 +    return res;
 +}
 +
 +static void allwinner_sdhost_write(void *opaque, hwaddr offset,
 +                                   uint64_t value, unsigned size)
 +{
 +    AwSdHostState *s = AW_SDHOST(opaque);
 +
 +    trace_allwinner_sdhost_write(offset, value, size);
 +
 +    switch (offset) {
 +    case REG_SD_GCTL:      /* Global Control */
 +        s->global_ctl = value;
 +        s->global_ctl &= ~(SD_GCTL_DMA_RST | SD_GCTL_FIFO_RST |
 +                           SD_GCTL_SOFT_RST);
 +        allwinner_sdhost_update_irq(s);
 +        break;
 +    case REG_SD_CKCR:      /* Clock Control */
 +        s->clock_ctl = value;
 +        break;
 +    case REG_SD_TMOR:      /* Timeout */
 +        s->timeout = value;
 +        break;
 +    case REG_SD_BWDR:      /* Bus Width */
 +        s->bus_width = value;
 +        break;
 +    case REG_SD_BKSR:      /* Block Size */
 +        s->block_size = value;
 +        break;
 +    case REG_SD_BYCR:      /* Byte Count */
 +        s->byte_count = value;
 +        s->transfer_cnt = value;
 +        break;
 +    case REG_SD_CMDR:      /* Command */
 +        s->command = value;
 +        if (value & SD_CMDR_LOAD) {
 +            allwinner_sdhost_send_command(s);
 +            allwinner_sdhost_dma(s);
 +            allwinner_sdhost_auto_stop(s);
 +        }
 +        allwinner_sdhost_update_irq(s);
 +        break;
 +    case REG_SD_CAGR:      /* Command Argument */
 +        s->command_arg = value;
 +        break;
 +    case REG_SD_RESP0:     /* Response Zero */
 +        s->response[0] = value;
 +        break;
 +    case REG_SD_RESP1:     /* Response One */
 +        s->response[1] = value;
 +        break;
 +    case REG_SD_RESP2:     /* Response Two */
 +        s->response[2] = value;
 +        break;
 +    case REG_SD_RESP3:     /* Response Three */
 +        s->response[3] = value;
 +        break;
 +    case REG_SD_IMKR:      /* Interrupt Mask */
 +        s->irq_mask = value;
 +        allwinner_sdhost_update_irq(s);
 +        break;
 +    case REG_SD_MISR:      /* Masked Interrupt Status */
 +    case REG_SD_RISR:      /* Raw Interrupt Status */
 +        s->irq_status &= ~value;
 +        allwinner_sdhost_update_irq(s);
 +        break;
 +    case REG_SD_STAR:      /* Status */
 +        s->status &= ~value;
 +        allwinner_sdhost_update_irq(s);
 +        break;
 +    case REG_SD_FWLR:      /* FIFO Water Level */
 +        s->fifo_wlevel = value;
 +        break;
 +    case REG_SD_FUNS:      /* FIFO Function Select */
 +        s->fifo_func_sel = value;
 +        break;
 +    case REG_SD_DBGC:      /* Debug Enable */
 +        s->debug_enable = value;
 +        break;
 +    case REG_SD_A12A:      /* Auto command 12 argument */
 +        s->auto12_arg = value;
 +        break;
 +    case REG_SD_NTSR:      /* SD NewTiming Set */
 +        s->newtiming_set = value;
 +        break;
 +    case REG_SD_SDBG:      /* SD newTiming Set Debug */
 +        s->newtiming_debug = value;
 +        break;
 +    case REG_SD_HWRST:     /* Hardware Reset Register */
 +        s->hardware_rst = value;
 +        break;
 +    case REG_SD_DMAC:      /* Internal DMA Controller Control */
 +        s->dmac = value;
 +        allwinner_sdhost_update_irq(s);
 +        break;
 +    case REG_SD_DLBA:      /* Descriptor List Base Address */
 +        s->desc_base = value;
 +        break;
 +    case REG_SD_IDST:      /* Internal DMA Controller Status */
 +        s->dmac_status &= (~SD_IDST_WR_MASK) | (~value & SD_IDST_WR_MASK);
 +        allwinner_sdhost_update_irq(s);
 +        break;
 +    case REG_SD_IDIE:      /* Internal DMA Controller Interrupt Enable */
 +        s->dmac_irq = value;
 +        allwinner_sdhost_update_irq(s);
 +        break;
 +    case REG_SD_THLDC:     /* Card Threshold Control */
 +        s->card_threshold = value;
 +        break;
 +    case REG_SD_DSBD:      /* eMMC DDR Start Bit Detection Control */
 +        s->startbit_detect = value;
 +        break;
 +    case REG_SD_FIFO:      /* Read/Write FIFO */
 +        sdbus_write_data(&s->sdbus, value & 0xff);
 +        sdbus_write_data(&s->sdbus, (value >> 8) & 0xff);
 +        sdbus_write_data(&s->sdbus, (value >> 16) & 0xff);
 +        sdbus_write_data(&s->sdbus, (value >> 24) & 0xff);
 +        allwinner_sdhost_update_transfer_cnt(s, sizeof(uint32_t));
 +        allwinner_sdhost_auto_stop(s);
 +        allwinner_sdhost_update_irq(s);
 +        break;
 +    case REG_SD_RES_CRC:   /* Response CRC from card/eMMC */
 +    case REG_SD_DATA7_CRC: /* CRC Data 7 from card/eMMC */
 +    case REG_SD_DATA6_CRC: /* CRC Data 6 from card/eMMC */
 +    case REG_SD_DATA5_CRC: /* CRC Data 5 from card/eMMC */
 +    case REG_SD_DATA4_CRC: /* CRC Data 4 from card/eMMC */
 +    case REG_SD_DATA3_CRC: /* CRC Data 3 from card/eMMC */
 +    case REG_SD_DATA2_CRC: /* CRC Data 2 from card/eMMC */
 +    case REG_SD_DATA1_CRC: /* CRC Data 1 from card/eMMC */
 +    case REG_SD_DATA0_CRC: /* CRC Data 0 from card/eMMC */
 +    case REG_SD_CRC_STA:   /* CRC status from card/eMMC in write operation */
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset %"
 +                      HWADDR_PRIx"\n", __func__, offset);
 +        break;
 +    }
 +}
 +
 +static const MemoryRegionOps allwinner_sdhost_ops = {
 +    .read = allwinner_sdhost_read,
 +    .write = allwinner_sdhost_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +    .impl.min_access_size = 4,
 +};
 +
-+#define VIRTIO_IOMMU_PROBE_T_NONE        0
++static const VMStateDescription vmstate_allwinner_sdhost = {
-+#define VIRTIO_IOMMU_PROBE_T_RESV_MEM        1
++    .name = "allwinner-sdhost",
-+
++    .version_id = 1,
-+#define VIRTIO_IOMMU_PROBE_T_MASK        0xfff
++    .minimum_version_id = 1,
-+
++    .fields = (VMStateField[]) {
-+struct virtio_iommu_probe_property {
++        VMSTATE_UINT32(global_ctl, AwSdHostState),
-+    uint16_t                    type;
++        VMSTATE_UINT32(clock_ctl, AwSdHostState),
-+    uint16_t                    length;
++        VMSTATE_UINT32(timeout, AwSdHostState),
 +        VMSTATE_UINT32(bus_width, AwSdHostState),
 +        VMSTATE_UINT32(block_size, AwSdHostState),
 +        VMSTATE_UINT32(byte_count, AwSdHostState),
 +        VMSTATE_UINT32(transfer_cnt, AwSdHostState),
 +        VMSTATE_UINT32(command, AwSdHostState),
 +        VMSTATE_UINT32(command_arg, AwSdHostState),
 +        VMSTATE_UINT32_ARRAY(response, AwSdHostState, 4),
 +        VMSTATE_UINT32(irq_mask, AwSdHostState),
 +        VMSTATE_UINT32(irq_status, AwSdHostState),
 +        VMSTATE_UINT32(status, AwSdHostState),
 +        VMSTATE_UINT32(fifo_wlevel, AwSdHostState),
 +        VMSTATE_UINT32(fifo_func_sel, AwSdHostState),
 +        VMSTATE_UINT32(debug_enable, AwSdHostState),
 +        VMSTATE_UINT32(auto12_arg, AwSdHostState),
 +        VMSTATE_UINT32(newtiming_set, AwSdHostState),
 +        VMSTATE_UINT32(newtiming_debug, AwSdHostState),
 +        VMSTATE_UINT32(hardware_rst, AwSdHostState),
 +        VMSTATE_UINT32(dmac, AwSdHostState),
 +        VMSTATE_UINT32(desc_base, AwSdHostState),
 +        VMSTATE_UINT32(dmac_status, AwSdHostState),
 +        VMSTATE_UINT32(dmac_irq, AwSdHostState),
 +        VMSTATE_UINT32(card_threshold, AwSdHostState),
 +        VMSTATE_UINT32(startbit_detect, AwSdHostState),
 +        VMSTATE_UINT32(response_crc, AwSdHostState),
 +        VMSTATE_UINT32_ARRAY(data_crc, AwSdHostState, 8),
 +        VMSTATE_UINT32(status_crc, AwSdHostState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
-+#define VIRTIO_IOMMU_RESV_MEM_T_RESERVED    0
++static void allwinner_sdhost_init(Object *obj)
-+#define VIRTIO_IOMMU_RESV_MEM_T_MSI        1
++{
-+
++    AwSdHostState *s = AW_SDHOST(obj);
-+struct virtio_iommu_probe_resv_mem {
++
-+    struct virtio_iommu_probe_property    head;
++    qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
-+    uint8_t                    subtype;
++                         TYPE_AW_SDHOST_BUS, DEVICE(s), "sd-bus");
-+    uint8_t                    reserved[3];
++
-+    uint64_t                    start;
++    memory_region_init_io(&s->iomem, obj, &allwinner_sdhost_ops, s,
-+    uint64_t                    end;
++                           TYPE_AW_SDHOST, 4 * KiB);
 +    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 +    sysbus_init_irq(SYS_BUS_DEVICE(s), &s->irq);
 +}
 +
 +static void allwinner_sdhost_reset(DeviceState *dev)
 +{
 +    AwSdHostState *s = AW_SDHOST(dev);
 +
 +    s->global_ctl = REG_SD_GCTL_RST;
 +    s->clock_ctl = REG_SD_CKCR_RST;
 +    s->timeout = REG_SD_TMOR_RST;
 +    s->bus_width = REG_SD_BWDR_RST;
 +    s->block_size = REG_SD_BKSR_RST;
 +    s->byte_count = REG_SD_BYCR_RST;
 +    s->transfer_cnt = 0;
 +
 +    s->command = REG_SD_CMDR_RST;
 +    s->command_arg = REG_SD_CAGR_RST;
 +
 +    for (int i = 0; i < ARRAY_SIZE(s->response); i++) {
 +        s->response[i] = REG_SD_RESP_RST;
 +    }
 +
 +    s->irq_mask = REG_SD_IMKR_RST;
 +    s->irq_status = REG_SD_RISR_RST;
 +    s->status = REG_SD_STAR_RST;
 +
 +    s->fifo_wlevel = REG_SD_FWLR_RST;
 +    s->fifo_func_sel = REG_SD_FUNS_RST;
 +    s->debug_enable = REG_SD_DBGC_RST;
 +    s->auto12_arg = REG_SD_A12A_RST;
 +    s->newtiming_set = REG_SD_NTSR_RST;
 +    s->newtiming_debug = REG_SD_SDBG_RST;
 +    s->hardware_rst = REG_SD_HWRST_RST;
 +    s->dmac = REG_SD_DMAC_RST;
 +    s->desc_base = REG_SD_DLBA_RST;
 +    s->dmac_status = REG_SD_IDST_RST;
 +    s->dmac_irq = REG_SD_IDIE_RST;
 +    s->card_threshold = REG_SD_THLDC_RST;
 +    s->startbit_detect = REG_SD_DSBD_RST;
 +    s->response_crc = REG_SD_RES_CRC_RST;
 +
 +    for (int i = 0; i < ARRAY_SIZE(s->data_crc); i++) {
 +        s->data_crc[i] = REG_SD_DATA_CRC_RST;
 +    }
 +
 +    s->status_crc = REG_SD_CRC_STA_RST;
 +}
 +
 +static void allwinner_sdhost_bus_class_init(ObjectClass *klass, void *data)
 +{
 +    SDBusClass *sbc = SD_BUS_CLASS(klass);
 +
 +    sbc->set_inserted = allwinner_sdhost_set_inserted;
 +}
 +
 +static void allwinner_sdhost_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = allwinner_sdhost_reset;
 +    dc->vmsd = &vmstate_allwinner_sdhost;
 +}
 +
 +static void allwinner_sdhost_sun4i_class_init(ObjectClass *klass, void *data)
 +{
 +    AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
 +    sc->max_desc_size = 8 * KiB;
 +}
 +
 +static void allwinner_sdhost_sun5i_class_init(ObjectClass *klass, void *data)
 +{
 +    AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
 +    sc->max_desc_size = 64 * KiB;
 +}
 +
 +static TypeInfo allwinner_sdhost_info = {
 +    .name          = TYPE_AW_SDHOST,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_init = allwinner_sdhost_init,
 +    .instance_size = sizeof(AwSdHostState),
 +    .class_init    = allwinner_sdhost_class_init,
 +    .class_size    = sizeof(AwSdHostClass),
 +    .abstract      = true,
 +};
 +
-+struct virtio_iommu_req_probe {
++static const TypeInfo allwinner_sdhost_sun4i_info = {
-+    struct virtio_iommu_req_head        head;
++    .name          = TYPE_AW_SDHOST_SUN4I,
-+    uint32_t                    endpoint;
++    .parent        = TYPE_AW_SDHOST,
-+    uint8_t                    reserved[64];
++    .class_init    = allwinner_sdhost_sun4i_class_init,
 +
 +    uint8_t                    properties[];
 +
 +    /*
 +     * Tail follows the variable-length properties array. No padding,
 +     * property lengths are all aligned on 8 bytes.
 +     */
 +};
 +
-+/* Fault types */
++static const TypeInfo allwinner_sdhost_sun5i_info = {
-+#define VIRTIO_IOMMU_FAULT_R_UNKNOWN        0
++    .name          = TYPE_AW_SDHOST_SUN5I,
-+#define VIRTIO_IOMMU_FAULT_R_DOMAIN        1
++    .parent        = TYPE_AW_SDHOST,
-+#define VIRTIO_IOMMU_FAULT_R_MAPPING        2
++    .class_init    = allwinner_sdhost_sun5i_class_init,
 +
 +#define VIRTIO_IOMMU_FAULT_F_READ        (1 << 0)
 +#define VIRTIO_IOMMU_FAULT_F_WRITE        (1 << 1)
 +#define VIRTIO_IOMMU_FAULT_F_EXEC        (1 << 2)
 +#define VIRTIO_IOMMU_FAULT_F_ADDRESS        (1 << 8)
 +
 +struct virtio_iommu_fault {
 +    uint8_t                    reason;
 +    uint8_t                    reserved[3];
 +    uint32_t                    flags;
 +    uint32_t                    endpoint;
 +    uint8_t                    reserved2[4];
 +    uint64_t                    address;
 +};
 +
-+#endif
++static const TypeInfo allwinner_sdhost_bus_info = {
-diff --git a/include/standard-headers/linux/virtio_pmem.h b/include/standard-headers/linux/virtio_pmem.h
++    .name = TYPE_AW_SDHOST_BUS,
 +    .parent = TYPE_SD_BUS,
 +    .instance_size = sizeof(SDBus),
 +    .class_init = allwinner_sdhost_bus_class_init,
 +};
 +
 +static void allwinner_sdhost_register_types(void)
 +{
 +    type_register_static(&allwinner_sdhost_info);
 +    type_register_static(&allwinner_sdhost_sun4i_info);
 +    type_register_static(&allwinner_sdhost_sun5i_info);
 +    type_register_static(&allwinner_sdhost_bus_info);
 +}
 +
 +type_init(allwinner_sdhost_register_types)
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/include/standard-headers/linux/virtio_pmem.h
+--- a/hw/arm/Kconfig
-+++ b/include/standard-headers/linux/virtio_pmem.h
++++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
      select UNIMP
      select USB_OHCI
      select USB_EHCI_SYSBUS
 +    select SD
  config RASPI
      bool
 diff --git a/hw/sd/trace-events b/hw/sd/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sd/trace-events
 +++ b/hw/sd/trace-events
 @@ -XXX,XX +XXX,XX @@
--/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
+ # See docs/devel/tracing.txt for syntax documentation.
-+/* SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause */
- /*
++# allwinner-sdhost.c
-  * Definitions for virtio-pmem devices.
++allwinner_sdhost_set_inserted(bool inserted) "inserted %u"
-  *
++allwinner_sdhost_process_desc(uint64_t desc_addr, uint32_t desc_size, bool is_write, uint32_t max_bytes) "desc_addr 0x%" PRIx64 " desc_size %" PRIu32 " is_write %u max_bytes %" PRIu32
-@@ -XXX,XX +XXX,XX @@
++allwinner_sdhost_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
-  * Author(s): Pankaj Gupta <pagupta@redhat.com>
++allwinner_sdhost_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
-  */
++allwinner_sdhost_update_irq(uint32_t irq) "IRQ bits 0x%" PRIx32
++
--#ifndef _UAPI_LINUX_VIRTIO_PMEM_H
+ # bcm2835_sdhost.c
--#define _UAPI_LINUX_VIRTIO_PMEM_H
+ bcm2835_sdhost_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
-+#ifndef _LINUX_VIRTIO_PMEM_H
+ bcm2835_sdhost_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 +#define _LINUX_VIRTIO_PMEM_H
  #include "standard-headers/linux/types.h"
  #include "standard-headers/linux/virtio_ids.h"
 diff --git a/linux-headers/asm-arm/kvm.h b/linux-headers/asm-arm/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-arm/kvm.h
 +++ b/linux-headers/asm-arm/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_vcpu_events {
  #define KVM_REG_ARM_FW_REG(r)        (KVM_REG_ARM | KVM_REG_SIZE_U64 | \
                       KVM_REG_ARM_FW | ((r) & 0xffff))
  #define KVM_REG_ARM_PSCI_VERSION    KVM_REG_ARM_FW_REG(0)
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1    KVM_REG_ARM_FW_REG(1)
 +    /* Higher values mean better protection. */
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL        0
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL        1
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_REQUIRED    2
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2    KVM_REG_ARM_FW_REG(2)
 +    /* Higher values mean better protection. */
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL        0
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN        1
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL        2
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED    3
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED    (1U << 4)
  /* Device Control API: ARM VGIC */
  #define KVM_DEV_ARM_VGIC_GRP_ADDR    0
@@ -XXX,XX +XXX,XX @@ struct kvm_vcpu_events {
  #define   KVM_DEV_ARM_ITS_CTRL_RESET        4
  /* KVM_IRQ_LINE irq field index values */
 +#define KVM_ARM_IRQ_VCPU2_SHIFT        28
 +#define KVM_ARM_IRQ_VCPU2_MASK        0xf
  #define KVM_ARM_IRQ_TYPE_SHIFT        24
 -#define KVM_ARM_IRQ_TYPE_MASK        0xff
 +#define KVM_ARM_IRQ_TYPE_MASK        0xf
  #define KVM_ARM_IRQ_VCPU_SHIFT        16
  #define KVM_ARM_IRQ_VCPU_MASK        0xff
  #define KVM_ARM_IRQ_NUM_SHIFT        0
 diff --git a/linux-headers/asm-arm/unistd-common.h b/linux-headers/asm-arm/unistd-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-arm/unistd-common.h
 +++ b/linux-headers/asm-arm/unistd-common.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_fsconfig (__NR_SYSCALL_BASE + 431)
  #define __NR_fsmount (__NR_SYSCALL_BASE + 432)
  #define __NR_fspick (__NR_SYSCALL_BASE + 433)
 +#define __NR_pidfd_open (__NR_SYSCALL_BASE + 434)
 +#define __NR_clone3 (__NR_SYSCALL_BASE + 435)
  #endif /* _ASM_ARM_UNISTD_COMMON_H */
 diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-arm64/kvm.h
 +++ b/linux-headers/asm-arm64/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_vcpu_events {
  #define KVM_REG_ARM_FW_REG(r)        (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
                       KVM_REG_ARM_FW | ((r) & 0xffff))
  #define KVM_REG_ARM_PSCI_VERSION    KVM_REG_ARM_FW_REG(0)
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1    KVM_REG_ARM_FW_REG(1)
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL        0
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL        1
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_REQUIRED    2
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2    KVM_REG_ARM_FW_REG(2)
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL        0
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN        1
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL        2
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED    3
 +#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED         (1U << 4)
  /* SVE registers */
  #define KVM_REG_ARM64_SVE        (0x15 << KVM_REG_ARM_COPROC_SHIFT)
@@ -XXX,XX +XXX,XX @@ struct kvm_vcpu_events {
       KVM_REG_SIZE_U256 |                        \
       ((i) & (KVM_ARM64_SVE_MAX_SLICES - 1)))
 +/*
 + * Register values for KVM_REG_ARM64_SVE_ZREG(), KVM_REG_ARM64_SVE_PREG() and
 + * KVM_REG_ARM64_SVE_FFR() are represented in memory in an endianness-
 + * invariant layout which differs from the layout used for the FPSIMD
 + * V-registers on big-endian systems: see sigcontext.h for more explanation.
 + */
 +
  #define KVM_ARM64_SVE_VQ_MIN __SVE_VQ_MIN
  #define KVM_ARM64_SVE_VQ_MAX __SVE_VQ_MAX
@@ -XXX,XX +XXX,XX @@ struct kvm_vcpu_events {
  #define   KVM_ARM_VCPU_TIMER_IRQ_PTIMER        1
  /* KVM_IRQ_LINE irq field index values */
 +#define KVM_ARM_IRQ_VCPU2_SHIFT        28
 +#define KVM_ARM_IRQ_VCPU2_MASK        0xf
  #define KVM_ARM_IRQ_TYPE_SHIFT        24
 -#define KVM_ARM_IRQ_TYPE_MASK        0xff
 +#define KVM_ARM_IRQ_TYPE_MASK        0xf
  #define KVM_ARM_IRQ_VCPU_SHIFT        16
  #define KVM_ARM_IRQ_VCPU_MASK        0xff
  #define KVM_ARM_IRQ_NUM_SHIFT        0
 diff --git a/linux-headers/asm-generic/mman-common.h b/linux-headers/asm-generic/mman-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-generic/mman-common.h
 +++ b/linux-headers/asm-generic/mman-common.h
@@ -XXX,XX +XXX,XX @@
  #define MAP_TYPE    0x0f        /* Mask for type of mapping */
  #define MAP_FIXED    0x10        /* Interpret addr exactly */
  #define MAP_ANONYMOUS    0x20        /* don't use a file */
 -#ifdef CONFIG_MMAP_ALLOW_UNINITIALIZED
 -# define MAP_UNINITIALIZED 0x4000000    /* For anonymous mmap, memory could be uninitialized */
 -#else
 -# define MAP_UNINITIALIZED 0x0        /* Don't support this flag */
 -#endif
 -/* 0x0100 - 0x80000 flags are defined in asm-generic/mman.h */
 +/* 0x0100 - 0x4000 flags are defined in asm-generic/mman.h */
 +#define MAP_POPULATE        0x008000    /* populate (prefault) pagetables */
 +#define MAP_NONBLOCK        0x010000    /* do not block on IO */
 +#define MAP_STACK        0x020000    /* give out an address that is best suited for process/thread stacks */
 +#define MAP_HUGETLB        0x040000    /* create a huge page mapping */
 +#define MAP_SYNC        0x080000 /* perform synchronous page faults for the mapping */
  #define MAP_FIXED_NOREPLACE    0x100000    /* MAP_FIXED which doesn't unmap underlying mapping */
 +#define MAP_UNINITIALIZED 0x4000000    /* For anonymous mmap, memory could be
 +                     * uninitialized */
 +
  /*
   * Flags for mlock
   */
@@ -XXX,XX +XXX,XX @@
  #define MADV_WIPEONFORK 18        /* Zero memory on fork, child only */
  #define MADV_KEEPONFORK 19        /* Undo MADV_WIPEONFORK */
 +#define MADV_COLD    20        /* deactivate these pages */
 +#define MADV_PAGEOUT    21        /* reclaim these pages */
 +
  /* compatibility flags */
  #define MAP_FILE    0
 diff --git a/linux-headers/asm-generic/mman.h b/linux-headers/asm-generic/mman.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-generic/mman.h
 +++ b/linux-headers/asm-generic/mman.h
@@ -XXX,XX +XXX,XX @@
  #define MAP_EXECUTABLE    0x1000        /* mark it as an executable */
  #define MAP_LOCKED    0x2000        /* pages are locked */
  #define MAP_NORESERVE    0x4000        /* don't check for reservations */
 -#define MAP_POPULATE    0x8000        /* populate (prefault) pagetables */
 -#define MAP_NONBLOCK    0x10000        /* do not block on IO */
 -#define MAP_STACK    0x20000        /* give out an address that is best suited for process/thread stacks */
 -#define MAP_HUGETLB    0x40000        /* create a huge page mapping */
 -#define MAP_SYNC    0x80000        /* perform synchronous page faults for the mapping */
 -/* Bits [26:31] are reserved, see mman-common.h for MAP_HUGETLB usage */
 +/*
 + * Bits [26:31] are reserved, see asm-generic/hugetlb_encode.h
 + * for MAP_HUGETLB usage
 + */
  #define MCL_CURRENT    1        /* lock all current mappings */
  #define MCL_FUTURE    2        /* lock all future mappings */
 diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-generic/unistd.h
 +++ b/linux-headers/asm-generic/unistd.h
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_semget, sys_semget)
  __SC_COMP(__NR_semctl, sys_semctl, compat_sys_semctl)
  #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
  #define __NR_semtimedop 192
 -__SC_COMP(__NR_semtimedop, sys_semtimedop, sys_semtimedop_time32)
 +__SC_3264(__NR_semtimedop, sys_semtimedop_time32, sys_semtimedop)
  #endif
  #define __NR_semop 193
  __SYSCALL(__NR_semop, sys_semop)
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_fsconfig, sys_fsconfig)
  __SYSCALL(__NR_fsmount, sys_fsmount)
  #define __NR_fspick 433
  __SYSCALL(__NR_fspick, sys_fspick)
 +#define __NR_pidfd_open 434
 +__SYSCALL(__NR_pidfd_open, sys_pidfd_open)
 +#ifdef __ARCH_WANT_SYS_CLONE3
 +#define __NR_clone3 435
 +__SYSCALL(__NR_clone3, sys_clone3)
 +#endif
  #undef __NR_syscalls
 -#define __NR_syscalls 434
 +#define __NR_syscalls 436
  /*
   * 32 bit systems traditionally used different
 diff --git a/linux-headers/asm-mips/mman.h b/linux-headers/asm-mips/mman.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-mips/mman.h
 +++ b/linux-headers/asm-mips/mman.h
@@ -XXX,XX +XXX,XX @@
  #define MADV_WIPEONFORK 18        /* Zero memory on fork, child only */
  #define MADV_KEEPONFORK 19        /* Undo MADV_WIPEONFORK */
 +#define MADV_COLD    20        /* deactivate these pages */
 +#define MADV_PAGEOUT    21        /* reclaim these pages */
 +
  /* compatibility flags */
  #define MAP_FILE    0
 diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-mips/unistd_n32.h
 +++ b/linux-headers/asm-mips/unistd_n32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_fsconfig    (__NR_Linux + 431)
  #define __NR_fsmount    (__NR_Linux + 432)
  #define __NR_fspick    (__NR_Linux + 433)
 +#define __NR_pidfd_open    (__NR_Linux + 434)
  #endif /* _ASM_MIPS_UNISTD_N32_H */
 diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-mips/unistd_n64.h
 +++ b/linux-headers/asm-mips/unistd_n64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_fsconfig    (__NR_Linux + 431)
  #define __NR_fsmount    (__NR_Linux + 432)
  #define __NR_fspick    (__NR_Linux + 433)
 +#define __NR_pidfd_open    (__NR_Linux + 434)
  #endif /* _ASM_MIPS_UNISTD_N64_H */
 diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-mips/unistd_o32.h
 +++ b/linux-headers/asm-mips/unistd_o32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_fsconfig    (__NR_Linux + 431)
  #define __NR_fsmount    (__NR_Linux + 432)
  #define __NR_fspick    (__NR_Linux + 433)
 +#define __NR_pidfd_open    (__NR_Linux + 434)
  #endif /* _ASM_MIPS_UNISTD_O32_H */
 diff --git a/linux-headers/asm-powerpc/mman.h b/linux-headers/asm-powerpc/mman.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-powerpc/mman.h
 +++ b/linux-headers/asm-powerpc/mman.h
@@ -XXX,XX +XXX,XX @@
  #define MAP_DENYWRITE    0x0800        /* ETXTBSY */
  #define MAP_EXECUTABLE    0x1000        /* mark it as an executable */
 +
  #define MCL_CURRENT     0x2000          /* lock all currently mapped pages */
  #define MCL_FUTURE      0x4000          /* lock all additions to address space */
  #define MCL_ONFAULT    0x8000        /* lock all pages that are faulted in */
 -#define MAP_POPULATE    0x8000        /* populate (prefault) pagetables */
 -#define MAP_NONBLOCK    0x10000        /* do not block on IO */
 -#define MAP_STACK    0x20000        /* give out an address that is best suited for process/thread stacks */
 -#define MAP_HUGETLB    0x40000        /* create a huge page mapping */
 -
  /* Override any generic PKEY permission defines */
  #define PKEY_DISABLE_EXECUTE   0x4
  #undef PKEY_ACCESS_MASK
 diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-powerpc/unistd_32.h
 +++ b/linux-headers/asm-powerpc/unistd_32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_fsconfig    431
  #define __NR_fsmount    432
  #define __NR_fspick    433
 +#define __NR_pidfd_open    434
 +#define __NR_clone3    435
  #endif /* _ASM_POWERPC_UNISTD_32_H */
 diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-powerpc/unistd_64.h
 +++ b/linux-headers/asm-powerpc/unistd_64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_fsconfig    431
  #define __NR_fsmount    432
  #define __NR_fspick    433
 +#define __NR_pidfd_open    434
 +#define __NR_clone3    435
  #endif /* _ASM_POWERPC_UNISTD_64_H */
 diff --git a/linux-headers/asm-s390/kvm.h b/linux-headers/asm-s390/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-s390/kvm.h
 +++ b/linux-headers/asm-s390/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_guest_debug_arch {
  #define KVM_SYNC_GSCB   (1UL << 9)
  #define KVM_SYNC_BPBC   (1UL << 10)
  #define KVM_SYNC_ETOKEN (1UL << 11)
 +
 +#define KVM_SYNC_S390_VALID_FIELDS \
 +    (KVM_SYNC_PREFIX | KVM_SYNC_GPRS | KVM_SYNC_ACRS | KVM_SYNC_CRS | \
 +     KVM_SYNC_ARCH0 | KVM_SYNC_PFAULT | KVM_SYNC_VRS | KVM_SYNC_RICCB | \
 +     KVM_SYNC_FPRS | KVM_SYNC_GSCB | KVM_SYNC_BPBC | KVM_SYNC_ETOKEN)
 +
  /* length and alignment of the sdnx as a power of two */
  #define SDNXC 8
  #define SDNXL (1UL << SDNXC)
 diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-s390/unistd_32.h
 +++ b/linux-headers/asm-s390/unistd_32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_fsconfig 431
  #define __NR_fsmount 432
  #define __NR_fspick 433
 +#define __NR_pidfd_open 434
 +#define __NR_clone3 435
  #endif /* _ASM_S390_UNISTD_32_H */
 diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-s390/unistd_64.h
 +++ b/linux-headers/asm-s390/unistd_64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_fsconfig 431
  #define __NR_fsmount 432
  #define __NR_fspick 433
 +#define __NR_pidfd_open 434
 +#define __NR_clone3 435
  #endif /* _ASM_S390_UNISTD_64_H */
 diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/kvm.h
 +++ b/linux-headers/asm-x86/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_sync_regs {
      struct kvm_vcpu_events events;
  };
 -#define KVM_X86_QUIRK_LINT0_REENABLED    (1 << 0)
 -#define KVM_X86_QUIRK_CD_NW_CLEARED    (1 << 1)
 -#define KVM_X86_QUIRK_LAPIC_MMIO_HOLE    (1 << 2)
 -#define KVM_X86_QUIRK_OUT_7E_INC_RIP    (1 << 3)
 +#define KVM_X86_QUIRK_LINT0_REENABLED       (1 << 0)
 +#define KVM_X86_QUIRK_CD_NW_CLEARED       (1 << 1)
 +#define KVM_X86_QUIRK_LAPIC_MMIO_HOLE       (1 << 2)
 +#define KVM_X86_QUIRK_OUT_7E_INC_RIP       (1 << 3)
 +#define KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT (1 << 4)
  #define KVM_STATE_NESTED_FORMAT_VMX    0
 -#define KVM_STATE_NESTED_FORMAT_SVM    1
 +#define KVM_STATE_NESTED_FORMAT_SVM    1    /* unused */
  #define KVM_STATE_NESTED_GUEST_MODE    0x00000001
  #define KVM_STATE_NESTED_RUN_PENDING    0x00000002
  #define KVM_STATE_NESTED_EVMCS        0x00000004
 -#define KVM_STATE_NESTED_VMX_VMCS_SIZE    0x1000
 -
  #define KVM_STATE_NESTED_SMM_GUEST_MODE    0x00000001
  #define KVM_STATE_NESTED_SMM_VMXON    0x00000002
 +#define KVM_STATE_NESTED_VMX_VMCS_SIZE    0x1000
 +
  struct kvm_vmx_nested_state_data {
      __u8 vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
      __u8 shadow_vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
@@ -XXX,XX +XXX,XX @@ struct kvm_nested_state {
      } data;
  };
 +/* for KVM_CAP_PMU_EVENT_FILTER */
 +struct kvm_pmu_event_filter {
 +    __u32 action;
 +    __u32 nevents;
 +    __u32 fixed_counter_bitmap;
 +    __u32 flags;
 +    __u32 pad[4];
 +    __u64 events[0];
 +};
 +
 +#define KVM_PMU_EVENT_ALLOW 0
 +#define KVM_PMU_EVENT_DENY 1
 +
  #endif /* _ASM_X86_KVM_H */
 diff --git a/linux-headers/asm-x86/unistd.h b/linux-headers/asm-x86/unistd.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd.h
 +++ b/linux-headers/asm-x86/unistd.h
@@ -XXX,XX +XXX,XX @@
  #define _ASM_X86_UNISTD_H
  /* x32 syscall flag bit */
 -#define __X32_SYSCALL_BIT    0x40000000
 +#define __X32_SYSCALL_BIT    0x40000000UL
  # ifdef __i386__
  #  include <asm/unistd_32.h>
 diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd_32.h
 +++ b/linux-headers/asm-x86/unistd_32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_fsconfig 431
  #define __NR_fsmount 432
  #define __NR_fspick 433
 +#define __NR_pidfd_open 434
 +#define __NR_clone3 435
  #endif /* _ASM_X86_UNISTD_32_H */
 diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd_64.h
 +++ b/linux-headers/asm-x86/unistd_64.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_fsconfig 431
  #define __NR_fsmount 432
  #define __NR_fspick 433
 +#define __NR_pidfd_open 434
 +#define __NR_clone3 435
  #endif /* _ASM_X86_UNISTD_64_H */
 diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/asm-x86/unistd_x32.h
 +++ b/linux-headers/asm-x86/unistd_x32.h
@@ -XXX,XX +XXX,XX @@
  #define __NR_fsconfig (__X32_SYSCALL_BIT + 431)
  #define __NR_fsmount (__X32_SYSCALL_BIT + 432)
  #define __NR_fspick (__X32_SYSCALL_BIT + 433)
 +#define __NR_pidfd_open (__X32_SYSCALL_BIT + 434)
 +#define __NR_clone3 (__X32_SYSCALL_BIT + 435)
  #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
  #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
  #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
 diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/kvm.h
 +++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_irq_level {
       * ACPI gsi notion of irq.
       * For IA-64 (APIC model) IOAPIC0: irq 0-23; IOAPIC1: irq 24-47..
       * For X86 (standard AT mode) PIC0/1: irq 0-15. IOAPIC0: 0-23..
 -     * For ARM: See Documentation/virtual/kvm/api.txt
 +     * For ARM: See Documentation/virt/kvm/api.txt
       */
      union {
          __u32 irq;
@@ -XXX,XX +XXX,XX @@ struct kvm_hyperv_exit {
  #define KVM_INTERNAL_ERROR_SIMUL_EX    2
  /* Encounter unexpected vm-exit due to delivery event. */
  #define KVM_INTERNAL_ERROR_DELIVERY_EV    3
 +/* Encounter unexpected vm-exit reason */
 +#define KVM_INTERNAL_ERROR_UNEXPECTED_EXIT_REASON    4
  /* for KVM_RUN, returned by mmap(vcpu_fd, offset=0) */
  struct kvm_run {
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
  #define KVM_CAP_ARM_SVE 170
  #define KVM_CAP_ARM_PTRAUTH_ADDRESS 171
  #define KVM_CAP_ARM_PTRAUTH_GENERIC 172
 +#define KVM_CAP_PMU_EVENT_FILTER 173
 +#define KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 174
 +#define KVM_CAP_HYPERV_DIRECT_TLBFLUSH 175
  #ifdef KVM_CAP_IRQ_ROUTING
@@ -XXX,XX +XXX,XX @@ struct kvm_xen_hvm_config {
   *
   * KVM_IRQFD_FLAG_RESAMPLE indicates resamplefd is valid and specifies
   * the irqfd to operate in resampling mode for level triggered interrupt
 - * emulation.  See Documentation/virtual/kvm/api.txt.
 + * emulation.  See Documentation/virt/kvm/api.txt.
   */
  #define KVM_IRQFD_FLAG_RESAMPLE (1 << 1)
@@ -XXX,XX +XXX,XX @@ struct kvm_dirty_tlb {
  #define KVM_REG_S390        0x5000000000000000ULL
  #define KVM_REG_ARM64        0x6000000000000000ULL
  #define KVM_REG_MIPS        0x7000000000000000ULL
 +#define KVM_REG_RISCV        0x8000000000000000ULL
  #define KVM_REG_SIZE_SHIFT    52
  #define KVM_REG_SIZE_MASK    0x00f0000000000000ULL
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
  #define KVM_PPC_GET_RMMU_INFO      _IOW(KVMIO,  0xb0, struct kvm_ppc_rmmu_info)
  /* Available with KVM_CAP_PPC_GET_CPU_CHAR */
  #define KVM_PPC_GET_CPU_CHAR      _IOR(KVMIO,  0xb1, struct kvm_ppc_cpu_char)
 +/* Available with KVM_CAP_PMU_EVENT_FILTER */
 +#define KVM_SET_PMU_EVENT_FILTER  _IOW(KVMIO,  0xb2, struct kvm_pmu_event_filter)
  /* ioctl for vm fd */
  #define KVM_CREATE_DEVICE      _IOWR(KVMIO,  0xe0, struct kvm_create_device)
 diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/psp-sev.h
 +++ b/linux-headers/linux/psp-sev.h
@@ -XXX,XX +XXX,XX @@
 +/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
  /*
   * Userspace interface for AMD Secure Encrypted Virtualization (SEV)
   * platform management commands.
@@ -XXX,XX +XXX,XX @@
   * Author: Brijesh Singh <brijesh.singh@amd.com>
   *
   * SEV API specification is available at: https://developer.amd.com/sev/
 - *
 - * This program is free software; you can redistribute it and/or modify
 - * it under the terms of the GNU General Public License version 2 as
 - * published by the Free Software Foundation.
   */
  #ifndef __PSP_SEV_USER_H__
 diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-headers/linux/vfio.h
 +++ b/linux-headers/linux/vfio.h
@@ -XXX,XX +XXX,XX @@ struct vfio_region_info_cap_type {
      __u32 subtype;    /* type specific */
  };
 +/*
 + * List of region types, global per bus driver.
 + * If you introduce a new type, please add it here.
 + */
 +
 +/* PCI region type containing a PCI vendor part */
  #define VFIO_REGION_TYPE_PCI_VENDOR_TYPE    (1 << 31)
  #define VFIO_REGION_TYPE_PCI_VENDOR_MASK    (0xffff)
 +#define VFIO_REGION_TYPE_GFX                    (1)
 +#define VFIO_REGION_TYPE_CCW            (2)
 -/* 8086 Vendor sub-types */
 +/* sub-types for VFIO_REGION_TYPE_PCI_* */
 +
 +/* 8086 vendor PCI sub-types */
  #define VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION    (1)
  #define VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG    (2)
  #define VFIO_REGION_SUBTYPE_INTEL_IGD_LPC_CFG    (3)
 -#define VFIO_REGION_TYPE_GFX                    (1)
 +/* 10de vendor PCI sub-types */
 +/*
 + * NVIDIA GPU NVlink2 RAM is coherent RAM mapped onto the host address space.
 + */
 +#define VFIO_REGION_SUBTYPE_NVIDIA_NVLINK2_RAM    (1)
 +
 +/* 1014 vendor PCI sub-types */
 +/*
 + * IBM NPU NVlink2 ATSD (Address Translation Shootdown) register of NPU
 + * to do TLB invalidation on a GPU.
 + */
 +#define VFIO_REGION_SUBTYPE_IBM_NVLINK2_ATSD    (1)
 +
 +/* sub-types for VFIO_REGION_TYPE_GFX */
  #define VFIO_REGION_SUBTYPE_GFX_EDID            (1)
  /**
@@ -XXX,XX +XXX,XX @@ struct vfio_region_gfx_edid {
  #define VFIO_DEVICE_GFX_LINK_STATE_DOWN  2
  };
 -#define VFIO_REGION_TYPE_CCW            (2)
 -/* ccw sub-types */
 +/* sub-types for VFIO_REGION_TYPE_CCW */
  #define VFIO_REGION_SUBTYPE_CCW_ASYNC_CMD    (1)
 -/*
 - * 10de vendor sub-type
 - *
 - * NVIDIA GPU NVlink2 RAM is coherent RAM mapped onto the host address space.
 - */
 -#define VFIO_REGION_SUBTYPE_NVIDIA_NVLINK2_RAM    (1)
 -
 -/*
 - * 1014 vendor sub-type
 - *
 - * IBM NPU NVlink2 ATSD (Address Translation Shootdown) register of NPU
 - * to do TLB invalidation on a GPU.
 - */
 -#define VFIO_REGION_SUBTYPE_IBM_NVLINK2_ATSD    (1)
 -
  /*
   * The MSIX mappable capability informs that MSIX data of a BAR can be mmapped
   * which allows direct access to non-MSIX registers which happened to be within
@@ -XXX,XX +XXX,XX @@ struct vfio_iommu_type1_info {
      __u32    argsz;
      __u32    flags;
  #define VFIO_IOMMU_INFO_PGSIZES (1 << 0)    /* supported page sizes info */
 -    __u64    iova_pgsizes;        /* Bitmap of supported page sizes */
 +#define VFIO_IOMMU_INFO_CAPS    (1 << 1)    /* Info supports caps */
 +    __u64    iova_pgsizes;    /* Bitmap of supported page sizes */
 +    __u32   cap_offset;    /* Offset within info struct of first cap */
 +};
 +
 +/*
 + * The IOVA capability allows to report the valid IOVA range(s)
 + * excluding any non-relaxable reserved regions exposed by
 + * devices attached to the container. Any DMA map attempt
 + * outside the valid iova range will return error.
 + *
 + * The structures below define version 1 of this capability.
 + */
 +#define VFIO_IOMMU_TYPE1_INFO_CAP_IOVA_RANGE  1
 +
 +struct vfio_iova_range {
 +    __u64    start;
 +    __u64    end;
 +};
 +
 +struct vfio_iommu_type1_info_cap_iova_range {
 +    struct    vfio_info_cap_header header;
 +    __u32    nr_iovas;
 +    __u32    reserved;
 +    struct    vfio_iova_range iova_ranges[];
  };
  #define VFIO_IOMMU_GET_INFO _IO(VFIO_TYPE, VFIO_BASE + 12)
 --
 .20.1

-[PULL 37/68] target/arm/arm-semi: Implement support for semihosting feature detection
+[PULL 20/36] hw/arm/allwinner-h3: add EMAC ethernet device
-Version 2.0 of the semihosting specification added support for
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
 allowing a guest to detect whether the implementation supported
 particular features. This works by the guest opening a magic
 file ":semihosting-features", which contains a fixed set of
 data with some magic numbers followed by a sequence of bytes
 with feature flags. The file is expected to behave sensibly
 for the various semihosting calls which operate on files
 (SYS_FLEN, SYS_SEEK, etc).
-Implement this as another kind of guest FD using our function
+The Allwinner Sun8i System on Chip family includes an Ethernet MAC (EMAC)
-table dispatch mechanism. Initially we report no extended
+which provides 10M/100M/1000M Ethernet connectivity. This commit
-features, so we have just one feature flag byte which is zero.
+adds support for the Allwinner EMAC from the Sun8i family (H2+, H3, A33, etc),
 including emulation for the following functionality:
+ * DMA transfers
+ * MII interface
+ * Transmit CRC calculation
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20200311221854.30370-10-nieklinnenbank@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190916141544.17540-14-peter.maydell@linaro.org
 ---
- target/arm/arm-semi.c | 109 +++++++++++++++++++++++++++++++++++++++++-
+ hw/net/Makefile.objs                  |   1 +
-file changed, 108 insertions(+), 1 deletion(-)
+ include/hw/arm/allwinner-h3.h         |   3 +
  include/hw/net/allwinner-sun8i-emac.h |  99 +++
  hw/arm/allwinner-h3.c                 |  16 +-
  hw/arm/orangepi.c                     |   3 +
  hw/net/allwinner-sun8i-emac.c         | 871 ++++++++++++++++++++++++++
  hw/arm/Kconfig                        |   1 +
  hw/net/Kconfig                        |   3 +
  hw/net/trace-events                   |  10 +
 files changed, 1006 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/net/allwinner-sun8i-emac.h
  create mode 100644 hw/net/allwinner-sun8i-emac.c
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
+diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
+--- a/hw/net/Makefile.objs
-+++ b/target/arm/arm-semi.c
++++ b/hw/net/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ typedef enum GuestFDType {
+@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_XGMAC) += xgmac.o
-     GuestFDUnused = 0,
+ common-obj-$(CONFIG_MIPSNET) += mipsnet.o
-     GuestFDHost = 1,
+ common-obj-$(CONFIG_XILINX_AXI) += xilinx_axienet.o
-     GuestFDGDB = 2,
+ common-obj-$(CONFIG_ALLWINNER_EMAC) += allwinner_emac.o
-+    GuestFDFeatureFile = 3,
++common-obj-$(CONFIG_ALLWINNER_SUN8I_EMAC) += allwinner-sun8i-emac.o
- } GuestFDType;
+ common-obj-$(CONFIG_IMX_FEC) += imx_fec.o
- /*
+ common-obj-$(CONFIG_CADENCE) += cadence_gem.o
-@@ -XXX,XX +XXX,XX @@ typedef enum GuestFDType {
+diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
-  */
+index XXXXXXX..XXXXXXX 100644
- typedef struct GuestFD {
+--- a/include/hw/arm/allwinner-h3.h
-     GuestFDType type;
++++ b/include/hw/arm/allwinner-h3.h
--    int hostfd;
+@@ -XXX,XX +XXX,XX @@
-+    union {
+ #include "hw/misc/allwinner-h3-sysctrl.h"
-+        int hostfd;
+ #include "hw/misc/allwinner-sid.h"
-+        target_ulong featurefile_offset;
+ #include "hw/sd/allwinner-sdhost.h"
-+    };
++#include "hw/net/allwinner-sun8i-emac.h"
- } GuestFD;
+ #include "target/arm/cpu.h"
- static GArray *guestfd_array;
+ /**
-@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_flenfn(ARMCPU *cpu, GuestFD *gf)
+@@ -XXX,XX +XXX,XX @@ enum {
-                            gf->hostfd, arm_flen_buf(cpu));
+     AW_H3_UART1,
      AW_H3_UART2,
      AW_H3_UART3,
 +    AW_H3_EMAC,
      AW_H3_GIC_DIST,
      AW_H3_GIC_CPU,
      AW_H3_GIC_HYP,
@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
      AwH3SysCtrlState sysctrl;
      AwSidState sid;
      AwSdHostState mmc0;
 +    AwSun8iEmacState emac;
      GICState gic;
      MemoryRegion sram_a1;
      MemoryRegion sram_a2;
 diff --git a/include/hw/net/allwinner-sun8i-emac.h b/include/hw/net/allwinner-sun8i-emac.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/net/allwinner-sun8i-emac.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Allwinner Sun8i Ethernet MAC emulation
 + *
 + * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#ifndef HW_NET_ALLWINNER_SUN8I_EMAC_H
 +#define HW_NET_ALLWINNER_SUN8I_EMAC_H
 +
 +#include "qom/object.h"
 +#include "net/net.h"
 +#include "hw/sysbus.h"
 +
 +/**
 + * Object model
 + * @{
 + */
 +
 +#define TYPE_AW_SUN8I_EMAC "allwinner-sun8i-emac"
 +#define AW_SUN8I_EMAC(obj) \
 +    OBJECT_CHECK(AwSun8iEmacState, (obj), TYPE_AW_SUN8I_EMAC)
 +
 +/** @} */
 +
 +/**
 + * Allwinner Sun8i EMAC object instance state
 + */
 +typedef struct AwSun8iEmacState {
 +    /*< private >*/
 +    SysBusDevice  parent_obj;
 +    /*< public >*/
 +
 +    /** Maps I/O registers in physical memory */
 +    MemoryRegion iomem;
 +
 +    /** Interrupt output signal to notify CPU */
 +    qemu_irq     irq;
 +
 +    /** Generic Network Interface Controller (NIC) for networking API */
 +    NICState     *nic;
 +
 +    /** Generic Network Interface Controller (NIC) configuration */
 +    NICConf      conf;
 +
 +    /**
 +     * @name Media Independent Interface (MII)
 +     * @{
 +     */
 +
 +    uint8_t      mii_phy_addr;  /**< PHY address */
 +    uint32_t     mii_cr;        /**< Control */
 +    uint32_t     mii_st;        /**< Status */
 +    uint32_t     mii_adv;       /**< Advertised Abilities */
 +
 +    /** @} */
 +
 +    /**
 +     * @name Hardware Registers
 +     * @{
 +     */
 +
 +    uint32_t     basic_ctl0;    /**< Basic Control 0 */
 +    uint32_t     basic_ctl1;    /**< Basic Control 1 */
 +    uint32_t     int_en;        /**< Interrupt Enable */
 +    uint32_t     int_sta;       /**< Interrupt Status */
 +    uint32_t     frm_flt;       /**< Receive Frame Filter */
 +
 +    uint32_t     rx_ctl0;       /**< Receive Control 0 */
 +    uint32_t     rx_ctl1;       /**< Receive Control 1 */
 +    uint32_t     rx_desc_head;  /**< Receive Descriptor List Address */
 +    uint32_t     rx_desc_curr;  /**< Current Receive Descriptor Address */
 +
 +    uint32_t     tx_ctl0;       /**< Transmit Control 0 */
 +    uint32_t     tx_ctl1;       /**< Transmit Control 1 */
 +    uint32_t     tx_desc_head;  /**< Transmit Descriptor List Address */
 +    uint32_t     tx_desc_curr;  /**< Current Transmit Descriptor Address */
 +    uint32_t     tx_flowctl;    /**< Transmit Flow Control */
 +
 +    uint32_t     mii_cmd;       /**< Management Interface Command */
 +    uint32_t     mii_data;      /**< Management Interface Data */
 +
 +    /** @} */
 +
 +} AwSun8iEmacState;
 +
 +#endif /* HW_NET_ALLWINNER_SUN8I_H */
 diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/allwinner-h3.c
 +++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
      [AW_H3_UART1]      = 0x01c28400,
      [AW_H3_UART2]      = 0x01c28800,
      [AW_H3_UART3]      = 0x01c28c00,
 +    [AW_H3_EMAC]       = 0x01c30000,
      [AW_H3_GIC_DIST]   = 0x01c81000,
      [AW_H3_GIC_CPU]    = 0x01c82000,
      [AW_H3_GIC_HYP]    = 0x01c84000,
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
      { "twi1",      0x01c2b000, 1 * KiB },
      { "twi2",      0x01c2b400, 1 * KiB },
      { "scr",       0x01c2c400, 1 * KiB },
 -    { "emac",      0x01c30000, 64 * KiB },
      { "gpu",       0x01c40000, 64 * KiB },
      { "hstmr",     0x01c60000, 4 * KiB },
      { "dramcom",   0x01c62000, 4 * KiB },
@@ -XXX,XX +XXX,XX @@ enum {
      AW_H3_GIC_SPI_OHCI2     = 77,
      AW_H3_GIC_SPI_EHCI3     = 78,
      AW_H3_GIC_SPI_OHCI3     = 79,
 +    AW_H3_GIC_SPI_EMAC      = 82
  };
  /* Allwinner H3 general constants */
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
      sysbus_init_child_obj(obj, "mmc0", &s->mmc0, sizeof(s->mmc0),
                            TYPE_AW_SDHOST_SUN5I);
 +
 +    sysbus_init_child_obj(obj, "emac", &s->emac, sizeof(s->emac),
 +                          TYPE_AW_SUN8I_EMAC);
  }
-+#define SHFB_MAGIC_0 0x53
+ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
-+#define SHFB_MAGIC_1 0x48
+@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
-+#define SHFB_MAGIC_2 0x46
+     object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->mmc0),
-+#define SHFB_MAGIC_3 0x42
+                               "sd-bus", &error_abort);
-+
-+static const uint8_t featurefile_data[] = {
++    /* EMAC */
-+    SHFB_MAGIC_0,
++    if (nd_table[0].used) {
-+    SHFB_MAGIC_1,
++        qemu_check_nic_model(&nd_table[0], TYPE_AW_SUN8I_EMAC);
-+    SHFB_MAGIC_2,
++        qdev_set_nic_properties(DEVICE(&s->emac), &nd_table[0]);
-+    SHFB_MAGIC_3,
++    }
-+    0, /* Feature byte 0 */
++    qdev_init_nofail(DEVICE(&s->emac));
-+};
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->emac), 0, s->memmap[AW_H3_EMAC]);
-+
++    sysbus_connect_irq(SYS_BUS_DEVICE(&s->emac), 0,
-+static void init_featurefile_guestfd(int guestfd)
++                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_EMAC));
-+{
++
-+    GuestFD *gf = do_get_guestfd(guestfd);
+     /* Universal Serial Bus */
-+
+     sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI0],
-+    assert(gf);
+                          qdev_get_gpio_in(DEVICE(&s->gic),
-+    gf->type = GuestFDFeatureFile;
+diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
-+    gf->featurefile_offset = 0;
+index XXXXXXX..XXXXXXX 100644
-+}
+--- a/hw/arm/orangepi.c
-+
++++ b/hw/arm/orangepi.c
-+static uint32_t featurefile_closefn(ARMCPU *cpu, GuestFD *gf)
+@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)
-+{
+         warn_report("Security Identifier value does not include H3 prefix");
-+    /* Nothing to do */
+     }
 +    /* Setup EMAC properties */
 +    object_property_set_int(OBJECT(&h3->emac), 1, "phy-addr", &error_abort);
 +
      /* Mark H3 object realized */
      object_property_set_bool(OBJECT(h3), true, "realized", &error_abort);
 diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/net/allwinner-sun8i-emac.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Allwinner Sun8i Ethernet MAC emulation
 + *
 + * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/units.h"
 +#include "hw/sysbus.h"
 +#include "migration/vmstate.h"
 +#include "net/net.h"
 +#include "hw/irq.h"
 +#include "hw/qdev-properties.h"
 +#include "qemu/log.h"
 +#include "trace.h"
 +#include "net/checksum.h"
 +#include "qemu/module.h"
 +#include "exec/cpu-common.h"
 +#include "hw/net/allwinner-sun8i-emac.h"
 +
 +/* EMAC register offsets */
 +enum {
 +    REG_BASIC_CTL_0        = 0x0000, /* Basic Control 0 */
 +    REG_BASIC_CTL_1        = 0x0004, /* Basic Control 1 */
 +    REG_INT_STA            = 0x0008, /* Interrupt Status */
 +    REG_INT_EN             = 0x000C, /* Interrupt Enable */
 +    REG_TX_CTL_0           = 0x0010, /* Transmit Control 0 */
 +    REG_TX_CTL_1           = 0x0014, /* Transmit Control 1 */
 +    REG_TX_FLOW_CTL        = 0x001C, /* Transmit Flow Control */
 +    REG_TX_DMA_DESC_LIST   = 0x0020, /* Transmit Descriptor List Address */
 +    REG_RX_CTL_0           = 0x0024, /* Receive Control 0 */
 +    REG_RX_CTL_1           = 0x0028, /* Receive Control 1 */
 +    REG_RX_DMA_DESC_LIST   = 0x0034, /* Receive Descriptor List Address */
 +    REG_FRM_FLT            = 0x0038, /* Receive Frame Filter */
 +    REG_RX_HASH_0          = 0x0040, /* Receive Hash Table 0 */
 +    REG_RX_HASH_1          = 0x0044, /* Receive Hash Table 1 */
 +    REG_MII_CMD            = 0x0048, /* Management Interface Command */
 +    REG_MII_DATA           = 0x004C, /* Management Interface Data */
 +    REG_ADDR_HIGH          = 0x0050, /* MAC Address High */
 +    REG_ADDR_LOW           = 0x0054, /* MAC Address Low */
 +    REG_TX_DMA_STA         = 0x00B0, /* Transmit DMA Status */
 +    REG_TX_CUR_DESC        = 0x00B4, /* Transmit Current Descriptor */
 +    REG_TX_CUR_BUF         = 0x00B8, /* Transmit Current Buffer */
 +    REG_RX_DMA_STA         = 0x00C0, /* Receive DMA Status */
 +    REG_RX_CUR_DESC        = 0x00C4, /* Receive Current Descriptor */
 +    REG_RX_CUR_BUF         = 0x00C8, /* Receive Current Buffer */
 +    REG_RGMII_STA          = 0x00D0, /* RGMII Status */
 +};
 +
 +/* EMAC register flags */
 +enum {
 +    BASIC_CTL0_100Mbps     = (0b11 << 2),
 +    BASIC_CTL0_FD          = (1 << 0),
 +    BASIC_CTL1_SOFTRST     = (1 << 0),
 +};
 +
 +enum {
 +    INT_STA_RGMII_LINK     = (1 << 16),
 +    INT_STA_RX_EARLY       = (1 << 13),
 +    INT_STA_RX_OVERFLOW    = (1 << 12),
 +    INT_STA_RX_TIMEOUT     = (1 << 11),
 +    INT_STA_RX_DMA_STOP    = (1 << 10),
 +    INT_STA_RX_BUF_UA      = (1 << 9),
 +    INT_STA_RX             = (1 << 8),
 +    INT_STA_TX_EARLY       = (1 << 5),
 +    INT_STA_TX_UNDERFLOW   = (1 << 4),
 +    INT_STA_TX_TIMEOUT     = (1 << 3),
 +    INT_STA_TX_BUF_UA      = (1 << 2),
 +    INT_STA_TX_DMA_STOP    = (1 << 1),
 +    INT_STA_TX             = (1 << 0),
 +};
 +
 +enum {
 +    INT_EN_RX_EARLY        = (1 << 13),
 +    INT_EN_RX_OVERFLOW     = (1 << 12),
 +    INT_EN_RX_TIMEOUT      = (1 << 11),
 +    INT_EN_RX_DMA_STOP     = (1 << 10),
 +    INT_EN_RX_BUF_UA       = (1 << 9),
 +    INT_EN_RX              = (1 << 8),
 +    INT_EN_TX_EARLY        = (1 << 5),
 +    INT_EN_TX_UNDERFLOW    = (1 << 4),
 +    INT_EN_TX_TIMEOUT      = (1 << 3),
 +    INT_EN_TX_BUF_UA       = (1 << 2),
 +    INT_EN_TX_DMA_STOP     = (1 << 1),
 +    INT_EN_TX              = (1 << 0),
 +};
 +
 +enum {
 +    TX_CTL0_TX_EN          = (1 << 31),
 +    TX_CTL1_TX_DMA_START   = (1 << 31),
 +    TX_CTL1_TX_DMA_EN      = (1 << 30),
 +    TX_CTL1_TX_FLUSH       = (1 << 0),
 +};
 +
 +enum {
 +    RX_CTL0_RX_EN          = (1 << 31),
 +    RX_CTL0_STRIP_FCS      = (1 << 28),
 +    RX_CTL0_CRC_IPV4       = (1 << 27),
 +};
 +
 +enum {
 +    RX_CTL1_RX_DMA_START   = (1 << 31),
 +    RX_CTL1_RX_DMA_EN      = (1 << 30),
 +    RX_CTL1_RX_MD          = (1 << 1),
 +};
 +
 +enum {
 +    RX_FRM_FLT_DIS_ADDR    = (1 << 31),
 +};
 +
 +enum {
 +    MII_CMD_PHY_ADDR_SHIFT = (12),
 +    MII_CMD_PHY_ADDR_MASK  = (0xf000),
 +    MII_CMD_PHY_REG_SHIFT  = (4),
 +    MII_CMD_PHY_REG_MASK   = (0xf0),
 +    MII_CMD_PHY_RW         = (1 << 1),
 +    MII_CMD_PHY_BUSY       = (1 << 0),
 +};
 +
 +enum {
 +    TX_DMA_STA_STOP        = (0b000),
 +    TX_DMA_STA_RUN_FETCH   = (0b001),
 +    TX_DMA_STA_WAIT_STA    = (0b010),
 +};
 +
 +enum {
 +    RX_DMA_STA_STOP        = (0b000),
 +    RX_DMA_STA_RUN_FETCH   = (0b001),
 +    RX_DMA_STA_WAIT_FRM    = (0b011),
 +};
 +
 +/* EMAC register reset values */
 +enum {
 +    REG_BASIC_CTL_1_RST    = 0x08000000,
 +};
 +
 +/* EMAC constants */
 +enum {
 +    AW_SUN8I_EMAC_MIN_PKT_SZ  = 64
 +};
 +
 +/* Transmit/receive frame descriptor */
 +typedef struct FrameDescriptor {
 +    uint32_t status;
 +    uint32_t status2;
 +    uint32_t addr;
 +    uint32_t next;
 +} FrameDescriptor;
 +
 +/* Frame descriptor flags */
 +enum {
 +    DESC_STATUS_CTL                 = (1 << 31),
 +    DESC_STATUS2_BUF_SIZE_MASK      = (0x7ff),
 +};
 +
 +/* Transmit frame descriptor flags */
 +enum {
 +    TX_DESC_STATUS_LENGTH_ERR       = (1 << 14),
 +    TX_DESC_STATUS2_FIRST_DESC      = (1 << 29),
 +    TX_DESC_STATUS2_LAST_DESC       = (1 << 30),
 +    TX_DESC_STATUS2_CHECKSUM_MASK   = (0x3 << 27),
 +};
 +
 +/* Receive frame descriptor flags */
 +enum {
 +    RX_DESC_STATUS_FIRST_DESC       = (1 << 9),
 +    RX_DESC_STATUS_LAST_DESC        = (1 << 8),
 +    RX_DESC_STATUS_FRM_LEN_MASK     = (0x3fff0000),
 +    RX_DESC_STATUS_FRM_LEN_SHIFT    = (16),
 +    RX_DESC_STATUS_NO_BUF           = (1 << 14),
 +    RX_DESC_STATUS_HEADER_ERR       = (1 << 7),
 +    RX_DESC_STATUS_LENGTH_ERR       = (1 << 4),
 +    RX_DESC_STATUS_CRC_ERR          = (1 << 1),
 +    RX_DESC_STATUS_PAYLOAD_ERR      = (1 << 0),
 +    RX_DESC_STATUS2_RX_INT_CTL      = (1 << 31),
 +};
 +
 +/* MII register offsets */
 +enum {
 +    MII_REG_CR                      = (0x0), /* Control */
 +    MII_REG_ST                      = (0x1), /* Status */
 +    MII_REG_ID_HIGH                 = (0x2), /* Identifier High */
 +    MII_REG_ID_LOW                  = (0x3), /* Identifier Low */
 +    MII_REG_ADV                     = (0x4), /* Advertised abilities */
 +    MII_REG_LPA                     = (0x5), /* Link partner abilities */
 +};
 +
 +/* MII register flags */
 +enum {
 +    MII_REG_CR_RESET                = (1 << 15),
 +    MII_REG_CR_POWERDOWN            = (1 << 11),
 +    MII_REG_CR_10Mbit               = (0),
 +    MII_REG_CR_100Mbit              = (1 << 13),
 +    MII_REG_CR_1000Mbit             = (1 << 6),
 +    MII_REG_CR_AUTO_NEG             = (1 << 12),
 +    MII_REG_CR_AUTO_NEG_RESTART     = (1 << 9),
 +    MII_REG_CR_FULLDUPLEX           = (1 << 8),
 +};
 +
 +enum {
 +    MII_REG_ST_100BASE_T4           = (1 << 15),
 +    MII_REG_ST_100BASE_X_FD         = (1 << 14),
 +    MII_REG_ST_100BASE_X_HD         = (1 << 13),
 +    MII_REG_ST_10_FD                = (1 << 12),
 +    MII_REG_ST_10_HD                = (1 << 11),
 +    MII_REG_ST_100BASE_T2_FD        = (1 << 10),
 +    MII_REG_ST_100BASE_T2_HD        = (1 << 9),
 +    MII_REG_ST_AUTONEG_COMPLETE     = (1 << 5),
 +    MII_REG_ST_AUTONEG_AVAIL        = (1 << 3),
 +    MII_REG_ST_LINK_UP              = (1 << 2),
 +};
 +
 +enum {
 +    MII_REG_LPA_10_HD               = (1 << 5),
 +    MII_REG_LPA_10_FD               = (1 << 6),
 +    MII_REG_LPA_100_HD              = (1 << 7),
 +    MII_REG_LPA_100_FD              = (1 << 8),
 +    MII_REG_LPA_PAUSE               = (1 << 10),
 +    MII_REG_LPA_ASYMPAUSE           = (1 << 11),
 +};
 +
 +/* MII constants */
 +enum {
 +    MII_PHY_ID_HIGH                 = 0x0044,
 +    MII_PHY_ID_LOW                  = 0x1400,
 +};
 +
 +static void allwinner_sun8i_emac_mii_set_link(AwSun8iEmacState *s,
 +                                              bool link_active)
 +{
 +    if (link_active) {
 +        s->mii_st |= MII_REG_ST_LINK_UP;
 +    } else {
 +        s->mii_st &= ~MII_REG_ST_LINK_UP;
 +    }
 +}
 +
 +static void allwinner_sun8i_emac_mii_reset(AwSun8iEmacState *s,
 +                                           bool link_active)
 +{
 +    s->mii_cr = MII_REG_CR_100Mbit | MII_REG_CR_AUTO_NEG |
 +                MII_REG_CR_FULLDUPLEX;
 +    s->mii_st = MII_REG_ST_100BASE_T4 | MII_REG_ST_100BASE_X_FD |
 +                MII_REG_ST_100BASE_X_HD | MII_REG_ST_10_FD | MII_REG_ST_10_HD |
 +                MII_REG_ST_100BASE_T2_FD | MII_REG_ST_100BASE_T2_HD |
 +                MII_REG_ST_AUTONEG_COMPLETE | MII_REG_ST_AUTONEG_AVAIL;
 +    s->mii_adv = 0;
 +
 +    allwinner_sun8i_emac_mii_set_link(s, link_active);
 +}
 +
 +static void allwinner_sun8i_emac_mii_cmd(AwSun8iEmacState *s)
 +{
 +    uint8_t addr, reg;
 +
 +    addr = (s->mii_cmd & MII_CMD_PHY_ADDR_MASK) >> MII_CMD_PHY_ADDR_SHIFT;
 +    reg = (s->mii_cmd & MII_CMD_PHY_REG_MASK) >> MII_CMD_PHY_REG_SHIFT;
 +
 +    if (addr != s->mii_phy_addr) {
 +        return;
 +    }
 +
 +    /* Read or write a PHY register? */
 +    if (s->mii_cmd & MII_CMD_PHY_RW) {
 +        trace_allwinner_sun8i_emac_mii_write_reg(reg, s->mii_data);
 +
 +        switch (reg) {
 +        case MII_REG_CR:
 +            if (s->mii_data & MII_REG_CR_RESET) {
 +                allwinner_sun8i_emac_mii_reset(s, s->mii_st &
 +                                                  MII_REG_ST_LINK_UP);
 +            } else {
 +                s->mii_cr = s->mii_data & ~(MII_REG_CR_RESET |
 +                                            MII_REG_CR_AUTO_NEG_RESTART);
 +            }
 +            break;
 +        case MII_REG_ADV:
 +            s->mii_adv = s->mii_data;
 +            break;
 +        case MII_REG_ID_HIGH:
 +        case MII_REG_ID_LOW:
 +        case MII_REG_LPA:
 +            break;
 +        default:
 +            qemu_log_mask(LOG_UNIMP, "allwinner-h3-emac: write access to "
 +                                     "unknown MII register 0x%x\n", reg);
 +            break;
 +        }
 +    } else {
 +        switch (reg) {
 +        case MII_REG_CR:
 +            s->mii_data = s->mii_cr;
 +            break;
 +        case MII_REG_ST:
 +            s->mii_data = s->mii_st;
 +            break;
 +        case MII_REG_ID_HIGH:
 +            s->mii_data = MII_PHY_ID_HIGH;
 +            break;
 +        case MII_REG_ID_LOW:
 +            s->mii_data = MII_PHY_ID_LOW;
 +            break;
 +        case MII_REG_ADV:
 +            s->mii_data = s->mii_adv;
 +            break;
 +        case MII_REG_LPA:
 +            s->mii_data = MII_REG_LPA_10_HD | MII_REG_LPA_10_FD |
 +                          MII_REG_LPA_100_HD | MII_REG_LPA_100_FD |
 +                          MII_REG_LPA_PAUSE | MII_REG_LPA_ASYMPAUSE;
 +            break;
 +        default:
 +            qemu_log_mask(LOG_UNIMP, "allwinner-h3-emac: read access to "
 +                                     "unknown MII register 0x%x\n", reg);
 +            s->mii_data = 0;
 +            break;
 +        }
 +
 +        trace_allwinner_sun8i_emac_mii_read_reg(reg, s->mii_data);
 +    }
 +}
 +
 +static void allwinner_sun8i_emac_update_irq(AwSun8iEmacState *s)
 +{
 +    qemu_set_irq(s->irq, (s->int_sta & s->int_en) != 0);
 +}
 +
 +static uint32_t allwinner_sun8i_emac_next_desc(FrameDescriptor *desc,
 +                                               size_t min_size)
 +{
 +    uint32_t paddr = desc->next;
 +
 +    cpu_physical_memory_read(paddr, desc, sizeof(*desc));
 +
 +    if ((desc->status & DESC_STATUS_CTL) &&
 +        (desc->status2 & DESC_STATUS2_BUF_SIZE_MASK) >= min_size) {
 +        return paddr;
 +    } else {
 +        return 0;
 +    }
 +}
 +
 +static uint32_t allwinner_sun8i_emac_get_desc(FrameDescriptor *desc,
 +                                              uint32_t start_addr,
 +                                              size_t min_size)
 +{
 +    uint32_t desc_addr = start_addr;
 +
 +    /* Note that the list is a cycle. Last entry points back to the head. */
 +    while (desc_addr != 0) {
 +        cpu_physical_memory_read(desc_addr, desc, sizeof(*desc));
 +
 +        if ((desc->status & DESC_STATUS_CTL) &&
 +            (desc->status2 & DESC_STATUS2_BUF_SIZE_MASK) >= min_size) {
 +            return desc_addr;
 +        } else if (desc->next == start_addr) {
 +            break;
 +        } else {
 +            desc_addr = desc->next;
 +        }
 +    }
 +
 +    return 0;
 +}
 +
-+static uint32_t featurefile_writefn(ARMCPU *cpu, GuestFD *gf,
++static uint32_t allwinner_sun8i_emac_rx_desc(AwSun8iEmacState *s,
-+                                    target_ulong buf, uint32_t len)
++                                             FrameDescriptor *desc,
-+{
++                                             size_t min_size)
-+    /* This fd can never be open for writing */
++{
-+    CPUARMState *env = &cpu->env;
++    return allwinner_sun8i_emac_get_desc(desc, s->rx_desc_curr, min_size);
-+
++}
-+    errno = EBADF;
++
-+    return set_swi_errno(env, -1);
++static uint32_t allwinner_sun8i_emac_tx_desc(AwSun8iEmacState *s,
-+}
++                                             FrameDescriptor *desc,
-+
++                                             size_t min_size)
-+static uint32_t featurefile_readfn(ARMCPU *cpu, GuestFD *gf,
++{
-+                                   target_ulong buf, uint32_t len)
++    return allwinner_sun8i_emac_get_desc(desc, s->tx_desc_head, min_size);
-+{
++}
-+    uint32_t i;
++
-+#ifndef CONFIG_USER_ONLY
++static void allwinner_sun8i_emac_flush_desc(FrameDescriptor *desc,
-+    CPUARMState *env = &cpu->env;
++                                            uint32_t phys_addr)
-+#endif
++{
-+    char *s;
++    cpu_physical_memory_write(phys_addr, desc, sizeof(*desc));
-+
++}
-+    s = lock_user(VERIFY_WRITE, buf, len, 0);
++
-+    if (!s) {
++static int allwinner_sun8i_emac_can_receive(NetClientState *nc)
-+        return len;
++{
-+    }
++    AwSun8iEmacState *s = qemu_get_nic_opaque(nc);
-+
++    FrameDescriptor desc;
-+    for (i = 0; i < len; i++) {
++
-+        if (gf->featurefile_offset >= sizeof(featurefile_data)) {
++    return (s->rx_ctl0 & RX_CTL0_RX_EN) &&
-+            break;
++           (allwinner_sun8i_emac_rx_desc(s, &desc, 0) != 0);
-+        }
++}
-+        s[i] = featurefile_data[gf->featurefile_offset];
++
-+        gf->featurefile_offset++;
++static ssize_t allwinner_sun8i_emac_receive(NetClientState *nc,
-+    }
++                                            const uint8_t *buf,
-+
++                                            size_t size)
-+    unlock_user(s, buf, len);
++{
-+
++    AwSun8iEmacState *s = qemu_get_nic_opaque(nc);
-+    /* Return number of bytes not read */
++    FrameDescriptor desc;
-+    return len - i;
++    size_t bytes_left = size;
-+}
++    size_t desc_bytes = 0;
-+
++    size_t pad_fcs_size = 4;
-+static uint32_t featurefile_isattyfn(ARMCPU *cpu, GuestFD *gf)
++    size_t padding = 0;
-+{
++
 +    if (!(s->rx_ctl0 & RX_CTL0_RX_EN)) {
 +        return -1;
 +    }
 +
 +    s->rx_desc_curr = allwinner_sun8i_emac_rx_desc(s, &desc,
 +                                                   AW_SUN8I_EMAC_MIN_PKT_SZ);
 +    if (!s->rx_desc_curr) {
 +        s->int_sta |= INT_STA_RX_BUF_UA;
 +    }
 +
 +    /* Keep filling RX descriptors until the whole frame is written */
 +    while (s->rx_desc_curr && bytes_left > 0) {
 +        desc.status &= ~DESC_STATUS_CTL;
 +        desc.status &= ~RX_DESC_STATUS_FRM_LEN_MASK;
 +
 +        if (bytes_left == size) {
 +            desc.status |= RX_DESC_STATUS_FIRST_DESC;
 +        }
 +
 +        if ((desc.status2 & DESC_STATUS2_BUF_SIZE_MASK) <
 +            (bytes_left + pad_fcs_size)) {
 +            desc_bytes = desc.status2 & DESC_STATUS2_BUF_SIZE_MASK;
 +            desc.status |= desc_bytes << RX_DESC_STATUS_FRM_LEN_SHIFT;
 +        } else {
 +            padding = pad_fcs_size;
 +            if (bytes_left < AW_SUN8I_EMAC_MIN_PKT_SZ) {
 +                padding += (AW_SUN8I_EMAC_MIN_PKT_SZ - bytes_left);
 +            }
 +
 +            desc_bytes = (bytes_left);
 +            desc.status |= RX_DESC_STATUS_LAST_DESC;
 +            desc.status |= (bytes_left + padding)
 +                            << RX_DESC_STATUS_FRM_LEN_SHIFT;
 +        }
 +
 +        cpu_physical_memory_write(desc.addr, buf, desc_bytes);
 +        allwinner_sun8i_emac_flush_desc(&desc, s->rx_desc_curr);
 +        trace_allwinner_sun8i_emac_receive(s->rx_desc_curr, desc.addr,
 +                                           desc_bytes);
 +
 +        /* Check if frame needs to raise the receive interrupt */
 +        if (!(desc.status2 & RX_DESC_STATUS2_RX_INT_CTL)) {
 +            s->int_sta |= INT_STA_RX;
 +        }
 +
 +        /* Increment variables */
 +        buf += desc_bytes;
 +        bytes_left -= desc_bytes;
 +
 +        /* Move to the next descriptor */
 +        s->rx_desc_curr = allwinner_sun8i_emac_next_desc(&desc, 64);
 +        if (!s->rx_desc_curr) {
 +            /* Not enough buffer space available */
 +            s->int_sta |= INT_STA_RX_BUF_UA;
 +            s->rx_desc_curr = s->rx_desc_head;
 +            break;
 +        }
 +    }
 +
 +    /* Report receive DMA is finished */
 +    s->rx_ctl1 &= ~RX_CTL1_RX_DMA_START;
 +    allwinner_sun8i_emac_update_irq(s);
 +
 +    return size;
 +}
 +
 +static void allwinner_sun8i_emac_transmit(AwSun8iEmacState *s)
 +{
 +    NetClientState *nc = qemu_get_queue(s->nic);
 +    FrameDescriptor desc;
 +    size_t bytes = 0;
 +    size_t packet_bytes = 0;
 +    size_t transmitted = 0;
 +    static uint8_t packet_buf[2048];
 +
 +    s->tx_desc_curr = allwinner_sun8i_emac_tx_desc(s, &desc, 0);
 +
 +    /* Read all transmit descriptors */
 +    while (s->tx_desc_curr != 0) {
 +
 +        /* Read from physical memory into packet buffer */
 +        bytes = desc.status2 & DESC_STATUS2_BUF_SIZE_MASK;
 +        if (bytes + packet_bytes > sizeof(packet_buf)) {
 +            desc.status |= TX_DESC_STATUS_LENGTH_ERR;
 +            break;
 +        }
 +        cpu_physical_memory_read(desc.addr, packet_buf + packet_bytes, bytes);
 +        packet_bytes += bytes;
 +        desc.status &= ~DESC_STATUS_CTL;
 +        allwinner_sun8i_emac_flush_desc(&desc, s->tx_desc_curr);
 +
 +        /* After the last descriptor, send the packet */
 +        if (desc.status2 & TX_DESC_STATUS2_LAST_DESC) {
 +            if (desc.status2 & TX_DESC_STATUS2_CHECKSUM_MASK) {
 +                net_checksum_calculate(packet_buf, packet_bytes);
 +            }
 +
 +            qemu_send_packet(nc, packet_buf, packet_bytes);
 +            trace_allwinner_sun8i_emac_transmit(s->tx_desc_curr, desc.addr,
 +                                                bytes);
 +
 +            packet_bytes = 0;
 +            transmitted++;
 +        }
 +        s->tx_desc_curr = allwinner_sun8i_emac_next_desc(&desc, 0);
 +    }
 +
 +    /* Raise transmit completed interrupt */
 +    if (transmitted > 0) {
 +        s->int_sta |= INT_STA_TX;
 +        s->tx_ctl1 &= ~TX_CTL1_TX_DMA_START;
 +        allwinner_sun8i_emac_update_irq(s);
 +    }
 +}
 +
 +static void allwinner_sun8i_emac_reset(DeviceState *dev)
 +{
 +    AwSun8iEmacState *s = AW_SUN8I_EMAC(dev);
 +    NetClientState *nc = qemu_get_queue(s->nic);
 +
 +    trace_allwinner_sun8i_emac_reset();
 +
 +    s->mii_cmd = 0;
 +    s->mii_data = 0;
 +    s->basic_ctl0 = 0;
 +    s->basic_ctl1 = REG_BASIC_CTL_1_RST;
 +    s->int_en = 0;
 +    s->int_sta = 0;
 +    s->frm_flt = 0;
 +    s->rx_ctl0 = 0;
 +    s->rx_ctl1 = RX_CTL1_RX_MD;
 +    s->rx_desc_head = 0;
 +    s->rx_desc_curr = 0;
 +    s->tx_ctl0 = 0;
 +    s->tx_ctl1 = 0;
 +    s->tx_desc_head = 0;
 +    s->tx_desc_curr = 0;
 +    s->tx_flowctl = 0;
 +
 +    allwinner_sun8i_emac_mii_reset(s, !nc->link_down);
 +}
 +
 +static uint64_t allwinner_sun8i_emac_read(void *opaque, hwaddr offset,
 +                                          unsigned size)
 +{
 +    AwSun8iEmacState *s = AW_SUN8I_EMAC(opaque);
 +    uint64_t value = 0;
 +    FrameDescriptor desc;
 +
 +    switch (offset) {
 +    case REG_BASIC_CTL_0:       /* Basic Control 0 */
 +        value = s->basic_ctl0;
 +        break;
 +    case REG_BASIC_CTL_1:       /* Basic Control 1 */
 +        value = s->basic_ctl1;
 +        break;
 +    case REG_INT_STA:           /* Interrupt Status */
 +        value = s->int_sta;
 +        break;
 +    case REG_INT_EN:            /* Interupt Enable */
 +        value = s->int_en;
 +        break;
 +    case REG_TX_CTL_0:          /* Transmit Control 0 */
 +        value = s->tx_ctl0;
 +        break;
 +    case REG_TX_CTL_1:          /* Transmit Control 1 */
 +        value = s->tx_ctl1;
 +        break;
 +    case REG_TX_FLOW_CTL:       /* Transmit Flow Control */
 +        value = s->tx_flowctl;
 +        break;
 +    case REG_TX_DMA_DESC_LIST:  /* Transmit Descriptor List Address */
 +        value = s->tx_desc_head;
 +        break;
 +    case REG_RX_CTL_0:          /* Receive Control 0 */
 +        value = s->rx_ctl0;
 +        break;
 +    case REG_RX_CTL_1:          /* Receive Control 1 */
 +        value = s->rx_ctl1;
 +        break;
 +    case REG_RX_DMA_DESC_LIST:  /* Receive Descriptor List Address */
 +        value = s->rx_desc_head;
 +        break;
 +    case REG_FRM_FLT:           /* Receive Frame Filter */
 +        value = s->frm_flt;
 +        break;
 +    case REG_RX_HASH_0:         /* Receive Hash Table 0 */
 +    case REG_RX_HASH_1:         /* Receive Hash Table 1 */
 +        break;
 +    case REG_MII_CMD:           /* Management Interface Command */
 +        value = s->mii_cmd;
 +        break;
 +    case REG_MII_DATA:          /* Management Interface Data */
 +        value = s->mii_data;
 +        break;
 +    case REG_ADDR_HIGH:         /* MAC Address High */
 +        value = *(((uint32_t *) (s->conf.macaddr.a)) + 1);
 +        break;
 +    case REG_ADDR_LOW:          /* MAC Address Low */
 +        value = *(uint32_t *) (s->conf.macaddr.a);
 +        break;
 +    case REG_TX_DMA_STA:        /* Transmit DMA Status */
 +        break;
 +    case REG_TX_CUR_DESC:       /* Transmit Current Descriptor */
 +        value = s->tx_desc_curr;
 +        break;
 +    case REG_TX_CUR_BUF:        /* Transmit Current Buffer */
 +        if (s->tx_desc_curr != 0) {
 +            cpu_physical_memory_read(s->tx_desc_curr, &desc, sizeof(desc));
 +            value = desc.addr;
 +        } else {
 +            value = 0;
 +        }
 +        break;
 +    case REG_RX_DMA_STA:        /* Receive DMA Status */
 +        break;
 +    case REG_RX_CUR_DESC:       /* Receive Current Descriptor */
 +        value = s->rx_desc_curr;
 +        break;
 +    case REG_RX_CUR_BUF:        /* Receive Current Buffer */
 +        if (s->rx_desc_curr != 0) {
 +            cpu_physical_memory_read(s->rx_desc_curr, &desc, sizeof(desc));
 +            value = desc.addr;
 +        } else {
 +            value = 0;
 +        }
 +        break;
 +    case REG_RGMII_STA:         /* RGMII Status */
 +        break;
 +    default:
 +        qemu_log_mask(LOG_UNIMP, "allwinner-h3-emac: read access to unknown "
 +                                 "EMAC register 0x" TARGET_FMT_plx "\n",
 +                                  offset);
 +    }
 +
 +    trace_allwinner_sun8i_emac_read(offset, value);
 +    return value;
 +}
 +
 +static void allwinner_sun8i_emac_write(void *opaque, hwaddr offset,
 +                                       uint64_t value, unsigned size)
 +{
 +    AwSun8iEmacState *s = AW_SUN8I_EMAC(opaque);
 +    NetClientState *nc = qemu_get_queue(s->nic);
 +
 +    trace_allwinner_sun8i_emac_write(offset, value);
 +
 +    switch (offset) {
 +    case REG_BASIC_CTL_0:       /* Basic Control 0 */
 +        s->basic_ctl0 = value;
 +        break;
 +    case REG_BASIC_CTL_1:       /* Basic Control 1 */
 +        if (value & BASIC_CTL1_SOFTRST) {
 +            allwinner_sun8i_emac_reset(DEVICE(s));
 +            value &= ~BASIC_CTL1_SOFTRST;
 +        }
 +        s->basic_ctl1 = value;
 +        if (allwinner_sun8i_emac_can_receive(nc)) {
 +            qemu_flush_queued_packets(nc);
 +        }
 +        break;
 +    case REG_INT_STA:           /* Interrupt Status */
 +        s->int_sta &= ~value;
 +        allwinner_sun8i_emac_update_irq(s);
 +        break;
 +    case REG_INT_EN:            /* Interrupt Enable */
 +        s->int_en = value;
 +        allwinner_sun8i_emac_update_irq(s);
 +        break;
 +    case REG_TX_CTL_0:          /* Transmit Control 0 */
 +        s->tx_ctl0 = value;
 +        break;
 +    case REG_TX_CTL_1:          /* Transmit Control 1 */
 +        s->tx_ctl1 = value;
 +        if (value & TX_CTL1_TX_DMA_EN) {
 +            allwinner_sun8i_emac_transmit(s);
 +        }
 +        break;
 +    case REG_TX_FLOW_CTL:       /* Transmit Flow Control */
 +        s->tx_flowctl = value;
 +        break;
 +    case REG_TX_DMA_DESC_LIST:  /* Transmit Descriptor List Address */
 +        s->tx_desc_head = value;
 +        s->tx_desc_curr = value;
 +        break;
 +    case REG_RX_CTL_0:          /* Receive Control 0 */
 +        s->rx_ctl0 = value;
 +        break;
 +    case REG_RX_CTL_1:          /* Receive Control 1 */
 +        s->rx_ctl1 = value | RX_CTL1_RX_MD;
 +        if ((value & RX_CTL1_RX_DMA_EN) &&
 +             allwinner_sun8i_emac_can_receive(nc)) {
 +            qemu_flush_queued_packets(nc);
 +        }
 +        break;
 +    case REG_RX_DMA_DESC_LIST:  /* Receive Descriptor List Address */
 +        s->rx_desc_head = value;
 +        s->rx_desc_curr = value;
 +        break;
 +    case REG_FRM_FLT:           /* Receive Frame Filter */
 +        s->frm_flt = value;
 +        break;
 +    case REG_RX_HASH_0:         /* Receive Hash Table 0 */
 +    case REG_RX_HASH_1:         /* Receive Hash Table 1 */
 +        break;
 +    case REG_MII_CMD:           /* Management Interface Command */
 +        s->mii_cmd = value & ~MII_CMD_PHY_BUSY;
 +        allwinner_sun8i_emac_mii_cmd(s);
 +        break;
 +    case REG_MII_DATA:          /* Management Interface Data */
 +        s->mii_data = value;
 +        break;
 +    case REG_ADDR_HIGH:         /* MAC Address High */
 +        s->conf.macaddr.a[4] = (value & 0xff);
 +        s->conf.macaddr.a[5] = (value & 0xff00) >> 8;
 +        break;
 +    case REG_ADDR_LOW:          /* MAC Address Low */
 +        s->conf.macaddr.a[0] = (value & 0xff);
 +        s->conf.macaddr.a[1] = (value & 0xff00) >> 8;
 +        s->conf.macaddr.a[2] = (value & 0xff0000) >> 16;
 +        s->conf.macaddr.a[3] = (value & 0xff000000) >> 24;
 +        break;
 +    case REG_TX_DMA_STA:        /* Transmit DMA Status */
 +    case REG_TX_CUR_DESC:       /* Transmit Current Descriptor */
 +    case REG_TX_CUR_BUF:        /* Transmit Current Buffer */
 +    case REG_RX_DMA_STA:        /* Receive DMA Status */
 +    case REG_RX_CUR_DESC:       /* Receive Current Descriptor */
 +    case REG_RX_CUR_BUF:        /* Receive Current Buffer */
 +    case REG_RGMII_STA:         /* RGMII Status */
 +        break;
 +    default:
 +        qemu_log_mask(LOG_UNIMP, "allwinner-h3-emac: write access to unknown "
 +                                 "EMAC register 0x" TARGET_FMT_plx "\n",
 +                                  offset);
 +    }
 +}
 +
 +static void allwinner_sun8i_emac_set_link(NetClientState *nc)
 +{
 +    AwSun8iEmacState *s = qemu_get_nic_opaque(nc);
 +
 +    trace_allwinner_sun8i_emac_set_link(!nc->link_down);
 +    allwinner_sun8i_emac_mii_set_link(s, !nc->link_down);
 +}
 +
 +static const MemoryRegionOps allwinner_sun8i_emac_mem_ops = {
 +    .read = allwinner_sun8i_emac_read,
 +    .write = allwinner_sun8i_emac_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +    .impl.min_access_size = 4,
 +};
 +
 +static NetClientInfo net_allwinner_sun8i_emac_info = {
 +    .type = NET_CLIENT_DRIVER_NIC,
 +    .size = sizeof(NICState),
 +    .can_receive = allwinner_sun8i_emac_can_receive,
 +    .receive = allwinner_sun8i_emac_receive,
 +    .link_status_changed = allwinner_sun8i_emac_set_link,
 +};
 +
 +static void allwinner_sun8i_emac_init(Object *obj)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    AwSun8iEmacState *s = AW_SUN8I_EMAC(obj);
 +
 +    memory_region_init_io(&s->iomem, OBJECT(s), &allwinner_sun8i_emac_mem_ops,
 +                           s, TYPE_AW_SUN8I_EMAC, 64 * KiB);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    sysbus_init_irq(sbd, &s->irq);
 +}
 +
 +static void allwinner_sun8i_emac_realize(DeviceState *dev, Error **errp)
 +{
 +    AwSun8iEmacState *s = AW_SUN8I_EMAC(dev);
 +
 +    qemu_macaddr_default_if_unset(&s->conf.macaddr);
 +    s->nic = qemu_new_nic(&net_allwinner_sun8i_emac_info, &s->conf,
 +                           object_get_typename(OBJECT(dev)), dev->id, s);
 +    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 +}
 +
 +static Property allwinner_sun8i_emac_properties[] = {
 +    DEFINE_NIC_PROPERTIES(AwSun8iEmacState, conf),
 +    DEFINE_PROP_UINT8("phy-addr", AwSun8iEmacState, mii_phy_addr, 0),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static int allwinner_sun8i_emac_post_load(void *opaque, int version_id)
 +{
 +    AwSun8iEmacState *s = opaque;
 +
 +    allwinner_sun8i_emac_set_link(qemu_get_queue(s->nic));
 +
 +    return 0;
 +}
 +
-+static uint32_t featurefile_seekfn(ARMCPU *cpu, GuestFD *gf,
++static const VMStateDescription vmstate_aw_emac = {
-+                                   target_ulong offset)
++    .name = "allwinner-sun8i-emac",
-+{
++    .version_id = 1,
-+    gf->featurefile_offset = offset;
++    .minimum_version_id = 1,
-+    return 0;
++    .post_load = allwinner_sun8i_emac_post_load,
-+}
++    .fields = (VMStateField[]) {
-+
++        VMSTATE_UINT8(mii_phy_addr, AwSun8iEmacState),
-+static uint32_t featurefile_flenfn(ARMCPU *cpu, GuestFD *gf)
++        VMSTATE_UINT32(mii_cmd, AwSun8iEmacState),
-+{
++        VMSTATE_UINT32(mii_data, AwSun8iEmacState),
-+    return sizeof(featurefile_data);
++        VMSTATE_UINT32(mii_cr, AwSun8iEmacState),
-+}
++        VMSTATE_UINT32(mii_st, AwSun8iEmacState),
-+
++        VMSTATE_UINT32(mii_adv, AwSun8iEmacState),
- typedef struct GuestFDFunctions {
++        VMSTATE_UINT32(basic_ctl0, AwSun8iEmacState),
-     sys_closefn *closefn;
++        VMSTATE_UINT32(basic_ctl1, AwSun8iEmacState),
-     sys_writefn *writefn;
++        VMSTATE_UINT32(int_en, AwSun8iEmacState),
-@@ -XXX,XX +XXX,XX @@ static const GuestFDFunctions guestfd_fns[] = {
++        VMSTATE_UINT32(int_sta, AwSun8iEmacState),
-         .seekfn = gdb_seekfn,
++        VMSTATE_UINT32(frm_flt, AwSun8iEmacState),
-         .flenfn = gdb_flenfn,
++        VMSTATE_UINT32(rx_ctl0, AwSun8iEmacState),
-     },
++        VMSTATE_UINT32(rx_ctl1, AwSun8iEmacState),
-+    [GuestFDFeatureFile] = {
++        VMSTATE_UINT32(rx_desc_head, AwSun8iEmacState),
-+        .closefn = featurefile_closefn,
++        VMSTATE_UINT32(rx_desc_curr, AwSun8iEmacState),
-+        .writefn = featurefile_writefn,
++        VMSTATE_UINT32(tx_ctl0, AwSun8iEmacState),
-+        .readfn = featurefile_readfn,
++        VMSTATE_UINT32(tx_ctl1, AwSun8iEmacState),
-+        .isattyfn = featurefile_isattyfn,
++        VMSTATE_UINT32(tx_desc_head, AwSun8iEmacState),
-+        .seekfn = featurefile_seekfn,
++        VMSTATE_UINT32(tx_desc_curr, AwSun8iEmacState),
-+        .flenfn = featurefile_flenfn,
++        VMSTATE_UINT32(tx_flowctl, AwSun8iEmacState),
-+    },
++        VMSTATE_END_OF_LIST()
- };
++    }
++};
- /* Read the input value from the argument block; fail the semihosting
++
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
++static void allwinner_sun8i_emac_class_init(ObjectClass *klass, void *data)
-             unlock_user(s, arg0, 0);
++{
-             return guestfd;
++    DeviceClass *dc = DEVICE_CLASS(klass);
-         }
++
-+        if (strcmp(s, ":semihosting-features") == 0) {
++    dc->realize = allwinner_sun8i_emac_realize;
-+            unlock_user(s, arg0, 0);
++    dc->reset = allwinner_sun8i_emac_reset;
-+            /* We must fail opens for modes other than 0 ('r') or 1 ('rb') */
++    dc->vmsd = &vmstate_aw_emac;
-+            if (arg1 != 0 && arg1 != 1) {
++    device_class_set_props(dc, allwinner_sun8i_emac_properties);
-+                dealloc_guestfd(guestfd);
++}
-+                errno = EACCES;
++
-+                return set_swi_errno(env, -1);
++static const TypeInfo allwinner_sun8i_emac_info = {
-+            }
++    .name           = TYPE_AW_SUN8I_EMAC,
-+            init_featurefile_guestfd(guestfd);
++    .parent         = TYPE_SYS_BUS_DEVICE,
-+            return guestfd;
++    .instance_size  = sizeof(AwSun8iEmacState),
-+        }
++    .instance_init  = allwinner_sun8i_emac_init,
-+
++    .class_init     = allwinner_sun8i_emac_class_init,
-         if (use_gdb_syscalls()) {
++};
-             arm_semi_open_guestfd = guestfd;
++
-             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
++static void allwinner_sun8i_emac_register_types(void)
 +{
 +    type_register_static(&allwinner_sun8i_emac_info);
 +}
 +
 +type_init(allwinner_sun8i_emac_register_types)
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
  config ALLWINNER_H3
      bool
      select ALLWINNER_A10_PIT
 +    select ALLWINNER_SUN8I_EMAC
      select SERIAL
      select ARM_TIMER
      select ARM_GIC
 diff --git a/hw/net/Kconfig b/hw/net/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/Kconfig
 +++ b/hw/net/Kconfig
@@ -XXX,XX +XXX,XX @@ config MIPSNET
  config ALLWINNER_EMAC
      bool
 +config ALLWINNER_SUN8I_EMAC
 +    bool
 +
  config IMX_FEC
      bool
 diff --git a/hw/net/trace-events b/hw/net/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/trace-events
 +++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@
  # See docs/devel/tracing.txt for syntax documentation.
 +# allwinner-sun8i-emac.c
 +allwinner_sun8i_emac_mii_write_reg(uint32_t reg, uint32_t value) "MII write: reg=0x%" PRIx32 " value=0x%" PRIx32
 +allwinner_sun8i_emac_mii_read_reg(uint32_t reg, uint32_t value) "MII read: reg=0x%" PRIx32 " value=0x%" PRIx32
 +allwinner_sun8i_emac_receive(uint32_t desc, uint32_t paddr, uint32_t bytes) "RX packet: desc=0x%" PRIx32 " paddr=0x%" PRIx32 " bytes=%" PRIu32
 +allwinner_sun8i_emac_transmit(uint32_t desc, uint32_t paddr, uint32_t bytes) "TX packet: desc=0x%" PRIx32 " paddr=0x%" PRIx32 " bytes=%" PRIu32
 +allwinner_sun8i_emac_reset(void) "HW reset"
 +allwinner_sun8i_emac_set_link(bool active) "Set link: active=%u"
 +allwinner_sun8i_emac_read(uint64_t offset, uint64_t val) "MMIO read: offset=0x%" PRIx64 " value=0x%" PRIx64
 +allwinner_sun8i_emac_write(uint64_t offset, uint64_t val) "MMIO write: offset=0x%" PRIx64 " value=0x%" PRIx64
 +
  # etraxfs_eth.c
  mdio_phy_read(int regnum, uint16_t value) "read phy_reg:%d value:0x%04x"
  mdio_phy_write(int regnum, uint16_t value) "write phy_reg:%d value:0x%04x"
 --
 .20.1

-[PULL 53/68] hw/gpio: Add in AST2600 specific implementation
+[PULL 21/36] hw/arm/allwinner-h3: add Boot ROM support
-From: Rashmica Gupta <rashmica.g@gmail.com>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-The AST2600 has the same sets of 3.6v gpios as the AST2400 plus an
+A real Allwinner H3 SoC contains a Boot ROM which is the
-addtional two sets of 1.8V gpios.
+first code that runs right after the SoC is powered on.
 The Boot ROM is responsible for loading user code (e.g. a bootloader)
 from any of the supported external devices and writing the downloaded
 code to internal SRAM. After loading the SoC begins executing the code
 written to SRAM.
-Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
+This commits adds emulation of the Boot ROM firmware setup functionality
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+by loading user code from SD card in the A1 SRAM. While the A1 SRAM is
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+KiB, we limit the size to 32KiB because the real H3 Boot ROM also rejects
-Acked-by: Joel Stanley <joel@jms.id.au>
+sizes larger than 32KiB. For reference, this behaviour is documented
-Message-id: 20190925143248.10000-15-clg@kaod.org
+by the Linux Sunxi project wiki at:
   https://linux-sunxi.org/BROM#U-Boot_SPL_limitations
 Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20200311221854.30370-11-nieklinnenbank@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/gpio/aspeed_gpio.c | 142 ++++++++++++++++++++++++++++++++++++++++--
+ include/hw/arm/allwinner-h3.h | 21 +++++++++++++++++++++
-file changed, 137 insertions(+), 5 deletions(-)
+ hw/arm/allwinner-h3.c         | 17 +++++++++++++++++
  hw/arm/orangepi.c             |  5 +++++
 files changed, 43 insertions(+)
-diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
+diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/gpio/aspeed_gpio.c
+--- a/include/hw/arm/allwinner-h3.h
-+++ b/hw/gpio/aspeed_gpio.c
++++ b/include/hw/arm/allwinner-h3.h
 @@ -XXX,XX +XXX,XX @@
- #define GPIO_3_6V_MEM_SIZE         0x1F0
+ #include "hw/sd/allwinner-sdhost.h"
- #define GPIO_3_6V_REG_ARRAY_SIZE   (GPIO_3_6V_MEM_SIZE >> 2)
+ #include "hw/net/allwinner-sun8i-emac.h"
+ #include "target/arm/cpu.h"
-+/* AST2600 only - 1.8V gpios */
++#include "sysemu/block-backend.h"
-+/*
-+ * The AST2600 has same 3.6V gpios as the AST2400 (memory offsets 0x0-0x198)
+ /**
-+ * and addtional 1.8V gpios (memory offsets 0x800-0x9D4).
+  * Allwinner H3 device list
@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
      MemoryRegion sram_c;
  } AwH3State;
 +/**
 + * Emulate Boot ROM firmware setup functionality.
 + *
 + * A real Allwinner H3 SoC contains a Boot ROM
 + * which is the first code that runs right after
 + * the SoC is powered on. The Boot ROM is responsible
 + * for loading user code (e.g. a bootloader) from any
 + * of the supported external devices and writing the
 + * downloaded code to internal SRAM. After loading the SoC
 + * begins executing the code written to SRAM.
 + *
 + * This function emulates the Boot ROM by copying 32 KiB
 + * of data from the given block device and writes it to
 + * the start of the first internal SRAM memory.
 + *
 + * @s: Allwinner H3 state object pointer
 + * @blk: Block backend device object pointer
 + */
-+#define GPIO_1_8V_REG_OFFSET          0x800
++void allwinner_h3_bootrom_setup(AwH3State *s, BlockBackend *blk);
 +#define GPIO_1_8V_ABCD_DATA_VALUE     ((0x800 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_DIRECTION      ((0x804 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_INT_ENABLE     ((0x808 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_INT_SENS_0     ((0x80C - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_INT_SENS_1     ((0x810 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_INT_SENS_2     ((0x814 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_INT_STATUS     ((0x818 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_RESET_TOLERANT ((0x81C - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_DATA_VALUE        ((0x820 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_DIRECTION         ((0x824 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_INT_ENABLE        ((0x828 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_INT_SENS_0        ((0x82C - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_INT_SENS_1        ((0x830 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_INT_SENS_2        ((0x834 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_INT_STATUS        ((0x838 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_RESET_TOLERANT    ((0x83C - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_DEBOUNCE_1     ((0x840 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_DEBOUNCE_2     ((0x844 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_DEBOUNCE_1        ((0x848 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_DEBOUNCE_2        ((0x84C - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_DEBOUNCE_TIME_1     ((0x850 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_DEBOUNCE_TIME_2     ((0x854 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_DEBOUNCE_TIME_3     ((0x858 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_COMMAND_SRC_0  ((0x860 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_COMMAND_SRC_1  ((0x864 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_COMMAND_SRC_0     ((0x868 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_COMMAND_SRC_1     ((0x86C - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_DATA_READ      ((0x8C0 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_DATA_READ         ((0x8C4 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_ABCD_INPUT_MASK     ((0x9D0 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_E_INPUT_MASK        ((0x9D4 - GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_1_8V_MEM_SIZE            0x9D8
 +#define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
 +                                      GPIO_1_8V_REG_OFFSET) >> 2)
 +#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
 +
- static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
+ #endif /* HW_ARM_ALLWINNER_H3_H */
- {
+diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
-     uint32_t falling_edge = 0, rising_edge = 0;
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static const AspeedGPIOReg aspeed_3_6v_gpios[GPIO_3_6V_REG_ARRAY_SIZE] = {
+--- a/hw/arm/allwinner-h3.c
-     [GPIO_AC_INPUT_MASK] =         { 7, gpio_reg_input_mask },
++++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/char/serial.h"
  #include "hw/misc/unimp.h"
  #include "hw/usb/hcd-ehci.h"
 +#include "hw/loader.h"
  #include "sysemu/sysemu.h"
  #include "hw/arm/allwinner-h3.h"
@@ -XXX,XX +XXX,XX @@ enum {
      AW_H3_GIC_NUM_SPI       = 128
  };
-+static const AspeedGPIOReg aspeed_1_8v_gpios[GPIO_1_8V_REG_ARRAY_SIZE] = {
++void allwinner_h3_bootrom_setup(AwH3State *s, BlockBackend *blk)
-+    /* 1.8V Set ABCD */
++{
-+    [GPIO_1_8V_ABCD_DATA_VALUE] =     {0, gpio_reg_data_value},
++    const int64_t rom_size = 32 * KiB;
-+    [GPIO_1_8V_ABCD_DIRECTION] =      {0, gpio_reg_direction},
++    g_autofree uint8_t *buffer = g_new0(uint8_t, rom_size);
 +    [GPIO_1_8V_ABCD_INT_ENABLE] =     {0, gpio_reg_int_enable},
 +    [GPIO_1_8V_ABCD_INT_SENS_0] =     {0, gpio_reg_int_sens_0},
 +    [GPIO_1_8V_ABCD_INT_SENS_1] =     {0, gpio_reg_int_sens_1},
 +    [GPIO_1_8V_ABCD_INT_SENS_2] =     {0, gpio_reg_int_sens_2},
 +    [GPIO_1_8V_ABCD_INT_STATUS] =     {0, gpio_reg_int_status},
 +    [GPIO_1_8V_ABCD_RESET_TOLERANT] = {0, gpio_reg_reset_tolerant},
 +    [GPIO_1_8V_ABCD_DEBOUNCE_1] =     {0, gpio_reg_debounce_1},
 +    [GPIO_1_8V_ABCD_DEBOUNCE_2] =     {0, gpio_reg_debounce_2},
 +    [GPIO_1_8V_ABCD_COMMAND_SRC_0] =  {0, gpio_reg_cmd_source_0},
 +    [GPIO_1_8V_ABCD_COMMAND_SRC_1] =  {0, gpio_reg_cmd_source_1},
 +    [GPIO_1_8V_ABCD_DATA_READ] =      {0, gpio_reg_data_read},
 +    [GPIO_1_8V_ABCD_INPUT_MASK] =     {0, gpio_reg_input_mask},
 +    /* 1.8V Set E */
 +    [GPIO_1_8V_E_DATA_VALUE] =     {1, gpio_reg_data_value},
 +    [GPIO_1_8V_E_DIRECTION] =      {1, gpio_reg_direction},
 +    [GPIO_1_8V_E_INT_ENABLE] =     {1, gpio_reg_int_enable},
 +    [GPIO_1_8V_E_INT_SENS_0] =     {1, gpio_reg_int_sens_0},
 +    [GPIO_1_8V_E_INT_SENS_1] =     {1, gpio_reg_int_sens_1},
 +    [GPIO_1_8V_E_INT_SENS_2] =     {1, gpio_reg_int_sens_2},
 +    [GPIO_1_8V_E_INT_STATUS] =     {1, gpio_reg_int_status},
 +    [GPIO_1_8V_E_RESET_TOLERANT] = {1, gpio_reg_reset_tolerant},
 +    [GPIO_1_8V_E_DEBOUNCE_1] =     {1, gpio_reg_debounce_1},
 +    [GPIO_1_8V_E_DEBOUNCE_2] =     {1, gpio_reg_debounce_2},
 +    [GPIO_1_8V_E_COMMAND_SRC_0] =  {1, gpio_reg_cmd_source_0},
 +    [GPIO_1_8V_E_COMMAND_SRC_1] =  {1, gpio_reg_cmd_source_1},
 +    [GPIO_1_8V_E_DATA_READ] =      {1, gpio_reg_data_read},
 +    [GPIO_1_8V_E_INPUT_MASK] =     {1, gpio_reg_input_mask},
 +};
 +
- static uint64_t aspeed_gpio_read(void *opaque, hwaddr offset, uint32_t size)
++    if (blk_pread(blk, 8 * KiB, buffer, rom_size) < 0) {
- {
++        error_setg(&error_fatal, "%s: failed to read BlockBackend data",
-     AspeedGPIOState *s = ASPEED_GPIO(opaque);
++                   __func__);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_get_pin(Object *obj, Visitor *v, const char *name,
++        return;
-     int set_idx, group_idx = 0;
++    }
      if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
 -        error_setg(errp, "%s: error reading %s", __func__, name);
 -        return;
 +        /* 1.8V gpio */
 +        if (sscanf(name, "gpio%3s%1d", group, &pin) != 2) {
 +            error_setg(errp, "%s: error reading %s", __func__, name);
 +            return;
 +        }
      }
      set_idx = get_set_idx(s, group, &group_idx);
      if (set_idx == -1) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_set_pin(Object *obj, Visitor *v, const char *name,
          return;
      }
      if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
 -        error_setg(errp, "%s: error reading %s", __func__, name);
 -        return;
 +        /* 1.8V gpio */
 +        if (sscanf(name, "gpio%3s%1d", group, &pin) != 2) {
 +            error_setg(errp, "%s: error reading %s", __func__, name);
 +            return;
 +        }
      }
      set_idx = get_set_idx(s, group, &group_idx);
      if (set_idx == -1) {
@@ -XXX,XX +XXX,XX @@ static const GPIOSetProperties ast2500_set_props[] = {
      [7] = {0x000000ff,  0x000000ff,  {"AC"} },
  };
 +static GPIOSetProperties ast2600_3_6v_set_props[] = {
 +    [0] = {0xffffffff,  0xffffffff,  {"A", "B", "C", "D"} },
 +    [1] = {0xffffffff,  0xffffffff,  {"E", "F", "G", "H"} },
 +    [2] = {0xffffffff,  0xffffffff,  {"I", "J", "K", "L"} },
 +    [3] = {0xffffffff,  0xffffffff,  {"M", "N", "O", "P"} },
 +    [4] = {0xffffffff,  0xffffffff,  {"Q", "R", "S", "T"} },
 +    [5] = {0xffffffff,  0x0000ffff,  {"U", "V", "W", "X"} },
 +    [6] = {0xffff0000,  0x0fff0000,  {"Y", "Z", "", ""} },
 +};
 +
-+static GPIOSetProperties ast2600_1_8v_set_props[] = {
++    rom_add_blob("allwinner-h3.bootrom", buffer, rom_size,
-+    [0] = {0xffffffff,  0xffffffff,  {"18A", "18B", "18C", "18D"} },
++                  rom_size, s->memmap[AW_H3_SRAM_A1],
-+    [1] = {0x0000000f,  0x0000000f,  {"18E"} },
++                  NULL, NULL, NULL, NULL, false);
 +};
 +
  static const MemoryRegionOps aspeed_gpio_ops = {
      .read       = aspeed_gpio_read,
      .write      = aspeed_gpio_write,
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
      }
      memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
 -            TYPE_ASPEED_GPIO, GPIO_3_6V_MEM_SIZE);
 +            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
      sysbus_init_mmio(sbd, &s->iomem);
  }
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_2500_class_init(ObjectClass *klass, void *data)
      agc->reg_table = aspeed_3_6v_gpios;
  }
 +static void aspeed_gpio_ast2600_3_6v_class_init(ObjectClass *klass, void *data)
 +{
 +    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 +
 +    agc->props = ast2600_3_6v_set_props;
 +    agc->nr_gpio_pins = 208;
 +    agc->nr_gpio_sets = 7;
 +    agc->reg_table = aspeed_3_6v_gpios;
 +}
 +
-+static void aspeed_gpio_ast2600_1_8v_class_init(ObjectClass *klass, void *data)
+ static void allwinner_h3_init(Object *obj)
 +{
 +    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 +
 +    agc->props = ast2600_1_8v_set_props;
 +    agc->nr_gpio_pins = 36;
 +    agc->nr_gpio_sets = 2;
 +    agc->reg_table = aspeed_1_8v_gpios;
 +}
 +
  static const TypeInfo aspeed_gpio_info = {
      .name           = TYPE_ASPEED_GPIO,
      .parent         = TYPE_SYS_BUS_DEVICE,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_gpio_ast2500_info = {
      .instance_init  = aspeed_gpio_init,
  };
 +static const TypeInfo aspeed_gpio_ast2600_3_6v_info = {
 +    .name           = TYPE_ASPEED_GPIO "-ast2600",
 +    .parent         = TYPE_ASPEED_GPIO,
 +    .class_init     = aspeed_gpio_ast2600_3_6v_class_init,
 +    .instance_init  = aspeed_gpio_init,
 +};
 +
 +static const TypeInfo aspeed_gpio_ast2600_1_8v_info = {
 +    .name           = TYPE_ASPEED_GPIO "-ast2600-1_8v",
 +    .parent         = TYPE_ASPEED_GPIO,
 +    .class_init     = aspeed_gpio_ast2600_1_8v_class_init,
 +    .instance_init  = aspeed_gpio_init,
 +};
 +
  static void aspeed_gpio_register_types(void)
  {
-     type_register_static(&aspeed_gpio_info);
+     AwH3State *s = AW_H3(obj);
-     type_register_static(&aspeed_gpio_ast2400_info);
+diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
-     type_register_static(&aspeed_gpio_ast2500_info);
+index XXXXXXX..XXXXXXX 100644
-+    type_register_static(&aspeed_gpio_ast2600_3_6v_info);
+--- a/hw/arm/orangepi.c
-+    type_register_static(&aspeed_gpio_ast2600_1_8v_info);
++++ b/hw/arm/orangepi.c
- }
+@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)
+     memory_region_add_subregion(get_system_memory(), h3->memmap[AW_H3_SDRAM],
- type_init(aspeed_gpio_register_types);
+                                 machine->ram);
 +    /* Load target kernel or start using BootROM */
 +    if (!machine->kernel_filename && blk_is_available(blk)) {
 +        /* Use Boot ROM to copy data from SD card to SRAM */
 +        allwinner_h3_bootrom_setup(h3, blk);
 +    }
      orangepi_binfo.loader_start = h3->memmap[AW_H3_SDRAM];
      orangepi_binfo.ram_size = machine->ram_size;
      arm_load_kernel(ARM_CPU(first_cpu), machine, &orangepi_binfo);
 --
 .20.1

-[PULL 47/68] aspeed/sdmc: Introduce an object class per SoC
+[PULL 22/36] hw/arm/allwinner-h3: add SDRAM controller device
-From: Cédric Le Goater <clg@kaod.org>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-Use class handlers and class constants to differentiate the
+In the Allwinner H3 SoC the SDRAM controller is responsible
-characteristics of the memory controller and remove the 'silicon_rev'
+for interfacing with the external Synchronous Dynamic Random
-property.
+Access Memory (SDRAM). Types of memory that the SDRAM controller
 supports are DDR2/DDR3 and capacities of up to 2GiB. This commit
 adds emulation support of the Allwinner H3 SDRAM controller.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190925143248.10000-9-clg@kaod.org
+Message-id: 20200311221854.30370-12-nieklinnenbank@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/aspeed_sdmc.h |  19 +++-
+ hw/misc/Makefile.objs                |   1 +
- hw/arm/aspeed_soc.c           |   5 +-
+ include/hw/arm/allwinner-h3.h        |   5 +
- hw/misc/aspeed_sdmc.c         | 168 +++++++++++++++++++++-------------
+ include/hw/misc/allwinner-h3-dramc.h | 106 ++++++++
-files changed, 122 insertions(+), 70 deletions(-)
+ hw/arm/allwinner-h3.c                |  19 +-
  hw/arm/orangepi.c                    |   6 +
  hw/misc/allwinner-h3-dramc.c         | 358 +++++++++++++++++++++++++++
  hw/misc/trace-events                 |  10 +
 files changed, 502 insertions(+), 3 deletions(-)
  create mode 100644 include/hw/misc/allwinner-h3-dramc.h
  create mode 100644 hw/misc/allwinner-h3-dramc.c
-diff --git a/include/hw/misc/aspeed_sdmc.h b/include/hw/misc/aspeed_sdmc.h
+diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/aspeed_sdmc.h
+--- a/hw/misc/Makefile.objs
-+++ b/include/hw/misc/aspeed_sdmc.h
++++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_IVSHMEM_DEVICE) += ivshmem.o
  common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-ccu.o
  obj-$(CONFIG_ALLWINNER_H3) += allwinner-cpucfg.o
 +common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-dramc.o
  common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-sysctrl.o
  common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-sid.o
  common-obj-$(CONFIG_REALVIEW) += arm_sysctl.o
 diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/allwinner-h3.h
 +++ b/include/hw/arm/allwinner-h3.h
 @@ -XXX,XX +XXX,XX @@
+ #include "hw/intc/arm_gic.h"
- #define TYPE_ASPEED_SDMC "aspeed.sdmc"
+ #include "hw/misc/allwinner-h3-ccu.h"
- #define ASPEED_SDMC(obj) OBJECT_CHECK(AspeedSDMCState, (obj), TYPE_ASPEED_SDMC)
+ #include "hw/misc/allwinner-cpucfg.h"
-+#define TYPE_ASPEED_2400_SDMC TYPE_ASPEED_SDMC "-ast2400"
++#include "hw/misc/allwinner-h3-dramc.h"
-+#define TYPE_ASPEED_2500_SDMC TYPE_ASPEED_SDMC "-ast2500"
+ #include "hw/misc/allwinner-h3-sysctrl.h"
+ #include "hw/misc/allwinner-sid.h"
- #define ASPEED_SDMC_NR_REGS (0x174 >> 2)
+ #include "hw/sd/allwinner-sdhost.h"
+@@ -XXX,XX +XXX,XX @@ enum {
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSDMCState {
+     AW_H3_UART2,
-     MemoryRegion iomem;
+     AW_H3_UART3,
+     AW_H3_EMAC,
-     uint32_t regs[ASPEED_SDMC_NR_REGS];
++    AW_H3_DRAMCOM,
--    uint32_t silicon_rev;
++    AW_H3_DRAMCTL,
--    uint32_t ram_bits;
++    AW_H3_DRAMPHY,
-     uint64_t ram_size;
+     AW_H3_GIC_DIST,
-     uint64_t max_ram_size;
+     AW_H3_GIC_CPU,
--    uint32_t fixed_conf;
+     AW_H3_GIC_HYP,
--
+@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
- } AspeedSDMCState;
+     AwA10PITState timer;
+     AwH3ClockCtlState ccu;
-+#define ASPEED_SDMC_CLASS(klass) \
+     AwCpuCfgState cpucfg;
-+     OBJECT_CLASS_CHECK(AspeedSDMCClass, (klass), TYPE_ASPEED_SDMC)
++    AwH3DramCtlState dramc;
-+#define ASPEED_SDMC_GET_CLASS(obj) \
+     AwH3SysCtrlState sysctrl;
-+     OBJECT_GET_CLASS(AspeedSDMCClass, (obj), TYPE_ASPEED_SDMC)
+     AwSidState sid;
-+
+     AwSdHostState mmc0;
-+typedef struct AspeedSDMCClass {
+diff --git a/include/hw/misc/allwinner-h3-dramc.h b/include/hw/misc/allwinner-h3-dramc.h
-+    SysBusDeviceClass parent_class;
+new file mode 100644
-+
+index XXXXXXX..XXXXXXX
-+    uint64_t max_ram_size;
+--- /dev/null
-+    uint32_t (*compute_conf)(AspeedSDMCState *s, uint32_t data);
++++ b/include/hw/misc/allwinner-h3-dramc.h
-+    void (*write)(AspeedSDMCState *s, uint32_t reg, uint32_t data);
+@@ -XXX,XX +XXX,XX @@
-+} AspeedSDMCClass;
++/*
-+
++ * Allwinner H3 SDRAM Controller emulation
- #endif /* ASPEED_SDMC_H */
++ *
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
++ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#ifndef HW_MISC_ALLWINNER_H3_DRAMC_H
 +#define HW_MISC_ALLWINNER_H3_DRAMC_H
 +
 +#include "qom/object.h"
 +#include "hw/sysbus.h"
 +#include "exec/hwaddr.h"
 +
 +/**
 + * Constants
 + * @{
 + */
 +
 +/** Highest register address used by DRAMCOM module */
 +#define AW_H3_DRAMCOM_REGS_MAXADDR  (0x804)
 +
 +/** Total number of known DRAMCOM registers */
 +#define AW_H3_DRAMCOM_REGS_NUM      (AW_H3_DRAMCOM_REGS_MAXADDR / \
 +                                     sizeof(uint32_t))
 +
 +/** Highest register address used by DRAMCTL module */
 +#define AW_H3_DRAMCTL_REGS_MAXADDR  (0x88c)
 +
 +/** Total number of known DRAMCTL registers */
 +#define AW_H3_DRAMCTL_REGS_NUM      (AW_H3_DRAMCTL_REGS_MAXADDR / \
 +                                     sizeof(uint32_t))
 +
 +/** Highest register address used by DRAMPHY module */
 +#define AW_H3_DRAMPHY_REGS_MAXADDR  (0x4)
 +
 +/** Total number of known DRAMPHY registers */
 +#define AW_H3_DRAMPHY_REGS_NUM      (AW_H3_DRAMPHY_REGS_MAXADDR / \
 +                                     sizeof(uint32_t))
 +
 +/** @} */
 +
 +/**
 + * Object model
 + * @{
 + */
 +
 +#define TYPE_AW_H3_DRAMC "allwinner-h3-dramc"
 +#define AW_H3_DRAMC(obj) \
 +    OBJECT_CHECK(AwH3DramCtlState, (obj), TYPE_AW_H3_DRAMC)
 +
 +/** @} */
 +
 +/**
 + * Allwinner H3 SDRAM Controller object instance state.
 + */
 +typedef struct AwH3DramCtlState {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +    /*< public >*/
 +
 +    /** Physical base address for start of RAM */
 +    hwaddr ram_addr;
 +
 +    /** Total RAM size in megabytes */
 +    uint32_t ram_size;
 +
 +    /**
 +     * @name Memory Regions
 +     * @{
 +     */
 +
 +    MemoryRegion row_mirror;       /**< Simulates rows for RAM size detection */
 +    MemoryRegion row_mirror_alias; /**< Alias of the row which is mirrored */
 +    MemoryRegion dramcom_iomem;    /**< DRAMCOM module I/O registers */
 +    MemoryRegion dramctl_iomem;    /**< DRAMCTL module I/O registers */
 +    MemoryRegion dramphy_iomem;    /**< DRAMPHY module I/O registers */
 +
 +    /** @} */
 +
 +    /**
 +     * @name Hardware Registers
 +     * @{
 +     */
 +
 +    uint32_t dramcom[AW_H3_DRAMCOM_REGS_NUM]; /**< Array of DRAMCOM registers */
 +    uint32_t dramctl[AW_H3_DRAMCTL_REGS_NUM]; /**< Array of DRAMCTL registers */
 +    uint32_t dramphy[AW_H3_DRAMPHY_REGS_NUM] ;/**< Array of DRAMPHY registers */
 +
 +    /** @} */
 +
 +} AwH3DramCtlState;
 +
 +#endif /* HW_MISC_ALLWINNER_H3_DRAMC_H */
 diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
+--- a/hw/arm/allwinner-h3.c
-+++ b/hw/arm/aspeed_soc.c
++++ b/hw/arm/allwinner-h3.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
-                               sizeof(s->spi[i]), typename);
+     [AW_H3_UART2]      = 0x01c28800,
-     }
+     [AW_H3_UART3]      = 0x01c28c00,
+     [AW_H3_EMAC]       = 0x01c30000,
-+    snprintf(typename, sizeof(typename), "aspeed.sdmc-%s", socname);
++    [AW_H3_DRAMCOM]    = 0x01c62000,
-     sysbus_init_child_obj(obj, "sdmc", OBJECT(&s->sdmc), sizeof(s->sdmc),
++    [AW_H3_DRAMCTL]    = 0x01c63000,
--                          TYPE_ASPEED_SDMC);
++    [AW_H3_DRAMPHY]    = 0x01c65000,
--    qdev_prop_set_uint32(DEVICE(&s->sdmc), "silicon-rev",
+     [AW_H3_GIC_DIST]   = 0x01c81000,
--                         sc->info->silicon_rev);
+     [AW_H3_GIC_CPU]    = 0x01c82000,
-+                          typename);
+     [AW_H3_GIC_HYP]    = 0x01c84000,
-     object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
+@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
-                               "ram-size", &error_abort);
+     { "scr",       0x01c2c400, 1 * KiB },
-     object_property_add_alias(obj, "max-ram-size", OBJECT(&s->sdmc),
+     { "gpu",       0x01c40000, 64 * KiB },
-diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
+     { "hstmr",     0x01c60000, 4 * KiB },
 -    { "dramcom",   0x01c62000, 4 * KiB },
 -    { "dramctl0",  0x01c63000, 4 * KiB },
 -    { "dramphy0",  0x01c65000, 4 * KiB },
      { "spi0",      0x01c68000, 4 * KiB },
      { "spi1",      0x01c69000, 4 * KiB },
      { "csi",       0x01cb0000, 320 * KiB },
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
      sysbus_init_child_obj(obj, "emac", &s->emac, sizeof(s->emac),
                            TYPE_AW_SUN8I_EMAC);
 +
 +    sysbus_init_child_obj(obj, "dramc", &s->dramc, sizeof(s->dramc),
 +                          TYPE_AW_H3_DRAMC);
 +    object_property_add_alias(obj, "ram-addr", OBJECT(&s->dramc),
 +                             "ram-addr", &error_abort);
 +    object_property_add_alias(obj, "ram-size", OBJECT(&s->dramc),
 +                              "ram-size", &error_abort);
  }
  static void allwinner_h3_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
                     qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART3),
 , serial_hd(3), DEVICE_NATIVE_ENDIAN);
 +    /* DRAMC */
 +    qdev_init_nofail(DEVICE(&s->dramc));
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->dramc), 0, s->memmap[AW_H3_DRAMCOM]);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->dramc), 1, s->memmap[AW_H3_DRAMCTL]);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->dramc), 2, s->memmap[AW_H3_DRAMPHY]);
 +
      /* Unimplemented devices */
      for (i = 0; i < ARRAY_SIZE(unimplemented); i++) {
          create_unimplemented_device(unimplemented[i].device_name,
 diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/aspeed_sdmc.c
+--- a/hw/arm/orangepi.c
-+++ b/hw/misc/aspeed_sdmc.c
++++ b/hw/arm/orangepi.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,
+@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)
-                              unsigned int size)
+     /* Setup EMAC properties */
- {
+     object_property_set_int(OBJECT(&h3->emac), 1, "phy-addr", &error_abort);
-     AspeedSDMCState *s = ASPEED_SDMC(opaque);
-+    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
++    /* DRAMC */
++    object_property_set_uint(OBJECT(h3), h3->memmap[AW_H3_SDRAM],
-     addr >>= 2;
++                             "ram-addr", &error_abort);
++    object_property_set_int(OBJECT(h3), machine->ram_size / MiB, "ram-size",
-@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,
++                            &error_abort);
-         return;
++
-     }
+     /* Mark H3 object realized */
+     object_property_set_bool(OBJECT(h3), true, "realized", &error_abort);
--    if (addr == R_CONF) {
--        /* Make sure readonly bits are kept */
+diff --git a/hw/misc/allwinner-h3-dramc.c b/hw/misc/allwinner-h3-dramc.c
--        switch (s->silicon_rev) {
+new file mode 100644
--        case AST2400_A0_SILICON_REV:
+index XXXXXXX..XXXXXXX
--        case AST2400_A1_SILICON_REV:
+--- /dev/null
--            data &= ~ASPEED_SDMC_READONLY_MASK;
++++ b/hw/misc/allwinner-h3-dramc.c
--            data |= s->fixed_conf;
+@@ -XXX,XX +XXX,XX @@
--            break;
++/*
--        case AST2500_A0_SILICON_REV:
++ * Allwinner H3 SDRAM Controller emulation
--        case AST2500_A1_SILICON_REV:
++ *
--            data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
++ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
--            data |= s->fixed_conf;
++ *
--            break;
++ * This program is free software: you can redistribute it and/or modify
--        default:
++ * it under the terms of the GNU General Public License as published by
--            g_assert_not_reached();
++ * the Free Software Foundation, either version 2 of the License, or
--        }
++ * (at your option) any later version.
--    }
++ *
--    if (s->silicon_rev == AST2500_A0_SILICON_REV ||
++ * This program is distributed in the hope that it will be useful,
--            s->silicon_rev == AST2500_A1_SILICON_REV) {
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
--        switch (addr) {
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
--        case R_STATUS1:
++ * GNU General Public License for more details.
--            /* Will never return 'busy' */
++ *
--            data &= ~PHY_BUSY_STATE;
++ * You should have received a copy of the GNU General Public License
--            break;
++ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
--        case R_ECC_TEST_CTRL:
++ */
--            /* Always done, always happy */
++
--            data |= ECC_TEST_FINISHED;
++#include "qemu/osdep.h"
--            data &= ~ECC_TEST_FAIL;
++#include "qemu/units.h"
--            break;
++#include "qemu/error-report.h"
--        default:
++#include "hw/sysbus.h"
--            break;
++#include "migration/vmstate.h"
--        }
++#include "qemu/log.h"
--    }
++#include "qemu/module.h"
--
++#include "exec/address-spaces.h"
--    s->regs[addr] = data;
++#include "hw/qdev-properties.h"
-+    asc->write(s, addr, data);
++#include "qapi/error.h"
- }
++#include "hw/misc/allwinner-h3-dramc.h"
++#include "trace.h"
- static const MemoryRegionOps aspeed_sdmc_ops = {
++
-@@ -XXX,XX +XXX,XX @@ static int ast2500_rambits(AspeedSDMCState *s)
++#define REG_INDEX(offset)    (offset / sizeof(uint32_t))
- static void aspeed_sdmc_reset(DeviceState *dev)
++
- {
++/* DRAMCOM register offsets */
-     AspeedSDMCState *s = ASPEED_SDMC(dev);
++enum {
-+    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
++    REG_DRAMCOM_CR    = 0x0000, /* Control Register */
++};
-     memset(s->regs, 0, sizeof(s->regs));
++
++/* DRAMCTL register offsets */
-     /* Set ram size bit and defaults values */
++enum {
--    s->regs[R_CONF] = s->fixed_conf;
++    REG_DRAMCTL_PIR   = 0x0000, /* PHY Initialization Register */
-+    s->regs[R_CONF] = asc->compute_conf(s, 0);
++    REG_DRAMCTL_PGSR  = 0x0010, /* PHY General Status Register */
- }
++    REG_DRAMCTL_STATR = 0x0018, /* Status Register */
++};
- static void aspeed_sdmc_realize(DeviceState *dev, Error **errp)
++
- {
++/* DRAMCTL register flags */
-     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
++enum {
-     AspeedSDMCState *s = ASPEED_SDMC(dev);
++    REG_DRAMCTL_PGSR_INITDONE = (1 << 0),
-+    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
++};
++
--    if (!is_supported_silicon_rev(s->silicon_rev)) {
++enum {
--        error_setg(errp, "Unknown silicon revision: 0x%" PRIx32,
++    REG_DRAMCTL_STATR_ACTIVE  = (1 << 0),
--                s->silicon_rev);
++};
--        return;
++
--    }
++static void allwinner_h3_dramc_map_rows(AwH3DramCtlState *s, uint8_t row_bits,
--
++                                        uint8_t bank_bits, uint16_t page_size)
--    switch (s->silicon_rev) {
++{
--    case AST2400_A0_SILICON_REV:
++    /*
--    case AST2400_A1_SILICON_REV:
++     * This function simulates row addressing behavior when bootloader
--        s->ram_bits = ast2400_rambits(s);
++     * software attempts to detect the amount of available SDRAM. In U-Boot
--        s->max_ram_size = 512 << 20;
++     * the controller is configured with the widest row addressing available.
--        s->fixed_conf = ASPEED_SDMC_VGA_COMPAT |
++     * Then a pattern is written to RAM at an offset on the row boundary size.
--            ASPEED_SDMC_DRAM_SIZE(s->ram_bits);
++     * If the value read back equals the value read back from the
--        break;
++     * start of RAM, the bootloader knows the amount of row bits.
--    case AST2500_A0_SILICON_REV:
++     *
--    case AST2500_A1_SILICON_REV:
++     * This function inserts a mirrored memory region when the configured row
--        s->ram_bits = ast2500_rambits(s);
++     * bits are not matching the actual emulated memory, to simulate the
--        s->max_ram_size = 1024 << 20;
++     * same behavior on hardware as expected by the bootloader.
--        s->fixed_conf = ASPEED_SDMC_HW_VERSION(1) |
++     */
--            ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
++    uint8_t row_bits_actual = 0;
--            ASPEED_SDMC_CACHE_INITIAL_DONE |
++
--            ASPEED_SDMC_DRAM_SIZE(s->ram_bits);
++    /* Calculate the actual row bits using the ram_size property */
--        break;
++    for (uint8_t i = 8; i < 12; i++) {
--    default:
++        if (1 << i == s->ram_size) {
--        g_assert_not_reached();
++            row_bits_actual = i + 3;
--    }
++            break;
-+    s->max_ram_size = asc->max_ram_size;
++        }
++    }
-     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_sdmc_ops, s,
++
-                           TYPE_ASPEED_SDMC, 0x1000);
++    if (s->ram_size == (1 << (row_bits - 3))) {
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_sdmc = {
++        /* When row bits is the expected value, remove the mirror */
- };
++        memory_region_set_enabled(&s->row_mirror_alias, false);
++        trace_allwinner_h3_dramc_rowmirror_disable();
- static Property aspeed_sdmc_properties[] = {
++
--    DEFINE_PROP_UINT32("silicon-rev", AspeedSDMCState, silicon_rev, 0),
++    } else if (row_bits_actual) {
-     DEFINE_PROP_UINT64("ram-size", AspeedSDMCState, ram_size, 0),
++        /* Row bits not matching ram_size, install the rows mirror */
-     DEFINE_PROP_UINT64("max-ram-size", AspeedSDMCState, max_ram_size, 0),
++        hwaddr row_mirror = s->ram_addr + ((1 << (row_bits_actual +
-     DEFINE_PROP_END_OF_LIST(),
++                                                  bank_bits)) * page_size);
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_sdmc_info = {
++
-     .parent = TYPE_SYS_BUS_DEVICE,
++        memory_region_set_enabled(&s->row_mirror_alias, true);
-     .instance_size = sizeof(AspeedSDMCState),
++        memory_region_set_address(&s->row_mirror_alias, row_mirror);
-     .class_init = aspeed_sdmc_class_init,
++
-+    .class_size = sizeof(AspeedSDMCClass),
++        trace_allwinner_h3_dramc_rowmirror_enable(row_mirror);
-+    .abstract   = true,
++    }
-+};
++}
 +
-+static uint32_t aspeed_2400_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
++static uint64_t allwinner_h3_dramcom_read(void *opaque, hwaddr offset,
-+{
++                                          unsigned size)
-+    uint32_t fixed_conf = ASPEED_SDMC_VGA_COMPAT |
++{
-+        ASPEED_SDMC_DRAM_SIZE(ast2400_rambits(s));
++    const AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
-+
++    const uint32_t idx = REG_INDEX(offset);
-+    /* Make sure readonly bits are kept */
++
-+    data &= ~ASPEED_SDMC_READONLY_MASK;
++    if (idx >= AW_H3_DRAMCOM_REGS_NUM) {
-+
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
-+    return data | fixed_conf;
++                      __func__, (uint32_t)offset);
-+}
++        return 0;
-+
++    }
-+static void aspeed_2400_sdmc_write(AspeedSDMCState *s, uint32_t reg,
++
-+                                   uint32_t data)
++    trace_allwinner_h3_dramcom_read(offset, s->dramcom[idx], size);
-+{
++
-+    switch (reg) {
++    return s->dramcom[idx];
-+    case R_CONF:
++}
-+        data = aspeed_2400_sdmc_compute_conf(s, data);
++
 +static void allwinner_h3_dramcom_write(void *opaque, hwaddr offset,
 +                                       uint64_t val, unsigned size)
 +{
 +    AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
 +    const uint32_t idx = REG_INDEX(offset);
 +
 +    trace_allwinner_h3_dramcom_write(offset, val, size);
 +
 +    if (idx >= AW_H3_DRAMCOM_REGS_NUM) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
 +                      __func__, (uint32_t)offset);
 +        return;
 +    }
 +
 +    switch (offset) {
 +    case REG_DRAMCOM_CR:   /* Control Register */
 +        allwinner_h3_dramc_map_rows(s, ((val >> 4) & 0xf) + 1,
 +                                       ((val >> 2) & 0x1) + 2,
 +                                       1 << (((val >> 8) & 0xf) + 3));
 +        break;
 +    default:
 +        break;
-+    }
++    };
 +
-+    s->regs[reg] = data;
++    s->dramcom[idx] = (uint32_t) val;
 +}
 +
-+static void aspeed_2400_sdmc_class_init(ObjectClass *klass, void *data)
++static uint64_t allwinner_h3_dramctl_read(void *opaque, hwaddr offset,
-+{
++                                          unsigned size)
-+    DeviceClass *dc = DEVICE_CLASS(klass);
++{
-+    AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
++    const AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
-+
++    const uint32_t idx = REG_INDEX(offset);
-+    dc->desc = "ASPEED 2400 SDRAM Memory Controller";
++
-+    asc->max_ram_size = 512 << 20;
++    if (idx >= AW_H3_DRAMCTL_REGS_NUM) {
-+    asc->compute_conf = aspeed_2400_sdmc_compute_conf;
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
-+    asc->write = aspeed_2400_sdmc_write;
++                      __func__, (uint32_t)offset);
-+}
++        return 0;
-+
++    }
-+static const TypeInfo aspeed_2400_sdmc_info = {
++
-+    .name = TYPE_ASPEED_2400_SDMC,
++    trace_allwinner_h3_dramctl_read(offset, s->dramctl[idx], size);
-+    .parent = TYPE_ASPEED_SDMC,
++
-+    .class_init = aspeed_2400_sdmc_class_init,
++    return s->dramctl[idx];
-+};
++}
 +
-+static uint32_t aspeed_2500_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
++static void allwinner_h3_dramctl_write(void *opaque, hwaddr offset,
-+{
++                                       uint64_t val, unsigned size)
-+    uint32_t fixed_conf = ASPEED_SDMC_HW_VERSION(1) |
++{
-+        ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
++    AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
-+        ASPEED_SDMC_CACHE_INITIAL_DONE |
++    const uint32_t idx = REG_INDEX(offset);
-+        ASPEED_SDMC_DRAM_SIZE(ast2500_rambits(s));
++
-+
++    trace_allwinner_h3_dramctl_write(offset, val, size);
-+    /* Make sure readonly bits are kept */
++
-+    data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
++    if (idx >= AW_H3_DRAMCTL_REGS_NUM) {
-+
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
-+    return data | fixed_conf;
++                      __func__, (uint32_t)offset);
-+}
++        return;
-+
++    }
-+static void aspeed_2500_sdmc_write(AspeedSDMCState *s, uint32_t reg,
++
-+                                   uint32_t data)
++    switch (offset) {
-+{
++    case REG_DRAMCTL_PIR:    /* PHY Initialization Register */
-+    switch (reg) {
++        s->dramctl[REG_INDEX(REG_DRAMCTL_PGSR)] |= REG_DRAMCTL_PGSR_INITDONE;
-+    case R_CONF:
++        s->dramctl[REG_INDEX(REG_DRAMCTL_STATR)] |= REG_DRAMCTL_STATR_ACTIVE;
 +        data = aspeed_2500_sdmc_compute_conf(s, data);
 +        break;
 +    case R_STATUS1:
 +        /* Will never return 'busy' */
 +        data &= ~PHY_BUSY_STATE;
 +        break;
 +    case R_ECC_TEST_CTRL:
 +        /* Always done, always happy */
 +        data |= ECC_TEST_FINISHED;
 +        data &= ~ECC_TEST_FAIL;
 +        break;
 +    default:
 +        break;
 +    }
 +
-+    s->regs[reg] = data;
++    s->dramctl[idx] = (uint32_t) val;
 +}
 +
-+static void aspeed_2500_sdmc_class_init(ObjectClass *klass, void *data)
++static uint64_t allwinner_h3_dramphy_read(void *opaque, hwaddr offset,
 +                                          unsigned size)
 +{
 +    const AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
 +    const uint32_t idx = REG_INDEX(offset);
 +
 +    if (idx >= AW_H3_DRAMPHY_REGS_NUM) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
 +                      __func__, (uint32_t)offset);
 +        return 0;
 +    }
 +
 +    trace_allwinner_h3_dramphy_read(offset, s->dramphy[idx], size);
 +
 +    return s->dramphy[idx];
 +}
 +
 +static void allwinner_h3_dramphy_write(void *opaque, hwaddr offset,
 +                                       uint64_t val, unsigned size)
 +{
 +    AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
 +    const uint32_t idx = REG_INDEX(offset);
 +
 +    trace_allwinner_h3_dramphy_write(offset, val, size);
 +
 +    if (idx >= AW_H3_DRAMPHY_REGS_NUM) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
 +                      __func__, (uint32_t)offset);
 +        return;
 +    }
 +
 +    s->dramphy[idx] = (uint32_t) val;
 +}
 +
 +static const MemoryRegionOps allwinner_h3_dramcom_ops = {
 +    .read = allwinner_h3_dramcom_read,
 +    .write = allwinner_h3_dramcom_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +    .impl.min_access_size = 4,
 +};
 +
 +static const MemoryRegionOps allwinner_h3_dramctl_ops = {
 +    .read = allwinner_h3_dramctl_read,
 +    .write = allwinner_h3_dramctl_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +    .impl.min_access_size = 4,
 +};
 +
 +static const MemoryRegionOps allwinner_h3_dramphy_ops = {
 +    .read = allwinner_h3_dramphy_read,
 +    .write = allwinner_h3_dramphy_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +    .impl.min_access_size = 4,
 +};
 +
 +static void allwinner_h3_dramc_reset(DeviceState *dev)
 +{
 +    AwH3DramCtlState *s = AW_H3_DRAMC(dev);
 +
 +    /* Set default values for registers */
 +    memset(&s->dramcom, 0, sizeof(s->dramcom));
 +    memset(&s->dramctl, 0, sizeof(s->dramctl));
 +    memset(&s->dramphy, 0, sizeof(s->dramphy));
 +}
 +
 +static void allwinner_h3_dramc_realize(DeviceState *dev, Error **errp)
 +{
 +    AwH3DramCtlState *s = AW_H3_DRAMC(dev);
 +
 +    /* Only power of 2 RAM sizes from 256MiB up to 2048MiB are supported */
 +    for (uint8_t i = 8; i < 13; i++) {
 +        if (1 << i == s->ram_size) {
 +            break;
 +        } else if (i == 12) {
 +            error_report("%s: ram-size %u MiB is not supported",
 +                          __func__, s->ram_size);
 +            exit(1);
 +        }
 +    }
 +
 +    /* Setup row mirror mappings */
 +    memory_region_init_ram(&s->row_mirror, OBJECT(s),
 +                           "allwinner-h3-dramc.row-mirror",
 +                            4 * KiB, &error_abort);
 +    memory_region_add_subregion_overlap(get_system_memory(), s->ram_addr,
 +                                       &s->row_mirror, 10);
 +
 +    memory_region_init_alias(&s->row_mirror_alias, OBJECT(s),
 +                            "allwinner-h3-dramc.row-mirror-alias",
 +                            &s->row_mirror, 0, 4 * KiB);
 +    memory_region_add_subregion_overlap(get_system_memory(),
 +                                        s->ram_addr + 1 * MiB,
 +                                       &s->row_mirror_alias, 10);
 +    memory_region_set_enabled(&s->row_mirror_alias, false);
 +}
 +
 +static void allwinner_h3_dramc_init(Object *obj)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    AwH3DramCtlState *s = AW_H3_DRAMC(obj);
 +
 +    /* DRAMCOM registers */
 +    memory_region_init_io(&s->dramcom_iomem, OBJECT(s),
 +                          &allwinner_h3_dramcom_ops, s,
 +                           TYPE_AW_H3_DRAMC, 4 * KiB);
 +    sysbus_init_mmio(sbd, &s->dramcom_iomem);
 +
 +    /* DRAMCTL registers */
 +    memory_region_init_io(&s->dramctl_iomem, OBJECT(s),
 +                          &allwinner_h3_dramctl_ops, s,
 +                           TYPE_AW_H3_DRAMC, 4 * KiB);
 +    sysbus_init_mmio(sbd, &s->dramctl_iomem);
 +
 +    /* DRAMPHY registers */
 +    memory_region_init_io(&s->dramphy_iomem, OBJECT(s),
 +                          &allwinner_h3_dramphy_ops, s,
 +                          TYPE_AW_H3_DRAMC, 4 * KiB);
 +    sysbus_init_mmio(sbd, &s->dramphy_iomem);
 +}
 +
 +static Property allwinner_h3_dramc_properties[] = {
 +    DEFINE_PROP_UINT64("ram-addr", AwH3DramCtlState, ram_addr, 0x0),
 +    DEFINE_PROP_UINT32("ram-size", AwH3DramCtlState, ram_size, 256 * MiB),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
 +static const VMStateDescription allwinner_h3_dramc_vmstate = {
 +    .name = "allwinner-h3-dramc",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(dramcom, AwH3DramCtlState, AW_H3_DRAMCOM_REGS_NUM),
 +        VMSTATE_UINT32_ARRAY(dramctl, AwH3DramCtlState, AW_H3_DRAMCTL_REGS_NUM),
 +        VMSTATE_UINT32_ARRAY(dramphy, AwH3DramCtlState, AW_H3_DRAMPHY_REGS_NUM),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void allwinner_h3_dramc_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
-+    AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
++
-+
++    dc->reset = allwinner_h3_dramc_reset;
-+    dc->desc = "ASPEED 2500 SDRAM Memory Controller";
++    dc->vmsd = &allwinner_h3_dramc_vmstate;
-+    asc->max_ram_size = 1024 << 20;
++    dc->realize = allwinner_h3_dramc_realize;
-+    asc->compute_conf = aspeed_2500_sdmc_compute_conf;
++    device_class_set_props(dc, allwinner_h3_dramc_properties);
-+    asc->write = aspeed_2500_sdmc_write;
++}
-+}
++
-+
++static const TypeInfo allwinner_h3_dramc_info = {
-+static const TypeInfo aspeed_2500_sdmc_info = {
++    .name          = TYPE_AW_H3_DRAMC,
-+    .name = TYPE_ASPEED_2500_SDMC,
++    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .parent = TYPE_ASPEED_SDMC,
++    .instance_init = allwinner_h3_dramc_init,
-+    .class_init = aspeed_2500_sdmc_class_init,
++    .instance_size = sizeof(AwH3DramCtlState),
- };
++    .class_init    = allwinner_h3_dramc_class_init,
++};
- static void aspeed_sdmc_register_types(void)
++
- {
++static void allwinner_h3_dramc_register(void)
-     type_register_static(&aspeed_sdmc_info);
++{
-+    type_register_static(&aspeed_2400_sdmc_info);
++    type_register_static(&allwinner_h3_dramc_info);
-+    type_register_static(&aspeed_2500_sdmc_info);
++}
- }
++
++type_init(allwinner_h3_dramc_register)
- type_init(aspeed_sdmc_register_types);
+diff --git a/hw/misc/trace-events b/hw/misc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ allwinner_cpucfg_cpu_reset(uint8_t cpu_id, uint32_t reset_addr) "id %u, reset_ad
  allwinner_cpucfg_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
  allwinner_cpucfg_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +# allwinner-h3-dramc.c
 +allwinner_h3_dramc_rowmirror_disable(void) "Disable row mirror"
 +allwinner_h3_dramc_rowmirror_enable(uint64_t addr) "Enable row mirror: addr 0x%" PRIx64
 +allwinner_h3_dramcom_read(uint64_t offset, uint64_t data, unsigned size) "Read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +allwinner_h3_dramcom_write(uint64_t offset, uint64_t data, unsigned size) "Write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +allwinner_h3_dramctl_read(uint64_t offset, uint64_t data, unsigned size) "Read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +allwinner_h3_dramctl_write(uint64_t offset, uint64_t data, unsigned size) "Write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +allwinner_h3_dramphy_read(uint64_t offset, uint64_t data, unsigned size) "Read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +allwinner_h3_dramphy_write(uint64_t offset, uint64_t data, unsigned size) "write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 +
  # allwinner-sid.c
  allwinner_sid_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
  allwinner_sid_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 --
 .20.1

-[PULL 42/68] hw: aspeed_scu: Add AST2600 support
+[PULL 23/36] hw/arm/allwinner: add RTC device support
-From: Joel Stanley <joel@jms.id.au>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-The SCU controller on the AST2600 SoC has extra registers. Increase
+Allwinner System-on-Chips usually contain a Real Time Clock (RTC)
-the number of regs of the model and introduce a new field in the class
+for non-volatile system date and time keeping. This commit adds a generic
-to customize the MemoryRegion operations depending on the SoC model.
+Allwinner RTC device that supports the RTC devices found in Allwinner SoC
 family sun4i (A10), sun7i (A20) and sun6i and newer (A31, H2+, H3, etc).
 The following RTC functionality and features are implemented:
-Signed-off-by: Joel Stanley <joel@jms.id.au>
+ * Year-Month-Day read/write
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+ * Hour-Minute-Second read/write
-Message-id: 20190925143248.10000-4-clg@kaod.org
+ * General Purpose storage
-[clg: - improved commit log
-      - changed vmstate version
+The following boards are extended with the RTC device:
-      - reworked model integration into new object class
-      - included AST2600_HPLL_PARAM value ]
+ * Cubieboard (hw/arm/cubieboard.c)
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+ * Orange Pi PC (hw/arm/orangepi.c)
 Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20200311221854.30370-13-nieklinnenbank@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/aspeed_scu.h |   7 +-
+ hw/rtc/Makefile.objs           |   1 +
- hw/misc/aspeed_scu.c         | 192 +++++++++++++++++++++++++++++++++--
+ include/hw/arm/allwinner-a10.h |   2 +
-files changed, 191 insertions(+), 8 deletions(-)
+ include/hw/arm/allwinner-h3.h  |   3 +
  include/hw/rtc/allwinner-rtc.h | 134 +++++++++++
  hw/arm/allwinner-a10.c         |   8 +
  hw/arm/allwinner-h3.c          |   9 +-
  hw/rtc/allwinner-rtc.c         | 411 +++++++++++++++++++++++++++++++++
  hw/rtc/trace-events            |   4 +
 files changed, 571 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/rtc/allwinner-rtc.h
  create mode 100644 hw/rtc/allwinner-rtc.c
-diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
+diff --git a/hw/rtc/Makefile.objs b/hw/rtc/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/aspeed_scu.h
+--- a/hw/rtc/Makefile.objs
-+++ b/include/hw/misc/aspeed_scu.h
++++ b/hw/rtc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MC146818RTC) += mc146818rtc.o
  common-obj-$(CONFIG_SUN4V_RTC) += sun4v-rtc.o
  common-obj-$(CONFIG_ASPEED_SOC) += aspeed_rtc.o
  common-obj-$(CONFIG_GOLDFISH_RTC) += goldfish_rtc.o
 +common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-rtc.o
 diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/allwinner-a10.h
 +++ b/include/hw/arm/allwinner-a10.h
 @@ -XXX,XX +XXX,XX @@
- #define ASPEED_SCU(obj) OBJECT_CHECK(AspeedSCUState, (obj), TYPE_ASPEED_SCU)
+ #include "hw/ide/ahci.h"
- #define TYPE_ASPEED_2400_SCU TYPE_ASPEED_SCU "-ast2400"
+ #include "hw/usb/hcd-ohci.h"
- #define TYPE_ASPEED_2500_SCU TYPE_ASPEED_SCU "-ast2500"
+ #include "hw/usb/hcd-ehci.h"
-+#define TYPE_ASPEED_2600_SCU TYPE_ASPEED_SCU "-ast2600"
++#include "hw/rtc/allwinner-rtc.h"
- #define ASPEED_SCU_NR_REGS (0x1A8 >> 2)
+ #include "target/arm/cpu.h"
-+#define ASPEED_AST2600_SCU_NR_REGS (0xE20 >> 2)
+@@ -XXX,XX +XXX,XX @@ typedef struct AwA10State {
- typedef struct AspeedSCUState {
+     AwEmacState emac;
-     /*< private >*/
+     AllwinnerAHCIState sata;
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
+     AwSdHostState mmc0;
-     /*< public >*/
++    AwRtcState rtc;
-     MemoryRegion iomem;
+     MemoryRegion sram_a;
+     EHCISysBusState ehci[AW_A10_NUM_USB];
--    uint32_t regs[ASPEED_SCU_NR_REGS];
+     OHCISysBusState ohci[AW_A10_NUM_USB];
-+    uint32_t regs[ASPEED_AST2600_SCU_NR_REGS];
+diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
      uint32_t silicon_rev;
      uint32_t hw_strap1;
      uint32_t hw_strap2;
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
  #define AST2400_A1_SILICON_REV   0x02010303U
  #define AST2500_A0_SILICON_REV   0x04000303U
  #define AST2500_A1_SILICON_REV   0x04010303U
 +#define AST2600_A0_SILICON_REV   0x05000303U
  #define ASPEED_IS_AST2500(si_rev)     ((((si_rev) >> 24) & 0xff) == 0x04)
@@ -XXX,XX +XXX,XX @@ typedef struct  AspeedSCUClass {
      const uint32_t *resets;
      uint32_t (*calc_hpll)(AspeedSCUState *s, uint32_t hpll_reg);
      uint32_t apb_divider;
 +    uint32_t nr_regs;
 +    const MemoryRegionOps *ops;
  }  AspeedSCUClass;
  #define ASPEED_SCU_PROT_KEY      0x1688A8A8
 diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/aspeed_scu.c
+--- a/include/hw/arm/allwinner-h3.h
-+++ b/hw/misc/aspeed_scu.c
++++ b/include/hw/arm/allwinner-h3.h
 @@ -XXX,XX +XXX,XX @@
- #define BMC_REV              TO_REG(0x19C)
+ #include "hw/misc/allwinner-sid.h"
- #define BMC_DEV_ID           TO_REG(0x1A4)
+ #include "hw/sd/allwinner-sdhost.h"
+ #include "hw/net/allwinner-sun8i-emac.h"
-+#define AST2600_PROT_KEY          TO_REG(0x00)
++#include "hw/rtc/allwinner-rtc.h"
-+#define AST2600_SILICON_REV       TO_REG(0x04)
+ #include "target/arm/cpu.h"
-+#define AST2600_SILICON_REV2      TO_REG(0x14)
+ #include "sysemu/block-backend.h"
-+#define AST2600_SYS_RST_CTRL      TO_REG(0x40)
-+#define AST2600_SYS_RST_CTRL_CLR  TO_REG(0x44)
+@@ -XXX,XX +XXX,XX @@ enum {
-+#define AST2600_SYS_RST_CTRL2     TO_REG(0x50)
+     AW_H3_GIC_CPU,
-+#define AST2600_SYS_RST_CTRL2_CLR TO_REG(0x54)
+     AW_H3_GIC_HYP,
-+#define AST2600_CLK_STOP_CTRL     TO_REG(0x80)
+     AW_H3_GIC_VCPU,
-+#define AST2600_CLK_STOP_CTRL_CLR TO_REG(0x84)
++    AW_H3_RTC,
-+#define AST2600_CLK_STOP_CTRL2     TO_REG(0x90)
+     AW_H3_CPUCFG,
-+#define AST2600_CLK_STOP_CTR2L_CLR TO_REG(0x94)
+     AW_H3_SDRAM
 +#define AST2600_HPLL_PARAM        TO_REG(0x200)
 +#define AST2600_HPLL_EXT          TO_REG(0x204)
 +#define AST2600_MPLL_EXT          TO_REG(0x224)
 +#define AST2600_EPLL_EXT          TO_REG(0x244)
 +#define AST2600_CLK_SEL           TO_REG(0x300)
 +#define AST2600_CLK_SEL2          TO_REG(0x304)
 +#define AST2600_CLK_SEL3          TO_REG(0x310)
 +#define AST2600_HW_STRAP1         TO_REG(0x500)
 +#define AST2600_HW_STRAP1_CLR     TO_REG(0x504)
 +#define AST2600_HW_STRAP1_PROT    TO_REG(0x508)
 +#define AST2600_HW_STRAP2         TO_REG(0x510)
 +#define AST2600_HW_STRAP2_CLR     TO_REG(0x514)
 +#define AST2600_HW_STRAP2_PROT    TO_REG(0x518)
 +#define AST2600_RNG_CTRL          TO_REG(0x524)
 +#define AST2600_RNG_DATA          TO_REG(0x540)
 +
 +#define AST2600_CLK TO_REG(0x40)
 +
  #define SCU_IO_REGION_SIZE 0x1000
  static const uint32_t ast2400_a0_resets[ASPEED_SCU_NR_REGS] = {
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_scu_read(void *opaque, hwaddr offset, unsigned size)
      AspeedSCUState *s = ASPEED_SCU(opaque);
      int reg = TO_REG(offset);
 -    if (reg >= ARRAY_SIZE(s->regs)) {
 +    if (reg >= ASPEED_SCU_NR_REGS) {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
                        __func__, offset);
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
      AspeedSCUState *s = ASPEED_SCU(opaque);
      int reg = TO_REG(offset);
 -    if (reg >= ARRAY_SIZE(s->regs)) {
 +    if (reg >= ASPEED_SCU_NR_REGS) {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
                        __func__, offset);
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_reset(DeviceState *dev)
      AspeedSCUState *s = ASPEED_SCU(dev);
      AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
 -    memcpy(s->regs, asc->resets, sizeof(s->regs));
 +    memcpy(s->regs, asc->resets, asc->nr_regs * 4);
      s->regs[SILICON_REV] = s->silicon_rev;
      s->regs[HW_STRAP1] = s->hw_strap1;
      s->regs[HW_STRAP2] = s->hw_strap2;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_silicon_revs[] = {
      AST2400_A1_SILICON_REV,
      AST2500_A0_SILICON_REV,
      AST2500_A1_SILICON_REV,
 +    AST2600_A0_SILICON_REV,
  };
+@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
- bool is_supported_silicon_rev(uint32_t silicon_rev)
+     AwSidState sid;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_realize(DeviceState *dev, Error **errp)
+     AwSdHostState mmc0;
      AwSun8iEmacState emac;
 +    AwRtcState rtc;
      GICState gic;
      MemoryRegion sram_a1;
      MemoryRegion sram_a2;
 diff --git a/include/hw/rtc/allwinner-rtc.h b/include/hw/rtc/allwinner-rtc.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/rtc/allwinner-rtc.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Allwinner Real Time Clock emulation
 + *
 + * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
 + *
 + * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#ifndef HW_MISC_ALLWINNER_RTC_H
 +#define HW_MISC_ALLWINNER_RTC_H
 +
 +#include "qom/object.h"
 +#include "hw/sysbus.h"
 +
 +/**
 + * Constants
 + * @{
 + */
 +
 +/** Highest register address used by RTC device */
 +#define AW_RTC_REGS_MAXADDR     (0x200)
 +
 +/** Total number of known registers */
 +#define AW_RTC_REGS_NUM         (AW_RTC_REGS_MAXADDR / sizeof(uint32_t))
 +
 +/** @} */
 +
 +/**
 + * Object model types
 + * @{
 + */
 +
 +/** Generic Allwinner RTC device (abstract) */
 +#define TYPE_AW_RTC          "allwinner-rtc"
 +
 +/** Allwinner RTC sun4i family (A10, A12) */
 +#define TYPE_AW_RTC_SUN4I    TYPE_AW_RTC "-sun4i"
 +
 +/** Allwinner RTC sun6i family and newer (A31, H2+, H3, etc) */
 +#define TYPE_AW_RTC_SUN6I    TYPE_AW_RTC "-sun6i"
 +
 +/** Allwinner RTC sun7i family (A20) */
 +#define TYPE_AW_RTC_SUN7I    TYPE_AW_RTC "-sun7i"
 +
 +/** @} */
 +
 +/**
 + * Object model macros
 + * @{
 + */
 +
 +#define AW_RTC(obj) \
 +    OBJECT_CHECK(AwRtcState, (obj), TYPE_AW_RTC)
 +#define AW_RTC_CLASS(klass) \
 +     OBJECT_CLASS_CHECK(AwRtcClass, (klass), TYPE_AW_RTC)
 +#define AW_RTC_GET_CLASS(obj) \
 +     OBJECT_GET_CLASS(AwRtcClass, (obj), TYPE_AW_RTC)
 +
 +/** @} */
 +
 +/**
 + * Allwinner RTC per-object instance state.
 + */
 +typedef struct AwRtcState {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +    /*< public >*/
 +
 +    /**
 +     * Actual year represented by the device when year counter is zero
 +     *
 +     * Can be overridden by the user using the corresponding 'base-year'
 +     * property. The base year used by the target OS driver can vary, for
 +     * example the Linux driver for sun6i uses 1970 while NetBSD uses 2000.
 +     */
 +    int base_year;
 +
 +    /** Maps I/O registers in physical memory */
 +    MemoryRegion iomem;
 +
 +    /** Array of hardware registers */
 +    uint32_t regs[AW_RTC_REGS_NUM];
 +
 +} AwRtcState;
 +
 +/**
 + * Allwinner RTC class-level struct.
 + *
 + * This struct is filled by each sunxi device specific code
 + * such that the generic code can use this struct to support
 + * all devices.
 + */
 +typedef struct AwRtcClass {
 +    /*< private >*/
 +    SysBusDeviceClass parent_class;
 +    /*< public >*/
 +
 +    /** Defines device specific register map */
 +    const uint8_t *regmap;
 +
 +    /** Size of the regmap in bytes */
 +    size_t regmap_size;
 +
 +    /**
 +     * Read device specific register
 +     *
 +     * @offset: register offset to read
 +     * @return true if register read successful, false otherwise
 +     */
 +    bool (*read)(AwRtcState *s, uint32_t offset);
 +
 +    /**
 +     * Write device specific register
 +     *
 +     * @offset: register offset to write
 +     * @data: value to set in register
 +     * @return true if register write successful, false otherwise
 +     */
 +    bool (*write)(AwRtcState *s, uint32_t offset, uint32_t data);
 +
 +} AwRtcClass;
 +
 +#endif /* HW_MISC_ALLWINNER_RTC_H */
 diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/allwinner-a10.c
 +++ b/hw/arm/allwinner-a10.c
@@ -XXX,XX +XXX,XX @@
  #define AW_A10_EHCI_BASE        0x01c14000
  #define AW_A10_OHCI_BASE        0x01c14400
  #define AW_A10_SATA_BASE        0x01c18000
 +#define AW_A10_RTC_BASE         0x01c20d00
  static void aw_a10_init(Object *obj)
  {
-     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+@@ -XXX,XX +XXX,XX @@ static void aw_a10_init(Object *obj)
-     AspeedSCUState *s = ASPEED_SCU(dev);
-+    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
+     sysbus_init_child_obj(obj, "mmc0", &s->mmc0, sizeof(s->mmc0),
+                           TYPE_AW_SDHOST_SUN4I);
-     if (!is_supported_silicon_rev(s->silicon_rev)) {
++
-         error_setg(errp, "Unknown silicon revision: 0x%" PRIx32,
++    sysbus_init_child_obj(obj, "rtc", &s->rtc, sizeof(s->rtc),
-@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_realize(DeviceState *dev, Error **errp)
++                          TYPE_AW_RTC_SUN4I);
-         return;
+ }
-     }
+ static void aw_a10_realize(DeviceState *dev, Error **errp)
--    memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_scu_ops, s,
+@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
-+    memory_region_init_io(&s->iomem, OBJECT(s), asc->ops, s,
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->mmc0), 0, qdev_get_gpio_in(dev, 32));
-                           TYPE_ASPEED_SCU, SCU_IO_REGION_SIZE);
+     object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->mmc0),
+                               "sd-bus", &error_abort);
-     sysbus_init_mmio(sbd, &s->iomem);
++
-@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_realize(DeviceState *dev, Error **errp)
++    /* RTC */
++    qdev_init_nofail(DEVICE(&s->rtc));
- static const VMStateDescription vmstate_aspeed_scu = {
++    sysbus_mmio_map_overlap(SYS_BUS_DEVICE(&s->rtc), 0, AW_A10_RTC_BASE, 10);
-     .name = "aspeed.scu",
+ }
--    .version_id = 1,
--    .minimum_version_id = 1,
+ static void aw_a10_class_init(ObjectClass *oc, void *data)
-+    .version_id = 2,
+diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
-+    .minimum_version_id = 2,
+index XXXXXXX..XXXXXXX 100644
-     .fields = (VMStateField[]) {
+--- a/hw/arm/allwinner-h3.c
--        VMSTATE_UINT32_ARRAY(regs, AspeedSCUState, ASPEED_SCU_NR_REGS),
++++ b/hw/arm/allwinner-h3.c
-+        VMSTATE_UINT32_ARRAY(regs, AspeedSCUState, ASPEED_AST2600_SCU_NR_REGS),
+@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
-         VMSTATE_END_OF_LIST()
+     [AW_H3_GIC_CPU]    = 0x01c82000,
-     }
+     [AW_H3_GIC_HYP]    = 0x01c84000,
      [AW_H3_GIC_VCPU]   = 0x01c86000,
 +    [AW_H3_RTC]        = 0x01f00000,
      [AW_H3_CPUCFG]     = 0x01f01c00,
      [AW_H3_SDRAM]      = 0x40000000
  };
-@@ -XXX,XX +XXX,XX @@ static void aspeed_2400_scu_class_init(ObjectClass *klass, void *data)
+@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
-     asc->resets = ast2400_a0_resets;
+     { "csi",       0x01cb0000, 320 * KiB },
-     asc->calc_hpll = aspeed_2400_scu_calc_hpll;
+     { "tve",       0x01e00000, 64 * KiB },
-     asc->apb_divider = 2;
+     { "hdmi",      0x01ee0000, 128 * KiB },
-+    asc->nr_regs = ASPEED_SCU_NR_REGS;
+-    { "rtc",       0x01f00000, 1 * KiB },
-+    asc->ops = &aspeed_scu_ops;
+     { "r_timer",   0x01f00800, 1 * KiB },
      { "r_intc",    0x01f00c00, 1 * KiB },
      { "r_wdog",    0x01f01000, 1 * KiB },
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
                               "ram-addr", &error_abort);
      object_property_add_alias(obj, "ram-size", OBJECT(&s->dramc),
                                "ram-size", &error_abort);
 +
 +    sysbus_init_child_obj(obj, "rtc", &s->rtc, sizeof(s->rtc),
 +                          TYPE_AW_RTC_SUN6I);
  }
- static const TypeInfo aspeed_2400_scu_info = {
+ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
-@@ -XXX,XX +XXX,XX @@ static void aspeed_2500_scu_class_init(ObjectClass *klass, void *data)
+@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
-     asc->resets = ast2500_a1_resets;
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->dramc), 1, s->memmap[AW_H3_DRAMCTL]);
-     asc->calc_hpll = aspeed_2500_scu_calc_hpll;
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->dramc), 2, s->memmap[AW_H3_DRAMPHY]);
-     asc->apb_divider = 4;
-+    asc->nr_regs = ASPEED_SCU_NR_REGS;
++    /* RTC */
-+    asc->ops = &aspeed_scu_ops;
++    qdev_init_nofail(DEVICE(&s->rtc));
- }
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, s->memmap[AW_H3_RTC]);
++
- static const TypeInfo aspeed_2500_scu_info = {
+     /* Unimplemented devices */
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_2500_scu_info = {
+     for (i = 0; i < ARRAY_SIZE(unimplemented); i++) {
-     .class_init = aspeed_2500_scu_class_init,
+         create_unimplemented_device(unimplemented[i].device_name,
- };
+diff --git a/hw/rtc/allwinner-rtc.c b/hw/rtc/allwinner-rtc.c
+new file mode 100644
-+static uint64_t aspeed_ast2600_scu_read(void *opaque, hwaddr offset,
+index XXXXXXX..XXXXXXX
-+                                        unsigned size)
+--- /dev/null
-+{
++++ b/hw/rtc/allwinner-rtc.c
-+    AspeedSCUState *s = ASPEED_SCU(opaque);
+@@ -XXX,XX +XXX,XX @@
-+    int reg = TO_REG(offset);
++/*
-+
++ * Allwinner Real Time Clock emulation
-+    if (reg >= ASPEED_AST2600_SCU_NR_REGS) {
++ *
-+        qemu_log_mask(LOG_GUEST_ERROR,
++ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
-+                      "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
++ *
-+                      __func__, offset);
++ * This program is free software: you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation, either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/units.h"
 +#include "hw/sysbus.h"
 +#include "migration/vmstate.h"
 +#include "qemu/log.h"
 +#include "qemu/module.h"
 +#include "qemu-common.h"
 +#include "hw/qdev-properties.h"
 +#include "hw/rtc/allwinner-rtc.h"
 +#include "trace.h"
 +
 +/* RTC registers */
 +enum {
 +    REG_LOSC = 1,        /* Low Oscillator Control */
 +    REG_YYMMDD,          /* RTC Year-Month-Day */
 +    REG_HHMMSS,          /* RTC Hour-Minute-Second */
 +    REG_ALARM1_WKHHMMSS, /* Alarm1 Week Hour-Minute-Second */
 +    REG_ALARM1_EN,       /* Alarm1 Enable */
 +    REG_ALARM1_IRQ_EN,   /* Alarm1 IRQ Enable */
 +    REG_ALARM1_IRQ_STA,  /* Alarm1 IRQ Status */
 +    REG_GP0,             /* General Purpose Register 0 */
 +    REG_GP1,             /* General Purpose Register 1 */
 +    REG_GP2,             /* General Purpose Register 2 */
 +    REG_GP3,             /* General Purpose Register 3 */
 +
 +    /* sun4i registers */
 +    REG_ALARM1_DDHHMMSS, /* Alarm1 Day Hour-Minute-Second */
 +    REG_CPUCFG,          /* CPU Configuration Register */
 +
 +    /* sun6i registers */
 +    REG_LOSC_AUTOSTA,    /* LOSC Auto Switch Status */
 +    REG_INT_OSC_PRE,     /* Internal OSC Clock Prescaler */
 +    REG_ALARM0_COUNTER,  /* Alarm0 Counter */
 +    REG_ALARM0_CUR_VLU,  /* Alarm0 Counter Current Value */
 +    REG_ALARM0_ENABLE,   /* Alarm0 Enable */
 +    REG_ALARM0_IRQ_EN,   /* Alarm0 IRQ Enable */
 +    REG_ALARM0_IRQ_STA,  /* Alarm0 IRQ Status */
 +    REG_ALARM_CONFIG,    /* Alarm Config */
 +    REG_LOSC_OUT_GATING, /* LOSC Output Gating Register */
 +    REG_GP4,             /* General Purpose Register 4 */
 +    REG_GP5,             /* General Purpose Register 5 */
 +    REG_GP6,             /* General Purpose Register 6 */
 +    REG_GP7,             /* General Purpose Register 7 */
 +    REG_RTC_DBG,         /* RTC Debug Register */
 +    REG_GPL_HOLD_OUT,    /* GPL Hold Output Register */
 +    REG_VDD_RTC,         /* VDD RTC Regulate Register */
 +    REG_IC_CHARA,        /* IC Characteristics Register */
 +};
 +
 +/* RTC register flags */
 +enum {
 +    REG_LOSC_YMD   = (1 << 7),
 +    REG_LOSC_HMS   = (1 << 8),
 +};
 +
 +/* RTC sun4i register map (offset to name) */
 +const uint8_t allwinner_rtc_sun4i_regmap[] = {
 +    [0x0000] = REG_LOSC,
 +    [0x0004] = REG_YYMMDD,
 +    [0x0008] = REG_HHMMSS,
 +    [0x000C] = REG_ALARM1_DDHHMMSS,
 +    [0x0010] = REG_ALARM1_WKHHMMSS,
 +    [0x0014] = REG_ALARM1_EN,
 +    [0x0018] = REG_ALARM1_IRQ_EN,
 +    [0x001C] = REG_ALARM1_IRQ_STA,
 +    [0x0020] = REG_GP0,
 +    [0x0024] = REG_GP1,
 +    [0x0028] = REG_GP2,
 +    [0x002C] = REG_GP3,
 +    [0x003C] = REG_CPUCFG,
 +};
 +
 +/* RTC sun6i register map (offset to name) */
 +const uint8_t allwinner_rtc_sun6i_regmap[] = {
 +    [0x0000] = REG_LOSC,
 +    [0x0004] = REG_LOSC_AUTOSTA,
 +    [0x0008] = REG_INT_OSC_PRE,
 +    [0x0010] = REG_YYMMDD,
 +    [0x0014] = REG_HHMMSS,
 +    [0x0020] = REG_ALARM0_COUNTER,
 +    [0x0024] = REG_ALARM0_CUR_VLU,
 +    [0x0028] = REG_ALARM0_ENABLE,
 +    [0x002C] = REG_ALARM0_IRQ_EN,
 +    [0x0030] = REG_ALARM0_IRQ_STA,
 +    [0x0040] = REG_ALARM1_WKHHMMSS,
 +    [0x0044] = REG_ALARM1_EN,
 +    [0x0048] = REG_ALARM1_IRQ_EN,
 +    [0x004C] = REG_ALARM1_IRQ_STA,
 +    [0x0050] = REG_ALARM_CONFIG,
 +    [0x0060] = REG_LOSC_OUT_GATING,
 +    [0x0100] = REG_GP0,
 +    [0x0104] = REG_GP1,
 +    [0x0108] = REG_GP2,
 +    [0x010C] = REG_GP3,
 +    [0x0110] = REG_GP4,
 +    [0x0114] = REG_GP5,
 +    [0x0118] = REG_GP6,
 +    [0x011C] = REG_GP7,
 +    [0x0170] = REG_RTC_DBG,
 +    [0x0180] = REG_GPL_HOLD_OUT,
 +    [0x0190] = REG_VDD_RTC,
 +    [0x01F0] = REG_IC_CHARA,
 +};
 +
 +static bool allwinner_rtc_sun4i_read(AwRtcState *s, uint32_t offset)
 +{
 +    /* no sun4i specific registers currently implemented */
 +    return false;
 +}
 +
 +static bool allwinner_rtc_sun4i_write(AwRtcState *s, uint32_t offset,
 +                                      uint32_t data)
 +{
 +    /* no sun4i specific registers currently implemented */
 +    return false;
 +}
 +
 +static bool allwinner_rtc_sun6i_read(AwRtcState *s, uint32_t offset)
 +{
 +    const AwRtcClass *c = AW_RTC_GET_CLASS(s);
 +
 +    switch (c->regmap[offset]) {
 +    case REG_GP4:             /* General Purpose Register 4 */
 +    case REG_GP5:             /* General Purpose Register 5 */
 +    case REG_GP6:             /* General Purpose Register 6 */
 +    case REG_GP7:             /* General Purpose Register 7 */
 +        return true;
 +    default:
 +        break;
 +    }
 +    return false;
 +}
 +
 +static bool allwinner_rtc_sun6i_write(AwRtcState *s, uint32_t offset,
 +                                      uint32_t data)
 +{
 +    const AwRtcClass *c = AW_RTC_GET_CLASS(s);
 +
 +    switch (c->regmap[offset]) {
 +    case REG_GP4:             /* General Purpose Register 4 */
 +    case REG_GP5:             /* General Purpose Register 5 */
 +    case REG_GP6:             /* General Purpose Register 6 */
 +    case REG_GP7:             /* General Purpose Register 7 */
 +        return true;
 +    default:
 +        break;
 +    }
 +    return false;
 +}
 +
 +static uint64_t allwinner_rtc_read(void *opaque, hwaddr offset,
 +                                   unsigned size)
 +{
 +    AwRtcState *s = AW_RTC(opaque);
 +    const AwRtcClass *c = AW_RTC_GET_CLASS(s);
 +    uint64_t val = 0;
 +
 +    if (offset >= c->regmap_size) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
 +                      __func__, (uint32_t)offset);
 +        return 0;
 +    }
 +
-+    switch (reg) {
++    if (!c->regmap[offset]) {
-+    case AST2600_HPLL_EXT:
++            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid register 0x%04x\n",
-+    case AST2600_EPLL_EXT:
++                          __func__, (uint32_t)offset);
-+    case AST2600_MPLL_EXT:
++        return 0;
-+        /* PLLs are always "locked" */
++    }
-+        return s->regs[reg] | BIT(31);
++
-+    case AST2600_RNG_DATA:
++    switch (c->regmap[offset]) {
-+        /*
++    case REG_LOSC:       /* Low Oscillator Control */
-+         * On hardware, RNG_DATA works regardless of the state of the
++        val = s->regs[REG_LOSC];
-+         * enable bit in RNG_CTRL
++        s->regs[REG_LOSC] &= ~(REG_LOSC_YMD | REG_LOSC_HMS);
-+         *
++        break;
-+         * TODO: Check this is true for ast2600
++    case REG_YYMMDD:     /* RTC Year-Month-Day */
-+         */
++    case REG_HHMMSS:     /* RTC Hour-Minute-Second */
-+        s->regs[AST2600_RNG_DATA] = aspeed_scu_get_random();
++    case REG_GP0:        /* General Purpose Register 0 */
-+        break;
++    case REG_GP1:        /* General Purpose Register 1 */
-+    }
++    case REG_GP2:        /* General Purpose Register 2 */
-+
++    case REG_GP3:        /* General Purpose Register 3 */
-+    return s->regs[reg];
++        val = s->regs[c->regmap[offset]];
-+}
++        break;
-+
++    default:
-+static void aspeed_ast2600_scu_write(void *opaque, hwaddr offset, uint64_t data,
++        if (!c->read(s, offset)) {
-+                                     unsigned size)
++            qemu_log_mask(LOG_UNIMP, "%s: unimplemented register 0x%04x\n",
-+{
++                          __func__, (uint32_t)offset);
-+    AspeedSCUState *s = ASPEED_SCU(opaque);
++        }
-+    int reg = TO_REG(offset);
++        val = s->regs[c->regmap[offset]];
-+
++        break;
-+    if (reg >= ASPEED_AST2600_SCU_NR_REGS) {
++    }
-+        qemu_log_mask(LOG_GUEST_ERROR,
++
-+                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
++    trace_allwinner_rtc_read(offset, val);
-+                      __func__, offset);
++    return val;
 +}
 +
 +static void allwinner_rtc_write(void *opaque, hwaddr offset,
 +                                uint64_t val, unsigned size)
 +{
 +    AwRtcState *s = AW_RTC(opaque);
 +    const AwRtcClass *c = AW_RTC_GET_CLASS(s);
 +
 +    if (offset >= c->regmap_size) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
 +                      __func__, (uint32_t)offset);
 +        return;
 +    }
 +
-+    if (reg > PROT_KEY && !s->regs[PROT_KEY]) {
++    if (!c->regmap[offset]) {
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: SCU is locked!\n", __func__);
++            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid register 0x%04x\n",
-+    }
++                          __func__, (uint32_t)offset);
 +
 +    trace_aspeed_scu_write(offset, size, data);
 +
 +    switch (reg) {
 +    case AST2600_PROT_KEY:
 +        s->regs[reg] = (data == ASPEED_SCU_PROT_KEY) ? 1 : 0;
 +        return;
-+    case AST2600_HW_STRAP1:
++    }
-+    case AST2600_HW_STRAP2:
++
-+        if (s->regs[reg + 2]) {
++    trace_allwinner_rtc_write(offset, val);
-+            return;
++
 +    switch (c->regmap[offset]) {
 +    case REG_YYMMDD:     /* RTC Year-Month-Day */
 +        s->regs[REG_YYMMDD] = val;
 +        s->regs[REG_LOSC]  |= REG_LOSC_YMD;
 +        break;
 +    case REG_HHMMSS:     /* RTC Hour-Minute-Second */
 +        s->regs[REG_HHMMSS] = val;
 +        s->regs[REG_LOSC]  |= REG_LOSC_HMS;
 +        break;
 +    case REG_GP0:        /* General Purpose Register 0 */
 +    case REG_GP1:        /* General Purpose Register 1 */
 +    case REG_GP2:        /* General Purpose Register 2 */
 +    case REG_GP3:        /* General Purpose Register 3 */
 +        s->regs[c->regmap[offset]] = val;
 +        break;
 +    default:
 +        if (!c->write(s, offset, val)) {
 +            qemu_log_mask(LOG_UNIMP, "%s: unimplemented register 0x%04x\n",
 +                          __func__, (uint32_t)offset);
 +        }
-+        /* fall through */
++        break;
-+    case AST2600_SYS_RST_CTRL:
++    }
-+    case AST2600_SYS_RST_CTRL2:
++}
-+        /* W1S (Write 1 to set) registers */
++
-+        s->regs[reg] |= data;
++static const MemoryRegionOps allwinner_rtc_ops = {
-+        return;
++    .read = allwinner_rtc_read,
-+    case AST2600_SYS_RST_CTRL_CLR:
++    .write = allwinner_rtc_write,
-+    case AST2600_SYS_RST_CTRL2_CLR:
++    .endianness = DEVICE_NATIVE_ENDIAN,
-+    case AST2600_HW_STRAP1_CLR:
++    .valid = {
-+    case AST2600_HW_STRAP2_CLR:
++        .min_access_size = 4,
-+        /* W1C (Write 1 to clear) registers */
++        .max_access_size = 4,
-+        s->regs[reg] &= ~data;
++    },
-+        return;
++    .impl.min_access_size = 4,
-+
++};
-+    case AST2600_RNG_DATA:
++
-+    case AST2600_SILICON_REV:
++static void allwinner_rtc_reset(DeviceState *dev)
-+    case AST2600_SILICON_REV2:
++{
-+        /* Add read only registers here */
++    AwRtcState *s = AW_RTC(dev);
-+        qemu_log_mask(LOG_GUEST_ERROR,
++    struct tm now;
-+                      "%s: Write to read-only offset 0x%" HWADDR_PRIx "\n",
++
-+                      __func__, offset);
++    /* Clear registers */
-+        return;
++    memset(s->regs, 0, sizeof(s->regs));
-+    }
++
-+
++    /* Get current datetime */
-+    s->regs[reg] = data;
++    qemu_get_timedate(&now, 0);
-+}
++
-+
++    /* Set RTC with current datetime */
-+static const MemoryRegionOps aspeed_ast2600_scu_ops = {
++    if (s->base_year > 1900) {
-+    .read = aspeed_ast2600_scu_read,
++        s->regs[REG_YYMMDD] =  ((now.tm_year + 1900 - s->base_year) << 16) |
-+    .write = aspeed_ast2600_scu_write,
++                               ((now.tm_mon + 1) << 8) |
-+    .endianness = DEVICE_LITTLE_ENDIAN,
++                                 now.tm_mday;
-+    .valid.min_access_size = 4,
++        s->regs[REG_HHMMSS] = (((now.tm_wday + 6) % 7) << 29) |
-+    .valid.max_access_size = 4,
++                                  (now.tm_hour << 16) |
-+    .valid.unaligned = false,
++                                  (now.tm_min << 8) |
-+};
++                                   now.tm_sec;
-+
++    }
-+static const uint32_t ast2600_a0_resets[ASPEED_AST2600_SCU_NR_REGS] = {
++}
-+    [AST2600_SILICON_REV]       = AST2600_SILICON_REV,
++
-+    [AST2600_SILICON_REV2]      = AST2600_SILICON_REV,
++static void allwinner_rtc_init(Object *obj)
-+    [AST2600_SYS_RST_CTRL]      = 0xF7CFFEDC | 0x100,
++{
-+    [AST2600_SYS_RST_CTRL2]     = 0xFFFFFFFC,
++    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-+    [AST2600_CLK_STOP_CTRL]     = 0xEFF43E8B,
++    AwRtcState *s = AW_RTC(obj);
-+    [AST2600_CLK_STOP_CTRL2]    = 0xFFF0FFF0,
++
-+    [AST2600_HPLL_PARAM]        = 0x1000405F,
++    /* Memory mapping */
-+};
++    memory_region_init_io(&s->iomem, OBJECT(s), &allwinner_rtc_ops, s,
-+
++                          TYPE_AW_RTC, 1 * KiB);
-+static void aspeed_ast2600_scu_reset(DeviceState *dev)
++    sysbus_init_mmio(sbd, &s->iomem);
-+{
++}
-+    AspeedSCUState *s = ASPEED_SCU(dev);
++
-+    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
++static const VMStateDescription allwinner_rtc_vmstate = {
-+
++    .name = "allwinner-rtc",
-+    memcpy(s->regs, asc->resets, asc->nr_regs * 4);
++    .version_id = 1,
-+
++    .minimum_version_id = 1,
-+    s->regs[AST2600_SILICON_REV] = s->silicon_rev;
++    .fields = (VMStateField[]) {
-+    s->regs[AST2600_SILICON_REV2] = s->silicon_rev;
++        VMSTATE_UINT32_ARRAY(regs, AwRtcState, AW_RTC_REGS_NUM),
-+    s->regs[AST2600_HW_STRAP1] = s->hw_strap1;
++        VMSTATE_END_OF_LIST()
-+    s->regs[AST2600_HW_STRAP2] = s->hw_strap2;
++    }
-+    s->regs[PROT_KEY] = s->hw_prot_key;
++};
-+}
++
-+
++static Property allwinner_rtc_properties[] = {
-+static void aspeed_2600_scu_class_init(ObjectClass *klass, void *data)
++    DEFINE_PROP_INT32("base-year", AwRtcState, base_year, 0),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void allwinner_rtc_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
-+    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
++
-+
++    dc->reset = allwinner_rtc_reset;
-+    dc->desc = "ASPEED 2600 System Control Unit";
++    dc->vmsd = &allwinner_rtc_vmstate;
-+    dc->reset = aspeed_ast2600_scu_reset;
++    device_class_set_props(dc, allwinner_rtc_properties);
-+    asc->resets = ast2600_a0_resets;
++}
-+    asc->calc_hpll = aspeed_2500_scu_calc_hpll; /* No change since AST2500 */
++
-+    asc->apb_divider = 4;
++static void allwinner_rtc_sun4i_init(Object *obj)
-+    asc->nr_regs = ASPEED_AST2600_SCU_NR_REGS;
++{
-+    asc->ops = &aspeed_ast2600_scu_ops;
++    AwRtcState *s = AW_RTC(obj);
-+}
++    s->base_year = 2010;
-+
++}
-+static const TypeInfo aspeed_2600_scu_info = {
++
-+    .name = TYPE_ASPEED_2600_SCU,
++static void allwinner_rtc_sun4i_class_init(ObjectClass *klass, void *data)
-+    .parent = TYPE_ASPEED_SCU,
++{
-+    .instance_size = sizeof(AspeedSCUState),
++    AwRtcClass *arc = AW_RTC_CLASS(klass);
-+    .class_init = aspeed_2600_scu_class_init,
++
-+};
++    arc->regmap = allwinner_rtc_sun4i_regmap;
-+
++    arc->regmap_size = sizeof(allwinner_rtc_sun4i_regmap);
- static void aspeed_scu_register_types(void)
++    arc->read = allwinner_rtc_sun4i_read;
- {
++    arc->write = allwinner_rtc_sun4i_write;
-     type_register_static(&aspeed_scu_info);
++}
-     type_register_static(&aspeed_2400_scu_info);
++
-     type_register_static(&aspeed_2500_scu_info);
++static void allwinner_rtc_sun6i_init(Object *obj)
-+    type_register_static(&aspeed_2600_scu_info);
++{
- }
++    AwRtcState *s = AW_RTC(obj);
++    s->base_year = 1970;
- type_init(aspeed_scu_register_types);
++}
 +
 +static void allwinner_rtc_sun6i_class_init(ObjectClass *klass, void *data)
 +{
 +    AwRtcClass *arc = AW_RTC_CLASS(klass);
 +
 +    arc->regmap = allwinner_rtc_sun6i_regmap;
 +    arc->regmap_size = sizeof(allwinner_rtc_sun6i_regmap);
 +    arc->read = allwinner_rtc_sun6i_read;
 +    arc->write = allwinner_rtc_sun6i_write;
 +}
 +
 +static void allwinner_rtc_sun7i_init(Object *obj)
 +{
 +    AwRtcState *s = AW_RTC(obj);
 +    s->base_year = 1970;
 +}
 +
 +static void allwinner_rtc_sun7i_class_init(ObjectClass *klass, void *data)
 +{
 +    AwRtcClass *arc = AW_RTC_CLASS(klass);
 +    allwinner_rtc_sun4i_class_init(klass, arc);
 +}
 +
 +static const TypeInfo allwinner_rtc_info = {
 +    .name          = TYPE_AW_RTC,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_init = allwinner_rtc_init,
 +    .instance_size = sizeof(AwRtcState),
 +    .class_init    = allwinner_rtc_class_init,
 +    .class_size    = sizeof(AwRtcClass),
 +    .abstract      = true,
 +};
 +
 +static const TypeInfo allwinner_rtc_sun4i_info = {
 +    .name          = TYPE_AW_RTC_SUN4I,
 +    .parent        = TYPE_AW_RTC,
 +    .class_init    = allwinner_rtc_sun4i_class_init,
 +    .instance_init = allwinner_rtc_sun4i_init,
 +};
 +
 +static const TypeInfo allwinner_rtc_sun6i_info = {
 +    .name          = TYPE_AW_RTC_SUN6I,
 +    .parent        = TYPE_AW_RTC,
 +    .class_init    = allwinner_rtc_sun6i_class_init,
 +    .instance_init = allwinner_rtc_sun6i_init,
 +};
 +
 +static const TypeInfo allwinner_rtc_sun7i_info = {
 +    .name          = TYPE_AW_RTC_SUN7I,
 +    .parent        = TYPE_AW_RTC,
 +    .class_init    = allwinner_rtc_sun7i_class_init,
 +    .instance_init = allwinner_rtc_sun7i_init,
 +};
 +
 +static void allwinner_rtc_register(void)
 +{
 +    type_register_static(&allwinner_rtc_info);
 +    type_register_static(&allwinner_rtc_sun4i_info);
 +    type_register_static(&allwinner_rtc_sun6i_info);
 +    type_register_static(&allwinner_rtc_sun7i_info);
 +}
 +
 +type_init(allwinner_rtc_register)
 diff --git a/hw/rtc/trace-events b/hw/rtc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/trace-events
 +++ b/hw/rtc/trace-events
@@ -XXX,XX +XXX,XX @@
  # See docs/devel/tracing.txt for syntax documentation.
 +# allwinner-rtc.c
 +allwinner_rtc_read(uint64_t addr, uint64_t value) "addr 0x%" PRIx64 " value 0x%" PRIx64
 +allwinner_rtc_write(uint64_t addr, uint64_t value) "addr 0x%" PRIx64 " value 0x%" PRIx64
 +
  # sun4v-rtc.c
  sun4v_rtc_read(uint64_t addr, uint64_t value) "read: addr 0x%" PRIx64 " value 0x%" PRIx64
  sun4v_rtc_write(uint64_t addr, uint64_t value) "write: addr 0x%" PRIx64 " value 0x%" PRIx64
 --
 .20.1

-[PULL 68/68] hw/misc/bcm2835_mbox: Add trace events
+[PULL 24/36] tests/boot_linux_console: Add a quick test for the OrangePi PC board
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Add trace events for read/write accesses and IRQ.
+This test boots a Linux kernel on a OrangePi PC board and verify
 the serial output is working.
-Properties are structures used for the ARM particular MBOX.
+The kernel image and DeviceTree blob are built by the Armbian
-Since one call in bcm2835_property.c concerns the mbox block,
+project (based on Debian):
-name this trace event in the same bcm2835_mbox* namespace.
+https://www.armbian.com/orange-pi-pc/
 If ARM is a target being built, "make check-acceptance" will
 automatically include this test by the use of the "arch:arm" tags.
 Alternatively, this test can be run using:
   $ make check-venv
   $ ./tests/venv/bin/avocado --show=console,app run -t machine:orangepi-pc tests/acceptance/boot_linux_console.py
   JOB ID     : 2e4d15eceb13c33672af406f08171e6e9de1414a
   JOB LOG    : ~/job-results/job-2019-12-17T05.46-2e4d15e/job.log
   (1/1) tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi:
   console: Uncompressing Linux... done, booting the kernel.
   console: Booting Linux on physical CPU 0x0
   console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
   console: CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
   console: CPU: div instructions available: patching division code
   console: CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
   console: OF: fdt: Machine model: Xunlong Orange Pi PC
   console: Memory policy: Data cache writealloc
   console: OF: reserved mem: failed to allocate memory for node 'cma@4a000000'
   console: cma: Failed to reserve 128 MiB
   console: psci: probing for conduit method from DT.
   console: psci: PSCIv0.2 detected in firmware.
   console: psci: Using standard PSCI v0.2 function IDs
   console: psci: Trusted OS migration not required
   console: random: get_random_bytes called from start_kernel+0x8d/0x3c2 with crng_init=0
   console: percpu: Embedded 18 pages/cpu @(ptrval) s41228 r8192 d24308 u73728
   console: Built 1 zonelists, mobility grouping on.  Total pages: 32480
   console: Kernel command line: printk.time=0 console=ttyS0,115200
   PASS (8.59 s)
   JOB TIME   : 8.81 s
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190926173428.10713-8-f4bug@amsat.org
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20200311221854.30370-14-nieklinnenbank@gmail.com
 [NL: rename in commit message Raspbian to Armbian, remove vm.set_machine()]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/bcm2835_mbox.c     | 5 +++++
+ tests/acceptance/boot_linux_console.py | 25 +++++++++++++++++++++++++
- hw/misc/bcm2835_property.c | 2 ++
+file changed, 25 insertions(+)
  hw/misc/trace-events       | 6 ++++++
 files changed, 13 insertions(+)
-diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
+diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/bcm2835_mbox.c
+--- a/tests/acceptance/boot_linux_console.py
-+++ b/hw/misc/bcm2835_mbox.c
++++ b/tests/acceptance/boot_linux_console.py
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
- #include "migration/vmstate.h"
+         exec_command_and_wait_for_pattern(self, 'reboot',
- #include "qemu/log.h"
+                                                 'reboot: Restarting system')
- #include "qemu/module.h"
-+#include "trace.h"
++    def test_arm_orangepi(self):
++        """
- #define MAIL0_PEEK   0x90
++        :avocado: tags=arch:arm
- #define MAIL0_SENDER 0x94
++        :avocado: tags=machine:orangepi-pc
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_mbox_update(BCM2835MboxState *s)
++        """
-             set = true;
++        deb_url = ('https://apt.armbian.com/pool/main/l/'
-         }
++                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
-     }
++        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
-+    trace_bcm2835_mbox_irq(set);
++        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
-     qemu_set_irq(s->arm_irq, set);
++        kernel_path = self.extract_from_deb(deb_path,
- }
++                                            '/boot/vmlinuz-4.20.7-sunxi')
++        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun8i-h3-orangepi-pc.dtb'
-@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size)
++        dtb_path = self.extract_from_deb(deb_path, dtb_path)
      default:
          qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx"\n",
                        __func__, offset);
 +        trace_bcm2835_mbox_read(size, offset, res);
          return 0;
      }
 +    trace_bcm2835_mbox_read(size, offset, res);
      bcm2835_mbox_update(s);
@@ -XXX,XX +XXX,XX @@ static void bcm2835_mbox_write(void *opaque, hwaddr offset,
      offset &= 0xff;
 +    trace_bcm2835_mbox_write(size, offset, value);
      switch (offset) {
      case MAIL0_SENDER:
          break;
 diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/bcm2835_property.c
 +++ b/hw/misc/bcm2835_property.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/dma.h"
  #include "qemu/log.h"
  #include "qemu/module.h"
 +#include "trace.h"
  /* https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface */
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
              break;
          }
 +        trace_bcm2835_mbox_property(tag, bufsize, resplen);
          if (tag == 0) {
              break;
          }
 diff --git a/hw/misc/trace-events b/hw/misc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ armsse_mhu_write(uint64_t offset, uint64_t data, unsigned size) "SSE-200 MHU wri
  # aspeed_xdma.c
  aspeed_xdma_write(uint64_t offset, uint64_t data) "XDMA write: offset 0x%" PRIx64 " data 0x%" PRIx64
 +
-+# bcm2835_mbox.c
++        self.vm.set_console()
-+bcm2835_mbox_write(unsigned int size, uint64_t addr, uint64_t value) "mbox write sz:%u addr:0x%"PRIx64" data:0x%"PRIx64
++        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-+bcm2835_mbox_read(unsigned int size, uint64_t addr, uint64_t value) "mbox read sz:%u addr:0x%"PRIx64" data:0x%"PRIx64
++                               'console=ttyS0,115200n8 '
-+bcm2835_mbox_irq(unsigned level) "mbox irq:ARM level:%u"
++                               'earlycon=uart,mmio32,0x1c28000')
-+bcm2835_mbox_property(uint32_t tag, uint32_t bufsize, size_t resplen) "mbox property tag:0x%08x in_sz:%u out_sz:%zu"
++        self.vm.add_args('-kernel', kernel_path,
 +                         '-dtb', dtb_path,
 +                         '-append', kernel_command_line)
 +        self.vm.launch()
 +        console_pattern = 'Kernel command line: %s' % kernel_command_line
 +        self.wait_for_console_pattern(console_pattern)
 +
      def test_s390x_s390_ccw_virtio(self):
          """
          :avocado: tags=arch:s390x
 --
 .20.1

-[PULL 66/68] hw/arm/bcm2835: Rename some definitions
+[PULL 25/36] tests/boot_linux_console: Add initrd test for the Orange Pi PC board
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The UART1 is part of the AUX peripheral,
+This test boots a Linux kernel on a OrangePi PC board and verify
-the PCM_CLOCK (yet unimplemented) is part of the CPRMAN.
+the serial output is working.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+The kernel image and DeviceTree blob are built by the Armbian
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+project (based on Debian):
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+https://www.armbian.com/orange-pi-pc/
 The cpio image used comes from the linux-build-test project:
 https://github.com/groeck/linux-build-test
 If ARM is a target being built, "make check-acceptance" will
 automatically include this test by the use of the "arch:arm" tags.
 Alternatively, this test can be run using:
   $ avocado --show=console run -t machine:orangepi-pc tests/acceptance/boot_linux_console.py
   console: Uncompressing Linux... done, booting the kernel.
   console: Booting Linux on physical CPU 0x0
   console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
   console: CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
   console: CPU: div instructions available: patching division code
   console: CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
   console: OF: fdt: Machine model: Xunlong Orange Pi PC
   [...]
   console: Trying to unpack rootfs image as initramfs...
   console: Freeing initrd memory: 3256K
   console: Freeing unused kernel memory: 1024K
   console: Run /init as init process
   console: mount: mounting devtmpfs on /dev failed: Device or resource busy
   console: Starting logging: OK
   console: Initializing random number generator... random: dd: uninitialized urandom read (512 bytes read)
   console: done.
   console: Starting network: OK
   console: Found console ttyS0
   console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
   console: Boot successful.
   console: cat /proc/cpuinfo
   console: / # cat /proc/cpuinfo
   console: processor      : 0
   console: model name     : ARMv7 Processor rev 5 (v7l)
   console: BogoMIPS       : 125.00
   console: Features       : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
   console: CPU implementer        : 0x41
   console: CPU architecture: 7
   console: CPU variant    : 0x0
   console: CPU part       : 0xc07
   console: CPU revision   : 5
   [...]
   console: processor      : 3
   console: model name     : ARMv7 Processor rev 5 (v7l)
   console: BogoMIPS       : 125.00
   console: Features       : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
   console: CPU implementer        : 0x41
   console: CPU architecture: 7
   console: CPU variant    : 0x0
   console: CPU part       : 0xc07
   console: CPU revision   : 5
   console: Hardware       : Allwinner sun8i Family
   console: Revision       : 0000
   console: Serial         : 0000000000000000
   console: cat /proc/iomem
   console: / # cat /proc/iomem
   console: 01000000-010fffff : clock@1000000
   console: 01c00000-01c00fff : system-control@1c00000
   console: 01c02000-01c02fff : dma-controller@1c02000
   [...]
   console: reboot
   console: / # reboot
   console: / # Found console ttyS0
   console: Stopping network: OK
   console: hrtimer: interrupt took 21852064 ns
   console: Saving random seed... random: dd: uninitialized urandom read (512 bytes read)
   console: done.
   console: Stopping logging: OK
   console: umount: devtmpfs busy - remounted read-only
   console: umount: can't unmount /: Invalid argument
   console: The system is going down NOW!
   console: Sent SIGTERM to all processes
   console: Sent SIGKILL to all processes
   console: Requesting system reboot
   console: reboot: Restarting system
   PASS (48.32 s)
   JOB TIME   : 49.16 s
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190926173428.10713-5-f4bug@amsat.org
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20200311221854.30370-15-nieklinnenbank@gmail.com
 [NL: rename in commit message Raspbian to Armbian, remove vm.set_machine()]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/raspi_platform.h | 16 +++++++---------
+ tests/acceptance/boot_linux_console.py | 40 ++++++++++++++++++++++++++
- hw/arm/bcm2835_peripherals.c    |  7 ++++---
+file changed, 40 insertions(+)
  hw/arm/bcm2836.c                |  2 +-
 files changed, 12 insertions(+), 13 deletions(-)
-diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
+diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/raspi_platform.h
+--- a/tests/acceptance/boot_linux_console.py
-+++ b/include/hw/arm/raspi_platform.h
++++ b/tests/acceptance/boot_linux_console.py
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
- #ifndef HW_ARM_RASPI_PLATFORM_H
+         console_pattern = 'Kernel command line: %s' % kernel_command_line
- #define HW_ARM_RASPI_PLATFORM_H
+         self.wait_for_console_pattern(console_pattern)
--#define MCORE_OFFSET            0x0000   /* Fake frame buffer device
++    def test_arm_orangepi_initrd(self):
--                                          * (the multicore sync block) */
++        """
-+#define MSYNC_OFFSET            0x0000   /* Multicore Sync Block */
++        :avocado: tags=arch:arm
- #define IC0_OFFSET              0x2000
++        :avocado: tags=machine:orangepi-pc
- #define ST_OFFSET               0x3000   /* System Timer */
++        """
- #define MPHI_OFFSET             0x6000   /* Message-based Parallel Host Intf. */
++        deb_url = ('https://apt.armbian.com/pool/main/l/'
-@@ -XXX,XX +XXX,XX @@
++                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
- #define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 */
++        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
- #define ARMCTRL_0_SBM_OFFSET    (ARM_OFFSET + 0x800) /* User 0 (ARM) Semaphores
++        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
-                                                       * Doorbells & Mailboxes */
++        kernel_path = self.extract_from_deb(deb_path,
--#define PM_OFFSET               0x100000 /* Power Management, Reset controller
++                                            '/boot/vmlinuz-4.20.7-sunxi')
--                                          * and Watchdog registers */
++        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun8i-h3-orangepi-pc.dtb'
--#define PCM_CLOCK_OFFSET        0x101098
++        dtb_path = self.extract_from_deb(deb_path, dtb_path)
-+#define CPRMAN_OFFSET           0x100000 /* Power Management, Watchdog */
++        initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
-+#define CM_OFFSET               0x101000 /* Clock Management */
++                      '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
- #define RNG_OFFSET              0x104000
++                      'arm/rootfs-armv7a.cpio.gz')
- #define GPIO_OFFSET             0x200000
++        initrd_hash = '604b2e45cdf35045846b8bbfbf2129b1891bdc9c'
- #define UART0_OFFSET            0x201000
++        initrd_path_gz = self.fetch_asset(initrd_url, asset_hash=initrd_hash)
-@@ -XXX,XX +XXX,XX @@
++        initrd_path = os.path.join(self.workdir, 'rootfs.cpio')
- #define I2S_OFFSET              0x203000
++        archive.gzip_uncompress(initrd_path_gz, initrd_path)
  #define SPI0_OFFSET             0x204000
  #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
 -#define UART1_OFFSET            0x215000
 -#define EMMC_OFFSET             0x300000
 +#define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
 +#define EMMC1_OFFSET            0x300000
  #define SMI_OFFSET              0x600000
  #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
 -#define USB_OFFSET              0x980000 /* DTC_OTG USB controller */
 +#define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
  #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
  /* GPU interrupts */
@@ -XXX,XX +XXX,XX @@
  #define INTERRUPT_SPI                  54
  #define INTERRUPT_I2SPCM               55
  #define INTERRUPT_SDIO                 56
 -#define INTERRUPT_UART                 57
 +#define INTERRUPT_UART0                57
  #define INTERRUPT_SLIMBUS              58
  #define INTERRUPT_VEC                  59
  #define INTERRUPT_CPG                  60
 diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/bcm2835_peripherals.c
 +++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
                  sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart0), 0));
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart0), 0,
          qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
 -                               INTERRUPT_UART));
 +                               INTERRUPT_UART0));
 +
-     /* AUX / UART1 */
++        self.vm.set_console()
-     qdev_prop_set_chr(DEVICE(&s->aux), "chardev", serial_hd(1));
++        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
++                               'console=ttyS0,115200 '
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
++                               'panic=-1 noreboot')
-         return;
++        self.vm.add_args('-kernel', kernel_path,
-     }
++                         '-dtb', dtb_path,
++                         '-initrd', initrd_path,
--    memory_region_add_subregion(&s->peri_mr, UART1_OFFSET,
++                         '-append', kernel_command_line,
-+    memory_region_add_subregion(&s->peri_mr, AUX_OFFSET,
++                         '-no-reboot')
-                 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->aux), 0));
++        self.vm.launch()
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->aux), 0,
++        self.wait_for_console_pattern('Boot successful.')
-         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
++
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
++        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
-         return;
++                                                'Allwinner sun8i Family')
-     }
++        exec_command_and_wait_for_pattern(self, 'cat /proc/iomem',
++                                                'system-control@1c00000')
--    memory_region_add_subregion(&s->peri_mr, EMMC_OFFSET,
++        exec_command_and_wait_for_pattern(self, 'reboot',
-+    memory_region_add_subregion(&s->peri_mr, EMMC1_OFFSET,
++                                                'reboot: Restarting system')
-                 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->sdhci), 0));
++
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
+     def test_s390x_s390_ccw_virtio(self):
-         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
+         """
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+         :avocado: tags=arch:s390x
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/bcm2836.c
 +++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
          /* set periphbase/CBAR value for CPU-local registers */
          object_property_set_int(OBJECT(&s->cpus[n]),
 -                                BCM2836_PERI_BASE + MCORE_OFFSET,
 +                                BCM2836_PERI_BASE + MSYNC_OFFSET,
                                  "reset-cbar", &err);
          if (err) {
              error_propagate(errp, err);
 --
 .20.1

-[PULL 65/68] hw/arm/bcm2835_peripherals: Name various address spaces
+[PULL 26/36] tests/boot_linux_console: Add a SD card test for the OrangePi PC board
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Various address spaces from the BCM2835 are reported as
+The kernel image and DeviceTree blob are built by the Armbian
-'anonymous' in memory tree:
+project (based on Debian):
 https://www.armbian.com/orange-pi-pc/
-  (qemu) info mtree
+The SD image is from the kernelci.org project:
 https://kernelci.org/faq/#the-code
-  address-space: anonymous
+If ARM is a target being built, "make check-acceptance" will
-    0000000000000000-000000000000008f (prio 0, i/o): bcm2835-mbox
+automatically include this test by the use of the "arch:arm" tags.
       0000000000000010-000000000000001f (prio 0, i/o): bcm2835-fb
       0000000000000080-000000000000008f (prio 0, i/o): bcm2835-property
-  address-space: anonymous
+Alternatively, this test can be run using:
     0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
       0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
       0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
       000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
       0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
       00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  $ avocado --show=console run -t machine:orangepi-pc tests/acceptance/boot_linux_console.py
+  console: Uncompressing Linux... done, booting the kernel.
+  console: Booting Linux on physical CPU 0x0
+  console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
+  console: CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
   [...]
+  console: sunxi-wdt 1c20ca0.watchdog: Watchdog enabled (timeout=16 sec, nowayout=0)
-Since the address_space_init() function takes a 'name' argument,
+  console: sunxi-mmc 1c0f000.mmc: Linked as a consumer to regulator.2
-set it to correctly describe each address space:
+  console: sunxi-mmc 1c0f000.mmc: Got CD GPIO
+  console: ledtrig-cpu: registered to indicate activity on CPUs
-  (qemu) info mtree
+  console: hidraw: raw HID events driver (C) Jiri Kosina
+  console: usbcore: registered new interface driver usbhid
-  address-space: bcm2835-mbox-memory
+  console: usbhid: USB HID core driver
-    0000000000000000-000000000000008f (prio 0, i/o): bcm2835-mbox
+  console: Initializing XFRM netlink socket
-      0000000000000010-000000000000001f (prio 0, i/o): bcm2835-fb
+  console: sunxi-mmc 1c0f000.mmc: initialized, max. request size: 16384 KB
-      0000000000000080-000000000000008f (prio 0, i/o): bcm2835-property
+  console: NET: Registered protocol family 10
+  console: mmc0: host does not support reading read-only switch, assuming write-enable
-  address-space: bcm2835-fb-memory
+  console: mmc0: Problem switching card into high-speed mode!
-    0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
+  console: mmc0: new SD card at address 4567
-      0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  console: mmcblk0: mmc0:4567 QEMU! 60.0 MiB
-      0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  [...]
-      000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
+  console: EXT4-fs (mmcblk0): mounting ext2 file system using the ext4 subsystem
-      0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  console: EXT4-fs (mmcblk0): mounted filesystem without journal. Opts: (null)
-      00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  console: VFS: Mounted root (ext2 filesystem) on device 179:0.
+  console: Run /sbin/init as init process
-  address-space: bcm2835-property-memory
+  console: EXT4-fs (mmcblk0): re-mounted. Opts: block_validity,barrier,user_xattr,acl
-    0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
+  console: Starting syslogd: OK
-      0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  console: Starting klogd: OK
-      0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  console: Populating /dev using udev: udevd[203]: starting version 3.2.7
-      000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
+  console: /bin/sh: can't access tty; job control turned off
-      0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  console: cat /proc/partitions
-      00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  console: / # cat /proc/partitions
+  console: major minor  #blocks  name
-  address-space: bcm2835-dma-memory
+  console: 1        0       4096 ram0
-    0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
+  console: 1        1       4096 ram1
-      0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  console: 1        2       4096 ram2
-      0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  console: 1        3       4096 ram3
-      000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
+  console: 179        0      61440 mmcblk0
-      0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  console: reboot
-      00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
+  console: / # reboot
   console: umount: devtmpfs busy - remounted read-only
   console: EXT4-fs (mmcblk0): re-mounted. Opts: (null)
   console: The system is going down NOW!
   console: Sent SIGTERM to all processes
   console: Sent SIGKILL to all processes
   console: Requesting system reboot
   console: reboot: Restarting system
   JOB TIME   : 68.64 s
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Cleber Rosa <crosa@redhat.com>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190926173428.10713-4-f4bug@amsat.org
+Message-id: 20200311221854.30370-16-nieklinnenbank@gmail.com
 [NL: rename in commit message Raspbian to Armbian, remove vm.set_machine()]
 [NL: extend test with ethernet device checks]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/display/bcm2835_fb.c    | 2 +-
+ tests/acceptance/boot_linux_console.py | 47 ++++++++++++++++++++++++++
- hw/dma/bcm2835_dma.c       | 2 +-
+file changed, 47 insertions(+)
  hw/misc/bcm2835_mbox.c     | 2 +-
  hw/misc/bcm2835_property.c | 2 +-
 files changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/display/bcm2835_fb.c b/hw/display/bcm2835_fb.c
+diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
 index XXXXXXX..XXXXXXX 100644
---- a/hw/display/bcm2835_fb.c
+--- a/tests/acceptance/boot_linux_console.py
-+++ b/hw/display/bcm2835_fb.c
++++ b/tests/acceptance/boot_linux_console.py
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_fb_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
-     s->initial_config.base = s->vcram_base + BCM2835_FB_OFFSET;
+         exec_command_and_wait_for_pattern(self, 'reboot',
+                                                 'reboot: Restarting system')
-     s->dma_mr = MEMORY_REGION(obj);
--    address_space_init(&s->dma_as, s->dma_mr, NULL);
++    def test_arm_orangepi_sd(self):
-+    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_FB "-memory");
++        """
++        :avocado: tags=arch:arm
-     bcm2835_fb_reset(dev);
++        :avocado: tags=machine:orangepi-pc
++        """
-diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
++        deb_url = ('https://apt.armbian.com/pool/main/l/'
-index XXXXXXX..XXXXXXX 100644
++                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
---- a/hw/dma/bcm2835_dma.c
++        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
-+++ b/hw/dma/bcm2835_dma.c
++        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_dma_realize(DeviceState *dev, Error **errp)
++        kernel_path = self.extract_from_deb(deb_path,
-     }
++                                            '/boot/vmlinuz-4.20.7-sunxi')
++        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun8i-h3-orangepi-pc.dtb'
-     s->dma_mr = MEMORY_REGION(obj);
++        dtb_path = self.extract_from_deb(deb_path, dtb_path)
--    address_space_init(&s->dma_as, s->dma_mr, NULL);
++        rootfs_url = ('http://storage.kernelci.org/images/rootfs/buildroot/'
-+    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_DMA "-memory");
++                      'kci-2019.02/armel/base/rootfs.ext2.xz')
++        rootfs_hash = '692510cb625efda31640d1de0a8d60e26040f061'
-     bcm2835_dma_reset(dev);
++        rootfs_path_xz = self.fetch_asset(rootfs_url, asset_hash=rootfs_hash)
- }
++        rootfs_path = os.path.join(self.workdir, 'rootfs.cpio')
-diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
++        archive.lzma_uncompress(rootfs_path_xz, rootfs_path)
-index XXXXXXX..XXXXXXX 100644
++
---- a/hw/misc/bcm2835_mbox.c
++        self.vm.set_console()
-+++ b/hw/misc/bcm2835_mbox.c
++        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_mbox_realize(DeviceState *dev, Error **errp)
++                               'console=ttyS0,115200 '
-     }
++                               'root=/dev/mmcblk0 rootwait rw '
++                               'panic=-1 noreboot')
-     s->mbox_mr = MEMORY_REGION(obj);
++        self.vm.add_args('-kernel', kernel_path,
--    address_space_init(&s->mbox_as, s->mbox_mr, NULL);
++                         '-dtb', dtb_path,
-+    address_space_init(&s->mbox_as, s->mbox_mr, TYPE_BCM2835_MBOX "-memory");
++                         '-drive', 'file=' + rootfs_path + ',if=sd,format=raw',
-     bcm2835_mbox_reset(dev);
++                         '-append', kernel_command_line,
- }
++                         '-no-reboot')
++        self.vm.launch()
-diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
++        shell_ready = "/bin/sh: can't access tty; job control turned off"
-index XXXXXXX..XXXXXXX 100644
++        self.wait_for_console_pattern(shell_ready)
---- a/hw/misc/bcm2835_property.c
++
-+++ b/hw/misc/bcm2835_property.c
++        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_realize(DeviceState *dev, Error **errp)
++                                                'Allwinner sun8i Family')
-     }
++        exec_command_and_wait_for_pattern(self, 'cat /proc/partitions',
++                                                'mmcblk0')
-     s->dma_mr = MEMORY_REGION(obj);
++        exec_command_and_wait_for_pattern(self, 'ifconfig eth0 up',
--    address_space_init(&s->dma_as, s->dma_mr, NULL);
++                                                 'eth0: Link is Up')
-+    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_PROPERTY "-memory");
++        exec_command_and_wait_for_pattern(self, 'udhcpc eth0',
++            'udhcpc: lease of 10.0.2.15 obtained')
-     /* TODO: connect to MAC address of USB NIC device, once we emulate it */
++        exec_command_and_wait_for_pattern(self, 'ping -c 3 10.0.2.2',
-     qemu_macaddr_default_if_unset(&s->macaddr);
++            '3 packets transmitted, 3 packets received, 0% packet loss')
 +        exec_command_and_wait_for_pattern(self, 'reboot',
 +                                                'reboot: Restarting system')
 +
      def test_s390x_s390_ccw_virtio(self):
          """
          :avocado: tags=arch:s390x
 --
 .20.1

-[PULL 64/68] hw/arm/bcm2835_peripherals: Improve logging
+[PULL 27/36] tests/boot_linux_console: Add a SLOW test booting Ubuntu on OrangePi PC
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Various logging improvements as once:
+This test boots Ubuntu Bionic on a OrangePi PC board.
-- Use 0x prefix for hex numbers
-- Display value written during write accesses
+As it requires 1GB of storage, and is slow, this test is disabled
-- Move some logs from GUEST_ERROR to UNIMP
+on automatic CI testing.
 It is useful for workstation testing. Currently Avocado timeouts too
 quickly, so we can't run userland commands.
 The kernel image and DeviceTree blob are built by the Armbian
 project (based on Debian):
 https://www.armbian.com/orange-pi-pc/
 The Ubuntu image is downloaded from:
 https://dl.armbian.com/orangepipc/Bionic_current
 This test can be run using:
   $ AVOCADO_ALLOW_LARGE_STORAGE=yes \
     avocado --show=app,console run -t machine:orangepi-pc \
       tests/acceptance/boot_linux_console.py
   console: U-Boot SPL 2019.04-armbian (Nov 18 2019 - 23:08:35 +0100)
   console: DRAM: 1024 MiB
   console: Failed to set core voltage! Can't set CPU frequency
   console: Trying to boot from MMC1
   console: U-Boot 2019.04-armbian (Nov 18 2019 - 23:08:35 +0100) Allwinner Technology
   console: CPU:   Allwinner H3 (SUN8I 0000)
   console: Model: Xunlong Orange Pi PC
   console: DRAM:  1 GiB
   console: MMC:   mmc@1c0f000: 0
   [...]
   console: Uncompressing Linux... done, booting the kernel.
   console: Booting Linux on physical CPU 0x0
   console: Linux version 5.3.9-sunxi (root@builder) (gcc version 8.3.0 (GNU Toolchain for the A-profile Architecture 8.3-2019.03 (arm-rel-8.36))) #19.11.3 SMP Mon Nov 18 18:49:43 CET 2019
   console: CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
   console: CPU: div instructions available: patching division code
   console: CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
   console: OF: fdt: Machine model: Xunlong Orange Pi PC
   [...]
   console: EXT4-fs (mmcblk0p1): mounted filesystem with writeback data mode. Opts: (null)
   console: done.
   console: Begin: Running /scripts/local-bottom ... done.
   console: Begin: Running /scripts/init-bottom ... done.
   console: systemd[1]: systemd 237 running in system mode. (...)
   console: systemd[1]: Detected architecture arm.
   console: Welcome to Ubuntu 18.04.3 LTS!
   console: systemd[1]: Set hostname to <orangepipc>.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Cleber Rosa <crosa@redhat.com>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190926173428.10713-3-f4bug@amsat.org
+Message-id: 20200311221854.30370-17-nieklinnenbank@gmail.com
 [NL: rename in commit message Raspbian to Armbian, remove vm.set_machine()]
 [NL: changed test to boot from SD card via BootROM, added check for 7z]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/bcm2835_aux.c      |  5 +++--
+ tests/acceptance/boot_linux_console.py | 48 ++++++++++++++++++++++++++
- hw/dma/bcm2835_dma.c       |  8 ++++----
+file changed, 48 insertions(+)
  hw/intc/bcm2836_control.c  |  7 ++++---
  hw/misc/bcm2835_mbox.c     |  7 ++++---
  hw/misc/bcm2835_property.c | 16 ++++++++++------
 files changed, 25 insertions(+), 18 deletions(-)
-diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
+diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/bcm2835_aux.c
+--- a/tests/acceptance/boot_linux_console.py
-+++ b/hw/char/bcm2835_aux.c
++++ b/tests/acceptance/boot_linux_console.py
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_aux_write(void *opaque, hwaddr offset, uint64_t value,
+@@ -XXX,XX +XXX,XX @@ from avocado_qemu import exec_command_and_wait_for_pattern
-     switch (offset) {
+ from avocado_qemu import wait_for_console_pattern
-     case AUX_ENABLES:
+ from avocado.utils import process
-         if (value != 1) {
+ from avocado.utils import archive
--            qemu_log_mask(LOG_UNIMP, "%s: unsupported attempt to enable SPI "
++from avocado.utils.path import find_command, CmdNotFoundError
--                          "or disable UART\n", __func__);
-+            qemu_log_mask(LOG_UNIMP, "%s: unsupported attempt to enable SPI"
++P7ZIP_AVAILABLE = True
-+                                     " or disable UART: 0x%"PRIx64"\n",
++try:
-+                          __func__, value);
++    find_command('7z')
-         }
++except CmdNotFoundError:
-         break;
++    P7ZIP_AVAILABLE = False
-diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
+ class BootLinuxConsole(Test):
-index XXXXXXX..XXXXXXX 100644
+     """
---- a/hw/dma/bcm2835_dma.c
+@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
-+++ b/hw/dma/bcm2835_dma.c
+         exec_command_and_wait_for_pattern(self, 'reboot',
-@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2835_dma_read(BCM2835DMAState *s, hwaddr offset,
+                                                 'reboot: Restarting system')
-         res = ch->debug;
-         break;
++    @skipUnless(os.getenv('AVOCADO_ALLOW_LARGE_STORAGE'), 'storage limited')
-     default:
++    @skipUnless(P7ZIP_AVAILABLE, '7z not installed')
--        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
++    def test_arm_orangepi_bionic(self):
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
++        """
-                       __func__, offset);
++        :avocado: tags=arch:arm
-         break;
++        :avocado: tags=machine:orangepi-pc
-     }
++        """
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_dma_write(BCM2835DMAState *s, hwaddr offset,
++
-         ch->debug = value;
++        # This test download a 196MB compressed image and expand it to 932MB...
-         break;
++        image_url = ('https://dl.armbian.com/orangepipc/archive/'
-     default:
++                     'Armbian_19.11.3_Orangepipc_bionic_current_5.3.9.7z')
--        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
++        image_hash = '196a8ffb72b0123d92cea4a070894813d305c71e'
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
++        image_path_7z = self.fetch_asset(image_url, asset_hash=image_hash)
-                       __func__, offset);
++        image_name = 'Armbian_19.11.3_Orangepipc_bionic_current_5.3.9.img'
-         break;
++        image_path = os.path.join(self.workdir, image_name)
-     }
++        process.run("7z e -o%s %s" % (self.workdir, image_path_7z))
-@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2835_dma0_read(void *opaque, hwaddr offset, unsigned size)
++
-         case BCM2708_DMA_ENABLE:
++        self.vm.set_console()
-             return s->enable;
++        self.vm.add_args('-drive', 'file=' + image_path + ',if=sd,format=raw',
-         default:
++                         '-nic', 'user',
--            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
++                         '-no-reboot')
-+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
++        self.vm.launch()
-                           __func__, offset);
++
-             return 0;
++        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-         }
++                               'console=ttyS0,115200 '
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_dma0_write(void *opaque, hwaddr offset, uint64_t value,
++                               'loglevel=7 '
-             s->enable = (value & 0xffff);
++                               'nosmp '
-             break;
++                               'systemd.default_timeout_start_sec=9000 '
-         default:
++                               'systemd.mask=armbian-zram-config.service '
--            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
++                               'systemd.mask=armbian-ramlog.service')
-+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
++
-                           __func__, offset);
++        self.wait_for_console_pattern('U-Boot SPL')
-         }
++        self.wait_for_console_pattern('Autoboot in ')
-     }
++        exec_command_and_wait_for_pattern(self, ' ', '=>')
-diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
++        exec_command_and_wait_for_pattern(self, "setenv extraargs '" +
-index XXXXXXX..XXXXXXX 100644
++                                                kernel_command_line + "'", '=>')
---- a/hw/intc/bcm2836_control.c
++        exec_command_and_wait_for_pattern(self, 'boot', 'Starting kernel ...');
-+++ b/hw/intc/bcm2836_control.c
++
-@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
++        self.wait_for_console_pattern('systemd[1]: Set hostname ' +
-     } else if (offset >= REG_MBOX0_RDCLR && offset < REG_LIMIT) {
++                                      'to <orangepipc>')
-         return s->mailboxes[(offset - REG_MBOX0_RDCLR) >> 2];
++        self.wait_for_console_pattern('Starting Load Kernel Modules...')
-     } else {
++
--        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+     def test_s390x_s390_ccw_virtio(self):
-+        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx"\n",
+         """
-                       __func__, offset);
+         :avocado: tags=arch:s390x
          return 0;
      }
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_write(void *opaque, hwaddr offset,
      } else if (offset >= REG_MBOX0_RDCLR && offset < REG_LIMIT) {
          s->mailboxes[(offset - REG_MBOX0_RDCLR) >> 2] &= ~val;
      } else {
 -        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
 -                      __func__, offset);
 +        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx
 +                                 " value 0x%"PRIx64"\n",
 +                      __func__, offset, val);
          return;
      }
 diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/bcm2835_mbox.c
 +++ b/hw/misc/bcm2835_mbox.c
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size)
          break;
      default:
 -        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
 +        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx"\n",
                        __func__, offset);
          return 0;
      }
@@ -XXX,XX +XXX,XX @@ static void bcm2835_mbox_write(void *opaque, hwaddr offset,
          break;
      default:
 -        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
 -                      __func__, offset);
 +        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx
 +                                 " value 0x%"PRIx64"\n",
 +                      __func__, offset, value);
          return;
      }
 diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/bcm2835_property.c
 +++ b/hw/misc/bcm2835_property.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
              break;
          case 0x00010001: /* Get board model */
              qemu_log_mask(LOG_UNIMP,
 -                          "bcm2835_property: %x get board model NYI\n", tag);
 +                          "bcm2835_property: 0x%08x get board model NYI\n",
 +                          tag);
              resplen = 4;
              break;
          case 0x00010002: /* Get board revision */
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
              break;
          case 0x00010004: /* Get board serial */
              qemu_log_mask(LOG_UNIMP,
 -                          "bcm2835_property: %x get board serial NYI\n", tag);
 +                          "bcm2835_property: 0x%08x get board serial NYI\n",
 +                          tag);
              resplen = 8;
              break;
          case 0x00010005: /* Get ARM memory */
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
          case 0x00038001: /* Set clock state */
              qemu_log_mask(LOG_UNIMP,
 -                          "bcm2835_property: %x set clock state NYI\n", tag);
 +                          "bcm2835_property: 0x%08x set clock state NYI\n",
 +                          tag);
              resplen = 8;
              break;
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
          case 0x00038004: /* Set max clock rate */
          case 0x00038007: /* Set min clock rate */
              qemu_log_mask(LOG_UNIMP,
 -                          "bcm2835_property: %x set clock rates NYI\n", tag);
 +                          "bcm2835_property: 0x%08x set clock rate NYI\n",
 +                          tag);
              resplen = 8;
              break;
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
              break;
          default:
 -            qemu_log_mask(LOG_GUEST_ERROR,
 -                          "bcm2835_property: unhandled tag %08x\n", tag);
 +            qemu_log_mask(LOG_UNIMP,
 +                          "bcm2835_property: unhandled tag 0x%08x\n", tag);
              break;
          }
 --
 .20.1

-[PULL 63/68] hw/arm/raspi: Use the IEC binary prefix definitions
+[PULL 28/36] tests/boot_linux_console: Test booting NetBSD via U-Boot on OrangePi PC
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-IEC binary prefixes ease code review: the unit is explicit.
+This test boots U-Boot then NetBSD (stored on a SD card) on
 a OrangePi PC board.
 As it requires ~1.3GB of storage, it is disabled by default.
 U-Boot is built by the Debian project [1], and the SD card image
 is provided by the NetBSD organization [2].
 Once the compressed SD card image is downloaded (304MB) and
 extracted, this test is fast:
   $ AVOCADO_ALLOW_LARGE_STORAGE=yes \
     avocado --show=app,console run -t machine:orangepi-pc \
       tests/acceptance/boot_linux_console.py
   console: U-Boot SPL 2020.01+dfsg-1 (Jan 08 2020 - 08:19:44 +0000)
   console: DRAM: 1024 MiB
   console: U-Boot 2020.01+dfsg-1 (Jan 08 2020 - 08:19:44 +0000) Allwinner Technology
   console: CPU:   Allwinner H3 (SUN8I 0000)
   console: scanning bus usb@1c1b000 for devices... 1 USB Device(s) found
   console: scanning bus usb@1c1d000 for devices... 1 USB Device(s) found
   console: scanning usb for storage devices... 0 Storage Device(s) found
   console: Hit any key to stop autoboot:  0
   console: => setenv bootargs root=ld0a
   console: => setenv kernel netbsd-GENERIC.ub
   console: => setenv fdtfile dtb/sun8i-h3-orangepi-pc.dtb
   console: => boot
   console: ## Booting kernel from Legacy Image at 42000000 ...
   console: Image Name:   NetBSD/earmv7hf 9.0_RC1
   console: Image Type:   ARM Linux Kernel Image (no loading done) (uncompressed)
   console: XIP Kernel Image (no loading done)
   console: Loading Device Tree to 49ff6000, end 49fffe01 ... OK
   console: Starting kernel ...
   console: [   1.0000000] NetBSD/evbarm (fdt) booting ...
   console: [   1.0000000] NetBSD 9.0 (GENERIC) #0: Fri Feb 14 00:06:28 UTC 2020
   console: [   1.0000000]         mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/evbarm/compile/GENERIC
   console: [   1.0000000] total memory = 1024 MB
   console: [   1.0000000] avail memory = 1003 MB
   console: [   1.0000000] armfdt0 (root)
   console: [   1.0000000] simplebus0 at armfdt0: Xunlong Orange Pi PC
   console: [   1.0000000] cpu0 at cpus0: Cortex-A7 r0p5 (Cortex V7A core)
   console: [   1.0000000] cpu0: DC enabled IC enabled WB enabled LABT branch prediction enabled
   console: [   1.0000000] cpu0: 32KB/64B 2-way L1 VIPT Instruction cache
   console: [   1.0000000] cpu0: 32KB/64B 2-way write-back-locking-C L1 PIPT Data cache
   console: [   1.0000000] cpu0: 2304KB/64B 16-way write-through L2 PIPT Unified cache
   console: [   1.0000000] vfp0 at cpu0: NEON MPE (VFP 3.0+), rounding, NaN propagation, denormals
   ...
   console: [   2.3812082] sdmmc0: SD card status: 4-bit, C0
   console: [   2.3812082] ld0 at sdmmc0: <0xaa:0x5859:QEMU!:0x01:0xdeadbeef:0x062>
   console: [   2.4012856] ld0: 1226 MB, 622 cyl, 64 head, 63 sec, 512 bytes/sect x 2511872 sectors
   console: [   2.5321222] ld0: 4-bit width, High-Speed/SDR25, 50.000 MHz
   console: [   3.1068718] WARNING: 4 errors while detecting hardware; check system log.
   console: [   3.1179868] boot device: ld0
   console: [   3.1470623] root on ld0a dumps on ld0b
   console: [   3.2464436] root file system type: ffs
   console: [   3.2897123] kern.module.path=/stand/evbarm/9.0/modules
   console: Mon Feb 17 20:33:35 UTC 2020
   console: Starting root file system check:
   PASS (35.96 s)
   RESULTS    : PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0
   JOB TIME   : 36.09 s
 Note, this test only took ~65 seconds to run on Travis-CI, see: [3].
 This test is based on a description from Niek Linnenbank from [4].
 [1] https://wiki.debian.org/InstallingDebianOn/Allwinner#Creating_a_bootable_SD_Card_with_u-boot
 [2] https://wiki.netbsd.org/ports/evbarm/allwinner/
 [3] https://travis-ci.org/philmd/qemu/jobs/638823612#L3778
 [4] https://www.mail-archive.com/qemu-devel@nongnu.org/msg669347.html
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Cleber Rosa <crosa@redhat.com>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190926173428.10713-2-f4bug@amsat.org
+Message-id: 20200311221854.30370-18-nieklinnenbank@gmail.com
 [NL: changed test to use NetBSD 9.0 final release and -global allwinner-rtc.base-year]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/raspi.c | 4 ++--
+ tests/acceptance/boot_linux_console.py | 70 ++++++++++++++++++++++++++
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 70 insertions(+)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/tests/acceptance/boot_linux_console.py
-+++ b/hw/arm/raspi.c
++++ b/tests/acceptance/boot_linux_console.py
-@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
+@@ -XXX,XX +XXX,XX @@ import shutil
-     mc->max_cpus = BCM283X_NCPUS;
+ from avocado import skipUnless
-     mc->min_cpus = BCM283X_NCPUS;
+ from avocado_qemu import Test
-     mc->default_cpus = BCM283X_NCPUS;
+ from avocado_qemu import exec_command_and_wait_for_pattern
--    mc->default_ram_size = 1024 * 1024 * 1024;
++from avocado_qemu import interrupt_interactive_console_until_pattern
-+    mc->default_ram_size = 1 * GiB;
+ from avocado_qemu import wait_for_console_pattern
-     mc->ignore_memory_transaction_failures = true;
+ from avocado.utils import process
- };
+ from avocado.utils import archive
- DEFINE_MACHINE("raspi2", raspi2_machine_init)
+@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
-@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
+                                       'to <orangepipc>')
-     mc->max_cpus = BCM283X_NCPUS;
+         self.wait_for_console_pattern('Starting Load Kernel Modules...')
-     mc->min_cpus = BCM283X_NCPUS;
-     mc->default_cpus = BCM283X_NCPUS;
++    @skipUnless(os.getenv('AVOCADO_ALLOW_LARGE_STORAGE'), 'storage limited')
--    mc->default_ram_size = 1024 * 1024 * 1024;
++    def test_arm_orangepi_uboot_netbsd9(self):
-+    mc->default_ram_size = 1 * GiB;
++        """
- }
++        :avocado: tags=arch:arm
- DEFINE_MACHINE("raspi3", raspi3_machine_init)
++        :avocado: tags=machine:orangepi-pc
- #endif
++        """
 +        # This test download a 304MB compressed image and expand it to 1.3GB...
 +        deb_url = ('http://snapshot.debian.org/archive/debian/'
 +                   '20200108T145233Z/pool/main/u/u-boot/'
 +                   'u-boot-sunxi_2020.01%2Bdfsg-1_armhf.deb')
 +        deb_hash = 'f67f404a80753ca3d1258f13e38f2b060e13db99'
 +        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
 +        # We use the common OrangePi PC 'plus' build of U-Boot for our secondary
 +        # program loader (SPL). We will then set the path to the more specific
 +        # OrangePi "PC" device tree blob with 'setenv fdtfile' in U-Boot prompt,
 +        # before to boot NetBSD.
 +        uboot_path = '/usr/lib/u-boot/orangepi_plus/u-boot-sunxi-with-spl.bin'
 +        uboot_path = self.extract_from_deb(deb_path, uboot_path)
 +        image_url = ('https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0/'
 +                     'evbarm-earmv7hf/binary/gzimg/armv7.img.gz')
 +        image_hash = '2babb29d36d8360adcb39c09e31060945259917a'
 +        image_path_gz = self.fetch_asset(image_url, asset_hash=image_hash)
 +        image_path = os.path.join(self.workdir, 'armv7.img')
 +        image_drive_args = 'if=sd,format=raw,snapshot=on,file=' + image_path
 +        archive.gzip_uncompress(image_path_gz, image_path)
 +
 +        # dd if=u-boot-sunxi-with-spl.bin of=armv7.img bs=1K seek=8 conv=notrunc
 +        with open(uboot_path, 'rb') as f_in:
 +            with open(image_path, 'r+b') as f_out:
 +                f_out.seek(8 * 1024)
 +                shutil.copyfileobj(f_in, f_out)
 +
 +                # Extend image, to avoid that NetBSD thinks the partition
 +                # inside the image is larger than device size itself
 +                f_out.seek(0, 2)
 +                f_out.seek(64 * 1024 * 1024, 1)
 +                f_out.write(bytearray([0x00]))
 +
 +        self.vm.set_console()
 +        self.vm.add_args('-nic', 'user',
 +                         '-drive', image_drive_args,
 +                         '-global', 'allwinner-rtc.base-year=2000',
 +                         '-no-reboot')
 +        self.vm.launch()
 +        wait_for_console_pattern(self, 'U-Boot 2020.01+dfsg-1')
 +        interrupt_interactive_console_until_pattern(self,
 +                                       'Hit any key to stop autoboot:',
 +                                       'switch to partitions #0, OK')
 +
 +        exec_command_and_wait_for_pattern(self, '', '=>')
 +        cmd = 'setenv bootargs root=ld0a'
 +        exec_command_and_wait_for_pattern(self, cmd, '=>')
 +        cmd = 'setenv kernel netbsd-GENERIC.ub'
 +        exec_command_and_wait_for_pattern(self, cmd, '=>')
 +        cmd = 'setenv fdtfile dtb/sun8i-h3-orangepi-pc.dtb'
 +        exec_command_and_wait_for_pattern(self, cmd, '=>')
 +        cmd = ("setenv bootcmd 'fatload mmc 0:1 ${kernel_addr_r} ${kernel}; "
 +               "fatload mmc 0:1 ${fdt_addr_r} ${fdtfile}; "
 +               "fdt addr ${fdt_addr_r}; "
 +               "bootm ${kernel_addr_r} - ${fdt_addr_r}'")
 +        exec_command_and_wait_for_pattern(self, cmd, '=>')
 +
 +        exec_command_and_wait_for_pattern(self, 'boot',
 +                                          'Booting kernel from Legacy Image')
 +        wait_for_console_pattern(self, 'Starting kernel ...')
 +        wait_for_console_pattern(self, 'NetBSD 9.0 (GENERIC)')
 +        # Wait for user-space
 +        wait_for_console_pattern(self, 'Starting root file system check')
 +
      def test_s390x_s390_ccw_virtio(self):
          """
          :avocado: tags=arch:s390x
 --
 .20.1

-[PULL 58/68] m25p80: Add support for w25q512jv
+[PULL 29/36] docs: add Orange Pi PC document
-From: Cédric Le Goater <clg@kaod.org>
+From: Niek Linnenbank <nieklinnenbank@gmail.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+The Xunlong Orange Pi PC machine is a functional ARM machine
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+based on the Allwinner H3 System-on-Chip. It supports mainline
-Message-id: 20190925143248.10000-20-clg@kaod.org
+Linux, U-Boot, NetBSD and is covered by acceptance tests.
 This commit adds a documentation text file with a description
 of the machine and instructions for the user.
 Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20200311221854.30370-19-nieklinnenbank@gmail.com
 [PMM: moved file into docs/system/arm to match the reorg
 of the arm target part of the docs; tweaked heading to
 match other boards]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/block/m25p80.c | 1 +
+ MAINTAINERS                  |   1 +
-file changed, 1 insertion(+)
+ docs/system/arm/orangepi.rst | 253 +++++++++++++++++++++++++++++++++++
+ docs/system/target-arm.rst   |   2 +
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
+files changed, 256 insertions(+)
  create mode 100644 docs/system/arm/orangepi.rst
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/MAINTAINERS
-+++ b/hw/block/m25p80.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ static const FlashPartInfo known_devices[] = {
+@@ -XXX,XX +XXX,XX @@ S: Maintained
-     { INFO("w25q80",      0xef5014,      0,  64 << 10,  16, ER_4K) },
+ F: hw/*/allwinner-h3*
-     { INFO("w25q80bl",    0xef4014,      0,  64 << 10,  16, ER_4K) },
+ F: include/hw/*/allwinner-h3*
-     { INFO("w25q256",     0xef4019,      0,  64 << 10, 512, ER_4K) },
+ F: hw/arm/orangepi.c
-+    { INFO("w25q512jv",   0xef4020,      0,  64 << 10, 1024, ER_4K) },
++F: docs/system/orangepi.rst
- };
+ ARM PrimeCell and CMSDK devices
- typedef enum {
+ M: Peter Maydell <peter.maydell@linaro.org>
 diff --git a/docs/system/arm/orangepi.rst b/docs/system/arm/orangepi.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/system/arm/orangepi.rst
@@ -XXX,XX +XXX,XX @@
 +Orange Pi PC (``orangepi-pc``)
 +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 +
 +The Xunlong Orange Pi PC is an Allwinner H3 System on Chip
 +based embedded computer with mainline support in both U-Boot
 +and Linux. The board comes with a Quad Core Cortex-A7 @ 1.3GHz,
 +1GiB RAM, 100Mbit ethernet, USB, SD/MMC, USB, HDMI and
 +various other I/O.
 +
 +Supported devices
 +"""""""""""""""""
 +
 +The Orange Pi PC machine supports the following devices:
 +
 + * SMP (Quad Core Cortex-A7)
 + * Generic Interrupt Controller configuration
 + * SRAM mappings
 + * SDRAM controller
 + * Real Time Clock
 + * Timer device (re-used from Allwinner A10)
 + * UART
 + * SD/MMC storage controller
 + * EMAC ethernet
 + * USB 2.0 interfaces
 + * Clock Control Unit
 + * System Control module
 + * Security Identifier device
 +
 +Limitations
 +"""""""""""
 +
 +Currently, Orange Pi PC does *not* support the following features:
 +
 +- Graphical output via HDMI, GPU and/or the Display Engine
 +- Audio output
 +- Hardware Watchdog
 +
 +Also see the 'unimplemented' array in the Allwinner H3 SoC module
 +for a complete list of unimplemented I/O devices: ``./hw/arm/allwinner-h3.c``
 +
 +Boot options
 +""""""""""""
 +
 +The Orange Pi PC machine can start using the standard -kernel functionality
 +for loading a Linux kernel or ELF executable. Additionally, the Orange Pi PC
 +machine can also emulate the BootROM which is present on an actual Allwinner H3
 +based SoC, which loads the bootloader from a SD card, specified via the -sd argument
 +to qemu-system-arm.
 +
 +Machine-specific options
 +""""""""""""""""""""""""
 +
 +The following machine-specific options are supported:
 +
 +- allwinner-rtc.base-year=YYYY
 +
 +  The Allwinner RTC device is automatically created by the Orange Pi PC machine
 +  and uses a default base year value which can be overridden using the 'base-year' property.
 +  The base year is the actual represented year when the RTC year value is zero.
 +  This option can be used in case the target operating system driver uses a different
 +  base year value. The minimum value for the base year is 1900.
 +
 +- allwinner-sid.identifier=abcd1122-a000-b000-c000-12345678ffff
 +
 +  The Security Identifier value can be read by the guest.
 +  For example, U-Boot uses it to determine a unique MAC address.
 +
 +The above machine-specific options can be specified in qemu-system-arm
 +via the '-global' argument, for example:
 +
 +.. code-block:: bash
 +
 +  $ qemu-system-arm -M orangepi-pc -sd mycard.img \
 +       -global allwinner-rtc.base-year=2000
 +
 +Running mainline Linux
 +""""""""""""""""""""""
 +
 +Mainline Linux kernels from 4.19 up to latest master are known to work.
 +To build a Linux mainline kernel that can be booted by the Orange Pi PC machine,
 +simply configure the kernel using the sunxi_defconfig configuration:
 +
 +.. code-block:: bash
 +
 +  $ ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- make mrproper
 +  $ ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- make sunxi_defconfig
 +
 +To be able to use USB storage, you need to manually enable the corresponding
 +configuration item. Start the kconfig configuration tool:
 +
 +.. code-block:: bash
 +
 +  $ ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- make menuconfig
 +
 +Navigate to the following item, enable it and save your configuration:
 +
 +  Device Drivers > USB support > USB Mass Storage support
 +
 +Build the Linux kernel with:
 +
 +.. code-block:: bash
 +
 +  $ ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- make
 +
 +To boot the newly build linux kernel in QEMU with the Orange Pi PC machine, use:
 +
 +.. code-block:: bash
 +
 +  $ qemu-system-arm -M orangepi-pc -nic user -nographic \
 +      -kernel /path/to/linux/arch/arm/boot/zImage \
 +      -append 'console=ttyS0,115200' \
 +      -dtb /path/to/linux/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dtb
 +
 +Orange Pi PC images
 +"""""""""""""""""""
 +
 +Note that the mainline kernel does not have a root filesystem. You may provide it
 +with an official Orange Pi PC image from the official website:
 +
 +  http://www.orangepi.org/downloadresources/
 +
 +Another possibility is to run an Armbian image for Orange Pi PC which
 +can be downloaded from:
 +
 +   https://www.armbian.com/orange-pi-pc/
 +
 +Alternatively, you can also choose to build you own image with buildroot
 +using the orangepi_pc_defconfig. Also see https://buildroot.org for more information.
 +
 +You can choose to attach the selected image either as an SD card or as USB mass storage.
 +For example, to boot using the Orange Pi PC Debian image on SD card, simply add the -sd
 +argument and provide the proper root= kernel parameter:
 +
 +.. code-block:: bash
 +
 +  $ qemu-system-arm -M orangepi-pc -nic user -nographic \
 +      -kernel /path/to/linux/arch/arm/boot/zImage \
 +      -append 'console=ttyS0,115200 root=/dev/mmcblk0p2' \
 +      -dtb /path/to/linux/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dtb \
 +      -sd OrangePi_pc_debian_stretch_server_linux5.3.5_v1.0.img
 +
 +To attach the image as an USB mass storage device to the machine,
 +simply append to the command:
 +
 +.. code-block:: bash
 +
 +  -drive if=none,id=stick,file=myimage.img \
 +  -device usb-storage,bus=usb-bus.0,drive=stick
 +
 +Instead of providing a custom Linux kernel via the -kernel command you may also
 +choose to let the Orange Pi PC machine load the bootloader from SD card, just like
 +a real board would do using the BootROM. Simply pass the selected image via the -sd
 +argument and remove the -kernel, -append, -dbt and -initrd arguments:
 +
 +.. code-block:: bash
 +
 +  $ qemu-system-arm -M orangepi-pc -nic user -nographic \
 +       -sd Armbian_19.11.3_Orangepipc_buster_current_5.3.9.img
 +
 +Note that both the official Orange Pi PC images and Armbian images start
 +a lot of userland programs via systemd. Depending on the host hardware and OS,
 +they may be slow to emulate, especially due to emulating the 4 cores.
 +To help reduce the performance slow down due to emulating the 4 cores, you can
 +give the following kernel parameters via U-Boot (or via -append):
 +
 +.. code-block:: bash
 +
 +  => setenv extraargs 'systemd.default_timeout_start_sec=9000 loglevel=7 nosmp console=ttyS0,115200'
 +
 +Running U-Boot
 +""""""""""""""
 +
 +U-Boot mainline can be build and configured using the orangepi_pc_defconfig
 +using similar commands as describe above for Linux. Note that it is recommended
 +for development/testing to select the following configuration setting in U-Boot:
 +
 +  Device Tree Control > Provider for DTB for DT Control > Embedded DTB
 +
 +To start U-Boot using the Orange Pi PC machine, provide the
 +u-boot binary to the -kernel argument:
 +
 +.. code-block:: bash
 +
 +  $ qemu-system-arm -M orangepi-pc -nic user -nographic \
 +      -kernel /path/to/uboot/u-boot -sd disk.img
 +
 +Use the following U-boot commands to load and boot a Linux kernel from SD card:
 +
 +.. code-block:: bash
 +
 +  => setenv bootargs console=ttyS0,115200
 +  => ext2load mmc 0 0x42000000 zImage
 +  => ext2load mmc 0 0x43000000 sun8i-h3-orangepi-pc.dtb
 +  => bootz 0x42000000 - 0x43000000
 +
 +Running NetBSD
 +""""""""""""""
 +
 +The NetBSD operating system also includes support for Allwinner H3 based boards,
 +including the Orange Pi PC. NetBSD 9.0 is known to work best for the Orange Pi PC
 +board and provides a fully working system with serial console, networking and storage.
 +For the Orange Pi PC machine, get the 'evbarm-earmv7hf' based image from:
 +
 +  https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0/evbarm-earmv7hf/binary/gzimg/armv7.img.gz
 +
 +The image requires manually installing U-Boot in the image. Build U-Boot with
 +the orangepi_pc_defconfig configuration as described in the previous section.
 +Next, unzip the NetBSD image and write the U-Boot binary including SPL using:
 +
 +.. code-block:: bash
 +
 +  $ gunzip armv7.img.gz
 +  $ dd if=/path/to/u-boot-sunxi-with-spl.bin of=armv7.img bs=1024 seek=8 conv=notrunc
 +
 +Finally, before starting the machine the SD image must be extended such
 +that the NetBSD kernel will not conclude the NetBSD partition is larger than
 +the emulated SD card:
 +
 +.. code-block:: bash
 +
 +  $ dd if=/dev/zero bs=1M count=64 >> armv7.img
 +
 +Start the machine using the following command:
 +
 +.. code-block:: bash
 +
 +  $ qemu-system-arm -M orangepi-pc -nic user -nographic \
 +        -sd armv7.img -global allwinner-rtc.base-year=2000
 +
 +At the U-Boot stage, interrupt the automatic boot process by pressing a key
 +and set the following environment variables before booting:
 +
 +.. code-block:: bash
 +
 +  => setenv bootargs root=ld0a
 +  => setenv kernel netbsd-GENERIC.ub
 +  => setenv fdtfile dtb/sun8i-h3-orangepi-pc.dtb
 +  => setenv bootcmd 'fatload mmc 0:1 ${kernel_addr_r} ${kernel}; fatload mmc 0:1 ${fdt_addr_r} ${fdtfile}; fdt addr ${fdt_addr_r}; bootm ${kernel_addr_r} - ${fdt_addr_r}'
 +
 +Optionally you may save the environment variables to SD card with 'saveenv'.
 +To continue booting simply give the 'boot' command and NetBSD boots.
 +
 +Orange Pi PC acceptance tests
 +"""""""""""""""""""""""""""""
 +
 +The Orange Pi PC machine has several acceptance tests included.
 +To run the whole set of tests, build QEMU from source and simply
 +provide the following command:
 +
 +.. code-block:: bash
 +
 +  $ AVOCADO_ALLOW_LARGE_STORAGE=yes avocado --show=app,console run \
 +     -t machine:orangepi-pc tests/acceptance/boot_linux_console.py
 diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/target-arm.rst
 +++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
  ``qemu-system-aarch64 --machine help``.
  .. toctree::
 +   :maxdepth: 1
     arm/integratorcp
     arm/versatile
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
     arm/stellaris
     arm/musicpal
     arm/sx1
 +   arm/orangepi
  Arm CPU features
  ================
 --
 .20.1

-[PULL 03/68] ARM: KVM: Check KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 for smp_cpus > 256
+[PULL 30/36] hw/arm/virt: Document 'max' value in gic-version property description
 From: Eric Auger <eric.auger@redhat.com>
-Host kernel within [4.18, 5.3] report an erroneous KVM_MAX_VCPUS=512
+Mention 'max' value in the gic-version property description.
 for ARM. The actual capability to instantiate more than 256 vcpus
 was fixed in 5.4 with the upgrade of the KVM_IRQ_LINE ABI to support
 vcpu id encoded on 12 bits instead of 8 and a redistributor consuming
 a single KVM IO device instead of 2.
 So let's check this capability when attempting to use more than 256
 vcpus within any ARM kvm accelerated machine.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
-Acked-by: Marc Zyngier <maz@kernel.org>
+Message-id: 20200311131618.7187-2-eric.auger@redhat.com
 Message-id: 20191003154640.22451-4-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/kvm.c | 10 +++++++++-
+ hw/arm/virt.c | 3 ++-
-file changed, 9 insertions(+), 1 deletion(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/arm/kvm.c b/target/arm/kvm.c
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm.c
+--- a/hw/arm/virt.c
-+++ b/target/arm/kvm.c
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
+@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
+                         virt_set_gic_version, NULL);
- int kvm_arch_init(MachineState *ms, KVMState *s)
+     object_property_set_description(obj, "gic-version",
- {
+                                     "Set GIC version. "
-+    int ret = 0;
+-                                    "Valid values are 2, 3 and host", NULL);
-     /* For ARM interrupt delivery is always asynchronous,
++                                    "Valid values are 2, 3, host and max",
-      * whether we are using an in-kernel VGIC or not.
++                                    NULL);
-      */
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+     vms->highmem_ecam = !vmc->no_highmem_ecam;
      cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
 -    return 0;
 +    if (ms->smp.cpus > 256 &&
 +        !kvm_check_extension(s, KVM_CAP_ARM_IRQ_LINE_LAYOUT_2)) {
 +        error_report("Using more than 256 vcpus requires a host kernel "
 +                     "with KVM_CAP_ARM_IRQ_LINE_LAYOUT_2");
 +        ret = -EINVAL;
 +    }
 +
 +    return ret;
  }
  unsigned long kvm_arch_vcpu_id(CPUState *cpu)
 --
 .20.1

-[PULL 46/68] aspeed/timer: Add support for IRQ status register on the AST2600
+[PULL 31/36] hw/arm/virt: Introduce VirtGICType enum type
-From: Cédric Le Goater <clg@kaod.org>
+From: Eric Auger <eric.auger@redhat.com>
-The AST2600 timer replaces control register 2 with a interrupt status
+We plan to introduce yet another value for the gic version (nosel).
-register. It is set by hardware when an IRQ occurs and cleared by
+As we already use exotic values such as 0 and -1, let's introduce
-software.
+a dedicated enum type and let vms->gic_version take this
 type.
-Modify the vmstate version to take into account the new fields.
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Based on previous work from Joel Stanley.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Message-id: 20200311131618.7187-3-eric.auger@redhat.com
 Reviewed-by: Joel Stanley <joel@jms.id.au>
 Message-id: 20190925143248.10000-8-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/timer/aspeed_timer.h |  1 +
+ include/hw/arm/virt.h | 11 +++++++++--
- hw/timer/aspeed_timer.c         | 36 +++++++++++++++++++++++++--------
+ hw/arm/virt.c         | 30 +++++++++++++++---------------
-files changed, 29 insertions(+), 8 deletions(-)
+files changed, 24 insertions(+), 17 deletions(-)
-diff --git a/include/hw/timer/aspeed_timer.h b/include/hw/timer/aspeed_timer.h
+diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/timer/aspeed_timer.h
+--- a/include/hw/arm/virt.h
-+++ b/include/hw/timer/aspeed_timer.h
++++ b/include/hw/arm/virt.h
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedTimerCtrlState {
+@@ -XXX,XX +XXX,XX @@ typedef enum VirtIOMMUType {
-     uint32_t ctrl;
+     VIRT_IOMMU_VIRTIO,
-     uint32_t ctrl2;
+ } VirtIOMMUType;
-     uint32_t ctrl3;
-+    uint32_t irq_sts;
++typedef enum VirtGICType {
-     AspeedTimer timers[ASPEED_TIMER_NR_TIMERS];
++    VIRT_GIC_VERSION_MAX,
++    VIRT_GIC_VERSION_HOST,
-     AspeedSCUState *scu;
++    VIRT_GIC_VERSION_2,
-diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
++    VIRT_GIC_VERSION_3,
 +} VirtGICType;
 +
  typedef struct MemMapEntry {
      hwaddr base;
      hwaddr size;
@@ -XXX,XX +XXX,XX @@ typedef struct {
      bool highmem_ecam;
      bool its;
      bool virt;
 -    int32_t gic_version;
 +    VirtGICType gic_version;
      VirtIOMMUType iommu;
      uint16_t virtio_iommu_bdf;
      struct arm_boot_info bootinfo;
@@ -XXX,XX +XXX,XX @@ static inline int virt_gicv3_redist_region_count(VirtMachineState *vms)
      uint32_t redist0_capacity =
                  vms->memmap[VIRT_GIC_REDIST].size / GICV3_REDIST_SIZE;
 -    assert(vms->gic_version == 3);
 +    assert(vms->gic_version == VIRT_GIC_VERSION_3);
      return vms->smp_cpus > redist0_capacity ? 2 : 1;
  }
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/aspeed_timer.c
+--- a/hw/arm/virt.c
-+++ b/hw/timer/aspeed_timer.c
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t calculate_next(struct AspeedTimer *t)
+@@ -XXX,XX +XXX,XX @@ static void fdt_add_timer_nodes(const VirtMachineState *vms)
-     timer_del(&t->timer);
+         irqflags = GIC_FDT_IRQ_FLAGS_EDGE_LO_HI;
      if (timer_overflow_interrupt(t)) {
 +        AspeedTimerCtrlState *s = timer_to_ctrl(t);
          t->level = !t->level;
 +        s->irq_sts |= BIT(t->id);
          qemu_set_irq(t->irq, t->level);
      }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_expire(void *opaque)
+-    if (vms->gic_version == 2) {
 +    if (vms->gic_version == VIRT_GIC_VERSION_2) {
          irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START,
                               GIC_FDT_IRQ_PPI_CPU_WIDTH,
                               (1 << vms->smp_cpus) - 1);
@@ -XXX,XX +XXX,XX @@ static void fdt_add_gic_node(VirtMachineState *vms)
      qemu_fdt_setprop_cell(vms->fdt, nodename, "#address-cells", 0x2);
      qemu_fdt_setprop_cell(vms->fdt, nodename, "#size-cells", 0x2);
      qemu_fdt_setprop(vms->fdt, nodename, "ranges", NULL, 0);
 -    if (vms->gic_version == 3) {
 +    if (vms->gic_version == VIRT_GIC_VERSION_3) {
          int nb_redist_regions = virt_gicv3_redist_region_count(vms);
          qemu_fdt_setprop_string(vms->fdt, nodename, "compatible",
@@ -XXX,XX +XXX,XX @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
          }
      }
-     if (interrupt) {
+-    if (vms->gic_version == 2) {
-+        AspeedTimerCtrlState *s = timer_to_ctrl(t);
++    if (vms->gic_version == VIRT_GIC_VERSION_2) {
-         t->level = !t->level;
+         irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START,
-+        s->irq_sts |= BIT(t->id);
+                              GIC_FDT_IRQ_PPI_CPU_WIDTH,
-         qemu_set_irq(t->irq, t->level);
+                              (1 << vms->smp_cpus) - 1);
-     }
+@@ -XXX,XX +XXX,XX @@ static uint64_t virt_cpu_mp_affinity(VirtMachineState *vms, int idx)
+          * purposes are to make TCG consistent (with 64-bit KVM hosts)
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_timer_read(void *opaque, hwaddr offset, unsigned size)
+          * and to improve SGI efficiency.
-     case 0x30: /* Control Register */
+          */
-         value = s->ctrl;
+-        if (vms->gic_version == 3) {
-         break;
++        if (vms->gic_version == VIRT_GIC_VERSION_3) {
--    case 0x34: /* Control Register 2 */
+             clustersz = GICV3_TARGETLIST_BITS;
--        value = s->ctrl2;
+         } else {
--        break;
+             clustersz = GIC_TARGETLIST_BITS;
-     case 0x00 ... 0x2c: /* Timers 1 - 4 */
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-         value = aspeed_timer_get_value(&s->timers[(offset >> 4)], reg);
+     /* We can probe only here because during property set
-         break;
+      * KVM is not available yet
-@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_write(void *opaque, hwaddr offset, uint64_t value,
+      */
-     case 0x30:
+-    if (vms->gic_version <= 0) {
-         aspeed_timer_set_ctrl(s, tv);
+-        /* "host" or "max" */
-         break;
++    if (vms->gic_version == VIRT_GIC_VERSION_HOST ||
--    case 0x34:
++        vms->gic_version == VIRT_GIC_VERSION_MAX) {
--        aspeed_timer_set_ctrl2(s, tv);
+         if (!kvm_enabled()) {
--        break;
+-            if (vms->gic_version == 0) {
-     /* Timer Registers */
++            if (vms->gic_version == VIRT_GIC_VERSION_HOST) {
-     case 0x00 ... 0x2c:
+                 error_report("gic-version=host requires KVM");
-         aspeed_timer_set_value(s, (offset >> TIMER_NR_REGS), reg, tv);
+                 exit(1);
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2400_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
+             } else {
-     uint64_t value;
+                 /* "max": currently means 3 for TCG */
+-                vms->gic_version = 3;
-     switch (offset) {
++                vms->gic_version = VIRT_GIC_VERSION_3;
-+    case 0x34:
+             }
-+        value = s->ctrl2;
+         } else {
-+        break;
+             vms->gic_version = kvm_arm_vgic_probe();
-     case 0x38:
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-     case 0x3C:
+     /* The maximum number of CPUs depends on the GIC version, or on how
-     default:
+      * many redistributors we can fit into the memory map.
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2400_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
+      */
- static void aspeed_2400_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
+-    if (vms->gic_version == 3) {
-                                     uint64_t value)
++    if (vms->gic_version == VIRT_GIC_VERSION_3) {
          virt_max_cpus =
              vms->memmap[VIRT_GIC_REDIST].size / GICV3_REDIST_SIZE;
          virt_max_cpus +=
@@ -XXX,XX +XXX,XX @@ static void virt_set_its(Object *obj, bool value, Error **errp)
  static char *virt_get_gic_version(Object *obj, Error **errp)
  {
-+    const uint32_t tv = (uint32_t)(value & 0xFFFFFFFF);
+     VirtMachineState *vms = VIRT_MACHINE(obj);
-+
+-    const char *val = vms->gic_version == 3 ? "3" : "2";
-     switch (offset) {
++    const char *val = vms->gic_version == VIRT_GIC_VERSION_3 ? "3" : "2";
-+    case 0x34:
-+        aspeed_timer_set_ctrl2(s, tv);
+     return g_strdup(val);
 +        break;
      case 0x38:
      case 0x3C:
      default:
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2500_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
      uint64_t value;
      switch (offset) {
 +    case 0x34:
 +        value = s->ctrl2;
 +        break;
      case 0x38:
          value = s->ctrl3 & BIT(0);
          break;
@@ -XXX,XX +XXX,XX @@ static void aspeed_2500_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
      uint8_t command;
      switch (offset) {
 +    case 0x34:
 +        aspeed_timer_set_ctrl2(s, tv);
 +        break;
      case 0x38:
          command = (value >> 1) & 0xFF;
          if (command == 0xAE) {
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2600_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
      uint64_t value;
      switch (offset) {
 +    case 0x34:
 +        value = s->irq_sts;
 +        break;
      case 0x38:
      case 0x3C:
      default:
@@ -XXX,XX +XXX,XX @@ static void aspeed_2600_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
      const uint32_t tv = (uint32_t)(value & 0xFFFFFFFF);
      switch (offset) {
 +    case 0x34:
 +        s->irq_sts &= tv;
 +        break;
      case 0x3C:
          aspeed_timer_set_ctrl(s, s->ctrl & ~tv);
          break;
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_reset(DeviceState *dev)
      s->ctrl = 0;
      s->ctrl2 = 0;
      s->ctrl3 = 0;
 +    s->irq_sts = 0;
  }
+@@ -XXX,XX +XXX,XX @@ static void virt_set_gic_version(Object *obj, const char *value, Error **errp)
- static const VMStateDescription vmstate_aspeed_timer = {
+     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_timer = {
+     if (!strcmp(value, "3")) {
- static const VMStateDescription vmstate_aspeed_timer_state = {
+-        vms->gic_version = 3;
-     .name = "aspeed.timerctrl",
++        vms->gic_version = VIRT_GIC_VERSION_3;
--    .version_id = 1,
+     } else if (!strcmp(value, "2")) {
--    .minimum_version_id = 1,
+-        vms->gic_version = 2;
-+    .version_id = 2,
++        vms->gic_version = VIRT_GIC_VERSION_2;
-+    .minimum_version_id = 2,
+     } else if (!strcmp(value, "host")) {
-     .fields = (VMStateField[]) {
+-        vms->gic_version = 0; /* Will probe later */
-         VMSTATE_UINT32(ctrl, AspeedTimerCtrlState),
++        vms->gic_version = VIRT_GIC_VERSION_HOST; /* Will probe later */
-         VMSTATE_UINT32(ctrl2, AspeedTimerCtrlState),
+     } else if (!strcmp(value, "max")) {
-         VMSTATE_UINT32(ctrl3, AspeedTimerCtrlState),
+-        vms->gic_version = -1; /* Will probe later */
-+        VMSTATE_UINT32(irq_sts, AspeedTimerCtrlState),
++        vms->gic_version = VIRT_GIC_VERSION_MAX; /* Will probe later */
-         VMSTATE_STRUCT_ARRAY(timers, AspeedTimerCtrlState,
+     } else {
-                              ASPEED_TIMER_NR_TIMERS, 1, vmstate_aspeed_timer,
+         error_setg(errp, "Invalid gic-version value");
-                              AspeedTimer),
+         error_append_hint(errp, "Valid values are 3, 2, host, max.\n");
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
                                      "physical address space above 32 bits",
                                      NULL);
      /* Default GIC type is v2 */
 -    vms->gic_version = 2;
 +    vms->gic_version = VIRT_GIC_VERSION_2;
      object_property_add_str(obj, "gic-version", virt_get_gic_version,
                          virt_set_gic_version, NULL);
      object_property_set_description(obj, "gic-version",
 --
 .20.1

-[PULL 55/68] aspeed/i2c: Add AST2600 support
+[PULL 32/36] hw/arm/virt: Introduce finalize_gic_version()
-From: Cédric Le Goater <clg@kaod.org>
+From: Eric Auger <eric.auger@redhat.com>
-The I2C controller of the AST2400 and AST2500 SoCs have one IRQ shared
+Let's move the code which freezes which gic-version to
-by all I2C busses. The AST2600 SoC I2C controller has one IRQ per bus
+be applied in a dedicated function. We also now set by
-and 16 busses.
+default the VIRT_GIC_VERSION_NO_SET. This eventually
 turns into the legacy v2 choice in the finalize() function.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190925143248.10000-17-clg@kaod.org
+Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20200311131618.7187-4-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/i2c/aspeed_i2c.h |  5 +++-
+ include/hw/arm/virt.h |  1 +
- hw/i2c/aspeed_i2c.c         | 46 +++++++++++++++++++++++++++++++++++--
+ hw/arm/virt.c         | 54 ++++++++++++++++++++++++++-----------------
-files changed, 48 insertions(+), 3 deletions(-)
+files changed, 34 insertions(+), 21 deletions(-)
-diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h
+diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i2c/aspeed_i2c.h
+--- a/include/hw/arm/virt.h
-+++ b/include/hw/i2c/aspeed_i2c.h
++++ b/include/hw/arm/virt.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef enum VirtGICType {
- #define TYPE_ASPEED_I2C "aspeed.i2c"
+     VIRT_GIC_VERSION_HOST,
- #define TYPE_ASPEED_2400_I2C TYPE_ASPEED_I2C "-ast2400"
+     VIRT_GIC_VERSION_2,
- #define TYPE_ASPEED_2500_I2C TYPE_ASPEED_I2C "-ast2500"
+     VIRT_GIC_VERSION_3,
-+#define TYPE_ASPEED_2600_I2C TYPE_ASPEED_I2C "-ast2600"
++    VIRT_GIC_VERSION_NOSEL,
- #define ASPEED_I2C(obj) \
+ } VirtGICType;
-     OBJECT_CHECK(AspeedI2CState, (obj), TYPE_ASPEED_I2C)
+ typedef struct MemMapEntry {
--#define ASPEED_I2C_NR_BUSSES 14
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 +#define ASPEED_I2C_NR_BUSSES 16
  struct AspeedI2CState;
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedI2CBus {
      I2CBus *bus;
      uint8_t id;
 +    qemu_irq irq;
      uint32_t ctrl;
      uint32_t timing[2];
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedI2CClass {
      uint8_t num_busses;
      uint8_t reg_size;
      uint8_t gap;
 +    qemu_irq (*bus_get_irq)(AspeedI2CBus *);
  } AspeedI2CClass;
  I2CBus *aspeed_i2c_get_bus(DeviceState *dev, int busnr);
 diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
+--- a/hw/arm/virt.c
-+++ b/hw/i2c/aspeed_i2c.c
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static inline bool aspeed_i2c_bus_is_enabled(AspeedI2CBus *bus)
+@@ -XXX,XX +XXX,XX @@ static void virt_set_memmap(VirtMachineState *vms)
  static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
  {
 +    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
 +
      bus->intr_status &= bus->intr_ctrl;
      if (bus->intr_status) {
          bus->controller->intr_status |= 1 << bus->id;
 -        qemu_irq_raise(bus->controller->irq);
 +        qemu_irq_raise(aic->bus_get_irq(bus));
      }
  }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
++/*
-                                  uint64_t value, unsigned size)
++ * finalize_gic_version - Determines the final gic_version
- {
++ * according to the gic-version property
-     AspeedI2CBus *bus = opaque;
++ *
-+    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
++ * Default GIC type is v2
-     bool handle_rx;
++ */
++static void finalize_gic_version(VirtMachineState *vms)
      switch (offset) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
          bus->intr_status &= ~(value & 0x7FFF);
          if (!bus->intr_status) {
              bus->controller->intr_status &= ~(1 << bus->id);
 -            qemu_irq_lower(bus->controller->irq);
 +            qemu_irq_lower(aic->bus_get_irq(bus));
          }
          if (handle_rx && (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST))) {
              aspeed_i2c_handle_rx_cmd(bus);
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
      for (i = 0; i < aic->num_busses; i++) {
          char name[32];
          int offset = i < aic->gap ? 1 : 5;
 +
 +        sysbus_init_irq(sbd, &s->busses[i].irq);
          snprintf(name, sizeof(name), "aspeed.i2c.%d", i);
          s->busses[i].controller = s;
          s->busses[i].id = i;
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_i2c_info = {
      .abstract   = true,
  };
 +static qemu_irq aspeed_2400_i2c_bus_get_irq(AspeedI2CBus *bus)
 +{
-+    return bus->controller->irq;
++    if (vms->gic_version == VIRT_GIC_VERSION_HOST ||
 +        vms->gic_version == VIRT_GIC_VERSION_MAX) {
 +        if (!kvm_enabled()) {
 +            if (vms->gic_version == VIRT_GIC_VERSION_HOST) {
 +                error_report("gic-version=host requires KVM");
 +                exit(1);
 +            } else {
 +                /* "max": currently means 3 for TCG */
 +                vms->gic_version = VIRT_GIC_VERSION_3;
 +            }
 +        } else {
 +            vms->gic_version = kvm_arm_vgic_probe();
 +            if (!vms->gic_version) {
 +                error_report(
 +                    "Unable to determine GIC version supported by host");
 +                exit(1);
 +            }
 +        }
 +    } else if (vms->gic_version == VIRT_GIC_VERSION_NOSEL) {
 +        vms->gic_version = VIRT_GIC_VERSION_2;
 +    }
 +}
 +
- static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
+ static void machvirt_init(MachineState *machine)
  {
-     DeviceClass *dc = DEVICE_CLASS(klass);
+     VirtMachineState *vms = VIRT_MACHINE(machine);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-     aic->num_busses = 14;
+     /* We can probe only here because during property set
-     aic->reg_size = 0x40;
+      * KVM is not available yet
-     aic->gap = 7;
+      */
-+    aic->bus_get_irq = aspeed_2400_i2c_bus_get_irq;
+-    if (vms->gic_version == VIRT_GIC_VERSION_HOST ||
- }
+-        vms->gic_version == VIRT_GIC_VERSION_MAX) {
+-        if (!kvm_enabled()) {
- static const TypeInfo aspeed_2400_i2c_info = {
+-            if (vms->gic_version == VIRT_GIC_VERSION_HOST) {
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_2400_i2c_info = {
+-                error_report("gic-version=host requires KVM");
-     .class_init = aspeed_2400_i2c_class_init,
+-                exit(1);
- };
+-            } else {
+-                /* "max": currently means 3 for TCG */
-+static qemu_irq aspeed_2500_i2c_bus_get_irq(AspeedI2CBus *bus)
+-                vms->gic_version = VIRT_GIC_VERSION_3;
-+{
+-            }
-+    return bus->controller->irq;
+-        } else {
-+}
+-            vms->gic_version = kvm_arm_vgic_probe();
-+
+-            if (!vms->gic_version) {
- static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
+-                error_report(
- {
+-                    "Unable to determine GIC version supported by host");
-     DeviceClass *dc = DEVICE_CLASS(klass);
+-                exit(1);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
+-            }
-     aic->num_busses = 14;
+-        }
-     aic->reg_size = 0x40;
+-    }
-     aic->gap = 7;
++    finalize_gic_version(vms);
-+    aic->bus_get_irq = aspeed_2500_i2c_bus_get_irq;
- }
+     if (!cpu_type_valid(machine->cpu_type)) {
+         error_report("mach-virt: CPU type %s not supported", machine->cpu_type);
- static const TypeInfo aspeed_2500_i2c_info = {
+@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_2500_i2c_info = {
+                                     "Set on/off to enable/disable using "
-     .class_init = aspeed_2500_i2c_class_init,
+                                     "physical address space above 32 bits",
- };
+                                     NULL);
+-    /* Default GIC type is v2 */
-+static qemu_irq aspeed_2600_i2c_bus_get_irq(AspeedI2CBus *bus)
+-    vms->gic_version = VIRT_GIC_VERSION_2;
-+{
++    vms->gic_version = VIRT_GIC_VERSION_NOSEL;
-+    return bus->irq;
+     object_property_add_str(obj, "gic-version", virt_get_gic_version,
-+}
+                         virt_set_gic_version, NULL);
-+
+     object_property_set_description(obj, "gic-version",
 +static void aspeed_2600_i2c_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
 +
 +    dc->desc = "ASPEED 2600 I2C Controller";
 +
 +    aic->num_busses = 16;
 +    aic->reg_size = 0x80;
 +    aic->gap = -1; /* no gap */
 +    aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
 +}
 +
 +static const TypeInfo aspeed_2600_i2c_info = {
 +    .name = TYPE_ASPEED_2600_I2C,
 +    .parent = TYPE_ASPEED_I2C,
 +    .class_init = aspeed_2600_i2c_class_init,
 +};
 +
  static void aspeed_i2c_register_types(void)
  {
      type_register_static(&aspeed_i2c_info);
      type_register_static(&aspeed_2400_i2c_info);
      type_register_static(&aspeed_2500_i2c_info);
 +    type_register_static(&aspeed_2600_i2c_info);
  }
  type_init(aspeed_i2c_register_types)
 --
 .20.1

-[PULL 02/68] intc/arm_gic: Support IRQ injection for more than 256 vpus
+[PULL 33/36] target/arm/kvm: Let kvm_arm_vgic_probe() return a bitmap
 From: Eric Auger <eric.auger@redhat.com>
-Host kernels that expose the KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 capability
+Convert kvm_arm_vgic_probe() so that it returns a
-allow injection of interrupts along with vcpu ids larger than 255.
+bitmap of supported in-kernel emulation VGIC versions instead
-Let's encode the vpcu id on 12 bits according to the upgraded KVM_IRQ_LINE
+of the max version: at the moment values can be v2 and v3.
-ABI when needed.
+This allows to expose the case where the host GICv3 also
+supports GICv2 emulation. This will be useful to choose the
-Given that we have two callsites that need to assemble
+default version in KVM accelerated mode.
 the value for kvm_set_irq(), a new helper routine, kvm_arm_set_irq
 is introduced.
 Without that patch qemu exits with "kvm_set_irq: Invalid argument"
 message.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reported-by: Zenghui Yu <yuzenghui@huawei.com>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20200311131618.7187-5-eric.auger@redhat.com
 Acked-by: Marc Zyngier <maz@kernel.org>
 Message-id: 20191003154640.22451-3-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/kvm_arm.h  |  1 +
+ target/arm/kvm_arm.h |  3 +++
- hw/intc/arm_gic_kvm.c |  7 ++-----
+ hw/arm/virt.c        | 11 +++++++++--
- target/arm/cpu.c      | 10 ++++------
+ target/arm/kvm.c     | 14 ++++++++------
- target/arm/kvm.c      | 12 ++++++++++++
+files changed, 20 insertions(+), 8 deletions(-)
 files changed, 19 insertions(+), 11 deletions(-)
 diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm_arm.h
 +++ b/target/arm/kvm_arm.h
-@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void);
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/memory.h"
- void kvm_arm_pmu_set_irq(CPUState *cs, int irq);
+ #include "qemu/error-report.h"
- void kvm_arm_pmu_init(CPUState *cs);
-+int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
++#define KVM_ARM_VGIC_V2   (1 << 0)
++#define KVM_ARM_VGIC_V3   (1 << 1)
- #else
++
+ /**
-diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
+  * kvm_arm_vcpu_init:
   * @cs: CPUState
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic_kvm.c
+--- a/hw/arm/virt.c
-+++ b/hw/intc/arm_gic_kvm.c
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ void kvm_arm_gic_set_irq(uint32_t num_irq, int irq, int level)
+@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
-      * has separate fields in the irq number for type,
+                 vms->gic_version = VIRT_GIC_VERSION_3;
-      * CPU number and interrupt number.
+             }
-      */
+         } else {
--    int kvm_irq, irqtype, cpu;
+-            vms->gic_version = kvm_arm_vgic_probe();
-+    int irqtype, cpu;
+-            if (!vms->gic_version) {
++            int probe_bitmap = kvm_arm_vgic_probe();
-     if (irq < (num_irq - GIC_INTERNAL)) {
++
-         /* External interrupt. The kernel numbers these like the GIC
++            if (!probe_bitmap) {
-@@ -XXX,XX +XXX,XX @@ void kvm_arm_gic_set_irq(uint32_t num_irq, int irq, int level)
+                 error_report(
-         cpu = irq / GIC_INTERNAL;
+                     "Unable to determine GIC version supported by host");
-         irq %= GIC_INTERNAL;
+                 exit(1);
-     }
++            } else {
--    kvm_irq = (irqtype << KVM_ARM_IRQ_TYPE_SHIFT)
++                if (probe_bitmap & KVM_ARM_VGIC_V3) {
--        | (cpu << KVM_ARM_IRQ_VCPU_SHIFT) | irq;
++                    vms->gic_version = VIRT_GIC_VERSION_3;
--
++                } else {
--    kvm_set_irq(kvm_state, kvm_irq, !!level);
++                    vms->gic_version = VIRT_GIC_VERSION_2;
-+    kvm_arm_set_irq(cpu, irqtype, irq, !!level);
++                }
- }
+             }
+         }
- static void kvm_arm_gicv2_set_irq(void *opaque, int irq, int level)
+     } else if (vms->gic_version == VIRT_GIC_VERSION_NOSEL) {
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_kvm_set_irq(void *opaque, int irq, int level)
      ARMCPU *cpu = opaque;
      CPUARMState *env = &cpu->env;
      CPUState *cs = CPU(cpu);
 -    int kvm_irq = KVM_ARM_IRQ_TYPE_CPU << KVM_ARM_IRQ_TYPE_SHIFT;
      uint32_t linestate_bit;
 +    int irq_id;
      switch (irq) {
      case ARM_CPU_IRQ:
 -        kvm_irq |= KVM_ARM_IRQ_CPU_IRQ;
 +        irq_id = KVM_ARM_IRQ_CPU_IRQ;
          linestate_bit = CPU_INTERRUPT_HARD;
          break;
      case ARM_CPU_FIQ:
 -        kvm_irq |= KVM_ARM_IRQ_CPU_FIQ;
 +        irq_id = KVM_ARM_IRQ_CPU_FIQ;
          linestate_bit = CPU_INTERRUPT_FIQ;
          break;
      default:
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_kvm_set_irq(void *opaque, int irq, int level)
      } else {
          env->irq_line_state &= ~linestate_bit;
      }
 -
 -    kvm_irq |= cs->cpu_index << KVM_ARM_IRQ_VCPU_SHIFT;
 -    kvm_set_irq(kvm_state, kvm_irq, level ? 1 : 0);
 +    kvm_arm_set_irq(cs->cpu_index, KVM_ARM_IRQ_TYPE_CPU, irq_id, !!level);
  #endif
  }
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
-@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void)
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_irqchip_create(KVMState *s)
  int kvm_arm_vgic_probe(void)
  {
 +    int val = 0;
 +
      if (kvm_create_device(kvm_state,
                            KVM_DEV_TYPE_ARM_VGIC_V3, true) == 0) {
 -        return 3;
 -    } else if (kvm_create_device(kvm_state,
 -                                 KVM_DEV_TYPE_ARM_VGIC_V2, true) == 0) {
 -        return 2;
 -    } else {
 -        return 0;
 +        val |= KVM_ARM_VGIC_V3;
      }
++    if (kvm_create_device(kvm_state,
++                          KVM_DEV_TYPE_ARM_VGIC_V2, true) == 0) {
++        val |= KVM_ARM_VGIC_V2;
++    }
++    return val;
  }
-+int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level)
+ int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level)
 +{
 +    int kvm_irq = (irqtype << KVM_ARM_IRQ_TYPE_SHIFT) | irq;
 +    int cpu_idx1 = cpu % 256;
 +    int cpu_idx2 = cpu / 256;
 +
 +    kvm_irq |= (cpu_idx1 << KVM_ARM_IRQ_VCPU_SHIFT) |
 +               (cpu_idx2 << KVM_ARM_IRQ_VCPU2_SHIFT);
 +
 +    return kvm_set_irq(kvm_state, kvm_irq, !!level);
 +}
 +
  int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
                               uint64_t address, uint32_t data, PCIDevice *dev)
  {
 --
 .20.1

-[PULL 04/68] ptimer: Rename ptimer_init() to ptimer_init_with_bh()
+Deleted patch
-Currently the ptimer design uses a QEMU bottom-half as its
-mechanism for calling back into the device model using the
-ptimer when the timer has expired. Unfortunately this design
-is fatally flawed, because it means that there is a lag
-between the ptimer updating its own state and the device
-callback function updating device state, and guest accesses
-to device registers between the two can return inconsistent
-device state.
-We want to replace the bottom-half design with one where
-the guest device's callback is called either immediately
-(when the ptimer triggers by timeout) or when the device
-model code closes a transaction-begin/end section (when the
-ptimer triggers because the device model changed the
-ptimer's count value or other state). As the first step,
-rename ptimer_init() to ptimer_init_with_bh(), to free up
-the ptimer_init() name for the new API. We can then convert
-all the ptimer users away from ptimer_init_with_bh() before
-removing it entirely.
-(Commit created with
- git grep -l ptimer_init | xargs sed -i -e 's/ptimer_init/ptimer_init_with_bh/'
-and three overlong lines folded by hand.)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-2-peter.maydell@linaro.org
----
- include/hw/ptimer.h              | 11 ++++++-----
- hw/arm/musicpal.c                |  2 +-
- hw/core/ptimer.c                 |  2 +-
- hw/dma/xilinx_axidma.c           |  2 +-
- hw/m68k/mcf5206.c                |  2 +-
- hw/m68k/mcf5208.c                |  2 +-
- hw/net/fsl_etsec/etsec.c         |  2 +-
- hw/net/lan9118.c                 |  2 +-
- hw/timer/allwinner-a10-pit.c     |  2 +-
- hw/timer/altera_timer.c          |  2 +-
- hw/timer/arm_mptimer.c           |  6 +++---
- hw/timer/arm_timer.c             |  2 +-
- hw/timer/cmsdk-apb-dualtimer.c   |  2 +-
- hw/timer/cmsdk-apb-timer.c       |  2 +-
- hw/timer/digic-timer.c           |  2 +-
- hw/timer/etraxfs_timer.c         |  6 +++---
- hw/timer/exynos4210_mct.c        |  7 ++++---
- hw/timer/exynos4210_pwm.c        |  2 +-
- hw/timer/exynos4210_rtc.c        |  4 ++--
- hw/timer/grlib_gptimer.c         |  2 +-
- hw/timer/imx_epit.c              |  4 ++--
- hw/timer/imx_gpt.c               |  2 +-
- hw/timer/lm32_timer.c            |  2 +-
- hw/timer/milkymist-sysctl.c      |  4 ++--
- hw/timer/mss-timer.c             |  2 +-
- hw/timer/puv3_ost.c              |  2 +-
- hw/timer/sh_timer.c              |  2 +-
- hw/timer/slavio_timer.c          |  2 +-
- hw/timer/xilinx_timer.c          |  2 +-
- hw/watchdog/cmsdk-apb-watchdog.c |  2 +-
- tests/ptimer-test.c              | 22 +++++++++++-----------
-files changed, 56 insertions(+), 54 deletions(-)
-diff --git a/include/hw/ptimer.h b/include/hw/ptimer.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/ptimer.h
-+++ b/include/hw/ptimer.h
-@@ -XXX,XX +XXX,XX @@
-  * ptimer_set_count() or ptimer_set_limit() will not trigger the timer
-  * (though it will cause a reload). Only a counter decrement to "0"
-  * will cause a trigger. Not compatible with NO_IMMEDIATE_TRIGGER;
-- * ptimer_init() will assert() that you don't set both.
-+ * ptimer_init_with_bh() will assert() that you don't set both.
-  */
- #define PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT (1 << 5)
-@@ -XXX,XX +XXX,XX @@ typedef struct ptimer_state ptimer_state;
- typedef void (*ptimer_cb)(void *opaque);
- /**
-- * ptimer_init - Allocate and return a new ptimer
-+ * ptimer_init_with_bh - Allocate and return a new ptimer
-  * @bh: QEMU bottom half which is run on timer expiry
-  * @policy: PTIMER_POLICY_* bits specifying behaviour
-  *
-@@ -XXX,XX +XXX,XX @@ typedef void (*ptimer_cb)(void *opaque);
-  * The ptimer takes ownership of @bh and will delete it
-  * when the ptimer is eventually freed.
-  */
--ptimer_state *ptimer_init(QEMUBH *bh, uint8_t policy_mask);
-+ptimer_state *ptimer_init_with_bh(QEMUBH *bh, uint8_t policy_mask);
- /**
-  * ptimer_free - Free a ptimer
-  * @s: timer to free
-  *
-- * Free a ptimer created using ptimer_init() (including
-+ * Free a ptimer created using ptimer_init_with_bh() (including
-  * deleting the bottom half which it is using).
-  */
- void ptimer_free(ptimer_state *s);
-@@ -XXX,XX +XXX,XX @@ void ptimer_set_count(ptimer_state *s, uint64_t count);
-  * @oneshot: non-zero if this timer should only count down once
-  *
-  * Start a ptimer counting down; when it reaches zero the bottom half
-- * passed to ptimer_init() will be invoked. If the @oneshot argument is zero,
-+ * passed to ptimer_init_with_bh() will be invoked.
-+ * If the @oneshot argument is zero,
-  * the counter value will then be reloaded from the limit and it will
-  * start counting down again. If @oneshot is non-zero, then the counter
-  * will disable itself when it reaches zero.
-diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/musicpal.c
-+++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ static void mv88w8618_timer_init(SysBusDevice *dev, mv88w8618_timer_state *s,
-     s->freq = freq;
-     bh = qemu_bh_new(mv88w8618_timer_tick, s);
--    s->ptimer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+    s->ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
- }
- static uint64_t mv88w8618_pit_read(void *opaque, hwaddr offset,
-diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/core/ptimer.c
-+++ b/hw/core/ptimer.c
-@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_ptimer = {
-     }
- };
--ptimer_state *ptimer_init(QEMUBH *bh, uint8_t policy_mask)
-+ptimer_state *ptimer_init_with_bh(QEMUBH *bh, uint8_t policy_mask)
- {
-     ptimer_state *s;
-diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xilinx_axidma.c
-+++ b/hw/dma/xilinx_axidma.c
-@@ -XXX,XX +XXX,XX @@ static void xilinx_axidma_realize(DeviceState *dev, Error **errp)
-         st->nr = i;
-         st->bh = qemu_bh_new(timer_hit, st);
--        st->ptimer = ptimer_init(st->bh, PTIMER_POLICY_DEFAULT);
-+        st->ptimer = ptimer_init_with_bh(st->bh, PTIMER_POLICY_DEFAULT);
-         ptimer_set_freq(st->ptimer, s->freqhz);
-     }
-     return;
-diff --git a/hw/m68k/mcf5206.c b/hw/m68k/mcf5206.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/m68k/mcf5206.c
-+++ b/hw/m68k/mcf5206.c
-@@ -XXX,XX +XXX,XX @@ static m5206_timer_state *m5206_timer_init(qemu_irq irq)
-     s = g_new0(m5206_timer_state, 1);
-     bh = qemu_bh_new(m5206_timer_trigger, s);
--    s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-     s->irq = irq;
-     m5206_timer_reset(s);
-     return s;
-diff --git a/hw/m68k/mcf5208.c b/hw/m68k/mcf5208.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/m68k/mcf5208.c
-+++ b/hw/m68k/mcf5208.c
-@@ -XXX,XX +XXX,XX @@ static void mcf5208_sys_init(MemoryRegion *address_space, qemu_irq *pic)
-     for (i = 0; i < 2; i++) {
-         s = g_new0(m5208_timer_state, 1);
-         bh = qemu_bh_new(m5208_timer_trigger, s);
--        s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+        s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-         memory_region_init_io(&s->iomem, NULL, &m5208_timer_ops, s,
-                               "m5208-timer", 0x00004000);
-         memory_region_add_subregion(address_space, 0xfc080000 + 0x4000 * i,
-diff --git a/hw/net/fsl_etsec/etsec.c b/hw/net/fsl_etsec/etsec.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/fsl_etsec/etsec.c
-+++ b/hw/net/fsl_etsec/etsec.c
-@@ -XXX,XX +XXX,XX @@ static void etsec_realize(DeviceState *dev, Error **errp)
-     etsec->bh     = qemu_bh_new(etsec_timer_hit, etsec);
--    etsec->ptimer = ptimer_init(etsec->bh, PTIMER_POLICY_DEFAULT);
-+    etsec->ptimer = ptimer_init_with_bh(etsec->bh, PTIMER_POLICY_DEFAULT);
-     ptimer_set_freq(etsec->ptimer, 100);
- }
-diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/lan9118.c
-+++ b/hw/net/lan9118.c
-@@ -XXX,XX +XXX,XX @@ static void lan9118_realize(DeviceState *dev, Error **errp)
-     s->txp = &s->tx_packet;
-     bh = qemu_bh_new(lan9118_tick, s);
--    s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-     ptimer_set_freq(s->timer, 10000);
-     ptimer_set_limit(s->timer, 0xffff, 1);
- }
-diff --git a/hw/timer/allwinner-a10-pit.c b/hw/timer/allwinner-a10-pit.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/allwinner-a10-pit.c
-+++ b/hw/timer/allwinner-a10-pit.c
-@@ -XXX,XX +XXX,XX @@ static void a10_pit_init(Object *obj)
-         tc->container = s;
-         tc->index = i;
-         bh[i] = qemu_bh_new(a10_pit_timer_cb, tc);
--        s->timer[i] = ptimer_init(bh[i], PTIMER_POLICY_DEFAULT);
-+        s->timer[i] = ptimer_init_with_bh(bh[i], PTIMER_POLICY_DEFAULT);
-     }
- }
-diff --git a/hw/timer/altera_timer.c b/hw/timer/altera_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/altera_timer.c
-+++ b/hw/timer/altera_timer.c
-@@ -XXX,XX +XXX,XX @@ static void altera_timer_realize(DeviceState *dev, Error **errp)
-     }
-     t->bh = qemu_bh_new(timer_hit, t);
--    t->ptimer = ptimer_init(t->bh, PTIMER_POLICY_DEFAULT);
-+    t->ptimer = ptimer_init_with_bh(t->bh, PTIMER_POLICY_DEFAULT);
-     ptimer_set_freq(t->ptimer, t->freq_hz);
-     memory_region_init_io(&t->mmio, OBJECT(t), &timer_ops, t,
-diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/arm_mptimer.c
-+++ b/hw/timer/arm_mptimer.c
-@@ -XXX,XX +XXX,XX @@ static void arm_mptimer_reset(DeviceState *dev)
-     }
- }
--static void arm_mptimer_init(Object *obj)
-+static void arm_mptimer_init_with_bh(Object *obj)
- {
-     ARMMPTimerState *s = ARM_MPTIMER(obj);
-@@ -XXX,XX +XXX,XX @@ static void arm_mptimer_realize(DeviceState *dev, Error **errp)
-     for (i = 0; i < s->num_cpu; i++) {
-         TimerBlock *tb = &s->timerblock[i];
-         QEMUBH *bh = qemu_bh_new(timerblock_tick, tb);
--        tb->timer = ptimer_init(bh, PTIMER_POLICY);
-+        tb->timer = ptimer_init_with_bh(bh, PTIMER_POLICY);
-         sysbus_init_irq(sbd, &tb->irq);
-         memory_region_init_io(&tb->iomem, OBJECT(s), &timerblock_ops, tb,
-                               "arm_mptimer_timerblock", 0x20);
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo arm_mptimer_info = {
-     .name          = TYPE_ARM_MPTIMER,
-     .parent        = TYPE_SYS_BUS_DEVICE,
-     .instance_size = sizeof(ARMMPTimerState),
--    .instance_init = arm_mptimer_init,
-+    .instance_init = arm_mptimer_init_with_bh,
-     .class_init    = arm_mptimer_class_init,
- };
-diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/arm_timer.c
-+++ b/hw/timer/arm_timer.c
-@@ -XXX,XX +XXX,XX @@ static arm_timer_state *arm_timer_init(uint32_t freq)
-     s->control = TIMER_CTRL_IE;
-     bh = qemu_bh_new(arm_timer_tick, s);
--    s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-     vmstate_register(NULL, -1, &vmstate_arm_timer, s);
-     return s;
- }
-diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/cmsdk-apb-dualtimer.c
-+++ b/hw/timer/cmsdk-apb-dualtimer.c
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
-         QEMUBH *bh = qemu_bh_new(cmsdk_dualtimermod_tick, m);
-         m->parent = s;
--        m->timer = ptimer_init(bh,
-+        m->timer = ptimer_init_with_bh(bh,
-                                PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
-                                PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
-                                PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
-diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/cmsdk-apb-timer.c
-+++ b/hw/timer/cmsdk-apb-timer.c
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
-     }
-     bh = qemu_bh_new(cmsdk_apb_timer_tick, s);
--    s->timer = ptimer_init(bh,
-+    s->timer = ptimer_init_with_bh(bh,
-                            PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
-                            PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
-                            PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
-diff --git a/hw/timer/digic-timer.c b/hw/timer/digic-timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/digic-timer.c
-+++ b/hw/timer/digic-timer.c
-@@ -XXX,XX +XXX,XX @@ static void digic_timer_init(Object *obj)
- {
-     DigicTimerState *s = DIGIC_TIMER(obj);
--    s->ptimer = ptimer_init(NULL, PTIMER_POLICY_DEFAULT);
-+    s->ptimer = ptimer_init_with_bh(NULL, PTIMER_POLICY_DEFAULT);
-     /*
-      * FIXME: there is no documentation on Digic timer
-diff --git a/hw/timer/etraxfs_timer.c b/hw/timer/etraxfs_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/etraxfs_timer.c
-+++ b/hw/timer/etraxfs_timer.c
-@@ -XXX,XX +XXX,XX @@ static void etraxfs_timer_realize(DeviceState *dev, Error **errp)
-     t->bh_t0 = qemu_bh_new(timer0_hit, t);
-     t->bh_t1 = qemu_bh_new(timer1_hit, t);
-     t->bh_wd = qemu_bh_new(watchdog_hit, t);
--    t->ptimer_t0 = ptimer_init(t->bh_t0, PTIMER_POLICY_DEFAULT);
--    t->ptimer_t1 = ptimer_init(t->bh_t1, PTIMER_POLICY_DEFAULT);
--    t->ptimer_wd = ptimer_init(t->bh_wd, PTIMER_POLICY_DEFAULT);
-+    t->ptimer_t0 = ptimer_init_with_bh(t->bh_t0, PTIMER_POLICY_DEFAULT);
-+    t->ptimer_t1 = ptimer_init_with_bh(t->bh_t1, PTIMER_POLICY_DEFAULT);
-+    t->ptimer_wd = ptimer_init_with_bh(t->bh_wd, PTIMER_POLICY_DEFAULT);
-     sysbus_init_irq(sbd, &t->irq);
-     sysbus_init_irq(sbd, &t->nmi);
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
-+++ b/hw/timer/exynos4210_mct.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
-     /* Global timer */
-     bh[0] = qemu_bh_new(exynos4210_gfrc_event, s);
--    s->g_timer.ptimer_frc = ptimer_init(bh[0], PTIMER_POLICY_DEFAULT);
-+    s->g_timer.ptimer_frc = ptimer_init_with_bh(bh[0], PTIMER_POLICY_DEFAULT);
-     memset(&s->g_timer.reg, 0, sizeof(struct gregs));
-     /* Local timers */
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
-         bh[0] = qemu_bh_new(exynos4210_ltick_event, &s->l_timer[i]);
-         bh[1] = qemu_bh_new(exynos4210_lfrc_event, &s->l_timer[i]);
-         s->l_timer[i].tick_timer.ptimer_tick =
--                                   ptimer_init(bh[0], PTIMER_POLICY_DEFAULT);
--        s->l_timer[i].ptimer_frc = ptimer_init(bh[1], PTIMER_POLICY_DEFAULT);
-+            ptimer_init_with_bh(bh[0], PTIMER_POLICY_DEFAULT);
-+        s->l_timer[i].ptimer_frc =
-+            ptimer_init_with_bh(bh[1], PTIMER_POLICY_DEFAULT);
-         s->l_timer[i].id = i;
-     }
-diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_pwm.c
-+++ b/hw/timer/exynos4210_pwm.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_init(Object *obj)
-     for (i = 0; i < EXYNOS4210_PWM_TIMERS_NUM; i++) {
-         bh = qemu_bh_new(exynos4210_pwm_tick, &s->timer[i]);
-         sysbus_init_irq(dev, &s->timer[i].irq);
--        s->timer[i].ptimer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+        s->timer[i].ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-         s->timer[i].id = i;
-         s->timer[i].parent = s;
-     }
-diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_rtc.c
-+++ b/hw/timer/exynos4210_rtc.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_init(Object *obj)
-     QEMUBH *bh;
-     bh = qemu_bh_new(exynos4210_rtc_tick, s);
--    s->ptimer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+    s->ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-     ptimer_set_freq(s->ptimer, RTC_BASE_FREQ);
-     exynos4210_rtc_update_freq(s, 0);
-     bh = qemu_bh_new(exynos4210_rtc_1Hz_tick, s);
--    s->ptimer_1Hz = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+    s->ptimer_1Hz = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-     ptimer_set_freq(s->ptimer_1Hz, RTC_BASE_FREQ);
-     sysbus_init_irq(dev, &s->alm_irq);
-diff --git a/hw/timer/grlib_gptimer.c b/hw/timer/grlib_gptimer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/grlib_gptimer.c
-+++ b/hw/timer/grlib_gptimer.c
-@@ -XXX,XX +XXX,XX @@ static void grlib_gptimer_realize(DeviceState *dev, Error **errp)
-         timer->unit   = unit;
-         timer->bh     = qemu_bh_new(grlib_gptimer_hit, timer);
--        timer->ptimer = ptimer_init(timer->bh, PTIMER_POLICY_DEFAULT);
-+        timer->ptimer = ptimer_init_with_bh(timer->bh, PTIMER_POLICY_DEFAULT);
-         timer->id     = i;
-         /* One IRQ line for each timer */
-diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/imx_epit.c
-+++ b/hw/timer/imx_epit.c
-@@ -XXX,XX +XXX,XX @@ static void imx_epit_realize(DeviceState *dev, Error **errp)
-x00001000);
-     sysbus_init_mmio(sbd, &s->iomem);
--    s->timer_reload = ptimer_init(NULL, PTIMER_POLICY_DEFAULT);
-+    s->timer_reload = ptimer_init_with_bh(NULL, PTIMER_POLICY_DEFAULT);
-     bh = qemu_bh_new(imx_epit_cmp, s);
--    s->timer_cmp = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+    s->timer_cmp = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
- }
- static void imx_epit_class_init(ObjectClass *klass, void *data)
-diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/imx_gpt.c
-+++ b/hw/timer/imx_gpt.c
-@@ -XXX,XX +XXX,XX @@ static void imx_gpt_realize(DeviceState *dev, Error **errp)
-     sysbus_init_mmio(sbd, &s->iomem);
-     bh = qemu_bh_new(imx_gpt_timeout, s);
--    s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
- }
- static void imx_gpt_class_init(ObjectClass *klass, void *data)
-diff --git a/hw/timer/lm32_timer.c b/hw/timer/lm32_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/lm32_timer.c
-+++ b/hw/timer/lm32_timer.c
-@@ -XXX,XX +XXX,XX @@ static void lm32_timer_realize(DeviceState *dev, Error **errp)
-     LM32TimerState *s = LM32_TIMER(dev);
-     s->bh = qemu_bh_new(timer_hit, s);
--    s->ptimer = ptimer_init(s->bh, PTIMER_POLICY_DEFAULT);
-+    s->ptimer = ptimer_init_with_bh(s->bh, PTIMER_POLICY_DEFAULT);
-     ptimer_set_freq(s->ptimer, s->freq_hz);
- }
-diff --git a/hw/timer/milkymist-sysctl.c b/hw/timer/milkymist-sysctl.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/milkymist-sysctl.c
-+++ b/hw/timer/milkymist-sysctl.c
-@@ -XXX,XX +XXX,XX @@ static void milkymist_sysctl_realize(DeviceState *dev, Error **errp)
-     s->bh0 = qemu_bh_new(timer0_hit, s);
-     s->bh1 = qemu_bh_new(timer1_hit, s);
--    s->ptimer0 = ptimer_init(s->bh0, PTIMER_POLICY_DEFAULT);
--    s->ptimer1 = ptimer_init(s->bh1, PTIMER_POLICY_DEFAULT);
-+    s->ptimer0 = ptimer_init_with_bh(s->bh0, PTIMER_POLICY_DEFAULT);
-+    s->ptimer1 = ptimer_init_with_bh(s->bh1, PTIMER_POLICY_DEFAULT);
-     ptimer_set_freq(s->ptimer0, s->freq_hz);
-     ptimer_set_freq(s->ptimer1, s->freq_hz);
-diff --git a/hw/timer/mss-timer.c b/hw/timer/mss-timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/mss-timer.c
-+++ b/hw/timer/mss-timer.c
-@@ -XXX,XX +XXX,XX @@ static void mss_timer_init(Object *obj)
-         struct Msf2Timer *st = &t->timers[i];
-         st->bh = qemu_bh_new(timer_hit, st);
--        st->ptimer = ptimer_init(st->bh, PTIMER_POLICY_DEFAULT);
-+        st->ptimer = ptimer_init_with_bh(st->bh, PTIMER_POLICY_DEFAULT);
-         ptimer_set_freq(st->ptimer, t->freq_hz);
-         sysbus_init_irq(SYS_BUS_DEVICE(obj), &st->irq);
-     }
-diff --git a/hw/timer/puv3_ost.c b/hw/timer/puv3_ost.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/puv3_ost.c
-+++ b/hw/timer/puv3_ost.c
-@@ -XXX,XX +XXX,XX @@ static void puv3_ost_realize(DeviceState *dev, Error **errp)
-     sysbus_init_irq(sbd, &s->irq);
-     s->bh = qemu_bh_new(puv3_ost_tick, s);
--    s->ptimer = ptimer_init(s->bh, PTIMER_POLICY_DEFAULT);
-+    s->ptimer = ptimer_init_with_bh(s->bh, PTIMER_POLICY_DEFAULT);
-     ptimer_set_freq(s->ptimer, 50 * 1000 * 1000);
-     memory_region_init_io(&s->iomem, OBJECT(s), &puv3_ost_ops, s, "puv3_ost",
-diff --git a/hw/timer/sh_timer.c b/hw/timer/sh_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/sh_timer.c
-+++ b/hw/timer/sh_timer.c
-@@ -XXX,XX +XXX,XX @@ static void *sh_timer_init(uint32_t freq, int feat, qemu_irq irq)
-     s->irq = irq;
-     bh = qemu_bh_new(sh_timer_tick, s);
--    s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-     sh_timer_write(s, OFFSET_TCOR >> 2, s->tcor);
-     sh_timer_write(s, OFFSET_TCNT >> 2, s->tcnt);
-diff --git a/hw/timer/slavio_timer.c b/hw/timer/slavio_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/slavio_timer.c
-+++ b/hw/timer/slavio_timer.c
-@@ -XXX,XX +XXX,XX @@ static void slavio_timer_init(Object *obj)
-         tc->timer_index = i;
-         bh = qemu_bh_new(slavio_timer_irq, tc);
--        s->cputimer[i].timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
-+        s->cputimer[i].timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-         ptimer_set_period(s->cputimer[i].timer, TIMER_PERIOD);
-         size = i == 0 ? SYS_TIMER_SIZE : CPU_TIMER_SIZE;
-diff --git a/hw/timer/xilinx_timer.c b/hw/timer/xilinx_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/xilinx_timer.c
-+++ b/hw/timer/xilinx_timer.c
-@@ -XXX,XX +XXX,XX @@ static void xilinx_timer_realize(DeviceState *dev, Error **errp)
-         xt->parent = t;
-         xt->nr = i;
-         xt->bh = qemu_bh_new(timer_hit, xt);
--        xt->ptimer = ptimer_init(xt->bh, PTIMER_POLICY_DEFAULT);
-+        xt->ptimer = ptimer_init_with_bh(xt->bh, PTIMER_POLICY_DEFAULT);
-         ptimer_set_freq(xt->ptimer, t->freq_hz);
-     }
-diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/watchdog/cmsdk-apb-watchdog.c
-+++ b/hw/watchdog/cmsdk-apb-watchdog.c
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
-     }
-     bh = qemu_bh_new(cmsdk_apb_watchdog_tick, s);
--    s->timer = ptimer_init(bh,
-+    s->timer = ptimer_init_with_bh(bh,
-                            PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
-                            PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
-                            PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
-diff --git a/tests/ptimer-test.c b/tests/ptimer-test.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/ptimer-test.c
-+++ b/tests/ptimer-test.c
-@@ -XXX,XX +XXX,XX @@ static void check_set_count(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_set_limit(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_oneshot(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
-@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_mode_change(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
-     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_period_change(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_freq_change(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_run_with_period_0(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-     bool continuous_trigger = (*policy & PTIMER_POLICY_CONTINUOUS_TRIGGER);
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-     bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
-@@ -XXX,XX +XXX,XX @@ static void check_oneshot_with_load_0(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-     bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
---
-.20.1

-[PULL 06/68] tests/ptimer-test: Switch to transaction-based ptimer API
+Deleted patch
-Convert the ptimer test cases to the transaction-based ptimer API,
-by changing to ptimer_init(), dropping the now-unused QEMUBH
-variables, and surrounding each set of changes to the ptimer
-state in ptimer_transaction_begin/commit calls.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-4-peter.maydell@linaro.org
----
- tests/ptimer-test.c | 106 +++++++++++++++++++++++++++++++++++---------
-file changed, 84 insertions(+), 22 deletions(-)
-diff --git a/tests/ptimer-test.c b/tests/ptimer-test.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/ptimer-test.c
-+++ b/tests/ptimer-test.c
-@@ -XXX,XX +XXX,XX @@ static void qemu_clock_step(uint64_t ns)
- static void check_set_count(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
--    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_count(ptimer, 1000);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 1000);
-     g_assert_false(triggered);
-     ptimer_free(ptimer);
-@@ -XXX,XX +XXX,XX @@ static void check_set_count(gconstpointer arg)
- static void check_set_limit(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
--    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_limit(ptimer, 1000, 0);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
-     g_assert_cmpuint(ptimer_get_limit(ptimer), ==, 1000);
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_limit(ptimer, 2000, 1);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 2000);
-     g_assert_cmpuint(ptimer_get_limit(ptimer), ==, 2000);
-     g_assert_false(triggered);
-@@ -XXX,XX +XXX,XX @@ static void check_set_limit(gconstpointer arg)
- static void check_oneshot(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
--    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
-     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_period(ptimer, 2000000);
-     ptimer_set_count(ptimer, 10);
-     ptimer_run(ptimer, 1);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(2000000 * 2 + 1);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 8 : 7);
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_stop(ptimer);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 8 : 7);
-     g_assert_false(triggered);
-@@ -XXX,XX +XXX,XX @@ static void check_oneshot(gconstpointer arg)
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 8 : 7);
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_run(ptimer, 1);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(2000000 * 7 + 1);
-@@ -XXX,XX +XXX,XX @@ static void check_oneshot(gconstpointer arg)
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_count(ptimer, 10);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(20000000 + 1);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 10);
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_limit(ptimer, 9, 1);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(20000000 + 1);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 9);
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_run(ptimer, 1);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(2000000 + 1);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 8 : 7);
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_count(ptimer, 20);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(2000000 * 19 + 1);
-@@ -XXX,XX +XXX,XX @@ static void check_oneshot(gconstpointer arg)
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
-     g_assert_true(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_stop(ptimer);
-+    ptimer_transaction_commit(ptimer);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_oneshot(gconstpointer arg)
- static void check_periodic(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
--    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
-     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_period(ptimer, 2000000);
-     ptimer_set_limit(ptimer, 10, 1);
-     ptimer_run(ptimer, 0);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 10);
-     g_assert_false(triggered);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
-                     (no_round_down ? 9 : 8) + (wrap_policy ? 1 : 0));
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_count(ptimer, 20);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 20);
-     g_assert_false(triggered);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_count(ptimer, 3);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 3);
-     g_assert_false(triggered);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
-                     (no_round_down ? 9 : 8) + (wrap_policy ? 1 : 0));
-     g_assert_true(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_stop(ptimer);
-+    ptimer_transaction_commit(ptimer);
-     triggered = false;
-     qemu_clock_step(2000000);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
-                     (no_round_down ? 9 : 8) + (wrap_policy ? 1 : 0));
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_count(ptimer, 3);
-     ptimer_run(ptimer, 0);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(2000000 * 3 + 1);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
-                     (no_round_down ? 9 : 8) + (wrap_policy ? 1 : 0));
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_count(ptimer, 0);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
-                      no_immediate_reload ? 0 : 10);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
-                     (no_round_down ? 8 : 7) + (wrap_policy ? 1 : 0));
-     g_assert_true(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_stop(ptimer);
-+    ptimer_transaction_commit(ptimer);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
-                     (no_round_down ? 8 : 7) + (wrap_policy ? 1 : 0));
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_run(ptimer, 0);
-+    ptimer_transaction_commit(ptimer);
-+
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_period(ptimer, 0);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(2000000 + 1);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
- static void check_on_the_fly_mode_change(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
--    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
-     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
-     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_period(ptimer, 2000000);
-     ptimer_set_limit(ptimer, 10, 1);
-     ptimer_run(ptimer, 1);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(2000000 * 9 + 1);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 1 : 0);
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_run(ptimer, 0);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 1 : 0);
-     g_assert_false(triggered);
-@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_mode_change(gconstpointer arg)
-     qemu_clock_step(2000000 * 9);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_run(ptimer, 1);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
-                      (no_round_down ? 1 : 0) + (wrap_policy ? 1 : 0));
-@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_mode_change(gconstpointer arg)
- static void check_on_the_fly_period_change(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
--    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
-     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_period(ptimer, 2000000);
-     ptimer_set_limit(ptimer, 8, 1);
-     ptimer_run(ptimer, 1);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(2000000 * 4 + 1);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 4 : 3);
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_period(ptimer, 4000000);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 4 : 3);
-     qemu_clock_step(4000000 * 2 + 1);
-@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_period_change(gconstpointer arg)
- static void check_on_the_fly_freq_change(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
--    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
-     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_freq(ptimer, 500);
-     ptimer_set_limit(ptimer, 8, 1);
-     ptimer_run(ptimer, 1);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(2000000 * 4 + 1);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 4 : 3);
-     g_assert_false(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_freq(ptimer, 250);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 4 : 3);
-     qemu_clock_step(2000000 * 4 + 1);
-@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_freq_change(gconstpointer arg)
- static void check_run_with_period_0(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
--    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_count(ptimer, 99);
-     ptimer_run(ptimer, 1);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(10 * NANOSECONDS_PER_SECOND);
-@@ -XXX,XX +XXX,XX @@ static void check_run_with_period_0(gconstpointer arg)
- static void check_run_with_delta_0(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
--    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
-     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
-@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_period(ptimer, 2000000);
-     ptimer_set_limit(ptimer, 99, 0);
-     ptimer_run(ptimer, 1);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
-                      no_immediate_reload ? 0 : 99);
-@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
-             g_assert_false(triggered);
-         }
-+        ptimer_transaction_begin(ptimer);
-         ptimer_set_count(ptimer, 99);
-         ptimer_run(ptimer, 1);
-+        ptimer_transaction_commit(ptimer);
-     }
-     qemu_clock_step(2000000 + 1);
-@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_count(ptimer, 0);
-     ptimer_run(ptimer, 0);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
-                      no_immediate_reload ? 0 : 99);
-@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
-                     wrap_policy ? 0 : (no_round_down ? 99 : 98));
-     g_assert_true(triggered);
-+    ptimer_transaction_begin(ptimer);
-     ptimer_stop(ptimer);
-+    ptimer_transaction_commit(ptimer);
-     ptimer_free(ptimer);
- }
- static void check_periodic_with_load_0(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
--    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
-     bool continuous_trigger = (*policy & PTIMER_POLICY_CONTINUOUS_TRIGGER);
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-     bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_period(ptimer, 2000000);
-     ptimer_run(ptimer, 0);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg)
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_count(ptimer, 10);
-     ptimer_run(ptimer, 0);
-+    ptimer_transaction_commit(ptimer);
-     qemu_clock_step(2000000 * 10 + 1);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg)
-         g_assert_false(triggered);
-     }
-+    ptimer_transaction_begin(ptimer);
-     ptimer_stop(ptimer);
-+    ptimer_transaction_commit(ptimer);
-     ptimer_free(ptimer);
- }
- static void check_oneshot_with_load_0(gconstpointer arg)
- {
-     const uint8_t *policy = arg;
--    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
--    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
-+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-     bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
-     triggered = false;
-+    ptimer_transaction_begin(ptimer);
-     ptimer_set_period(ptimer, 2000000);
-     ptimer_run(ptimer, 1);
-+    ptimer_transaction_commit(ptimer);
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
---
-.20.1

-[PULL 07/68] hw/timer/arm_timer.c: Switch to transaction-based ptimer API
+Deleted patch
-Switch the arm_timer.c code away from bottom-half based ptimers
-to the new transaction-based ptimer API. This just requires
-adding begin/commit calls around the various arms of
-arm_timer_write() that modify the ptimer state, and using the
-new ptimer_init() function to create the timer.
-Fixes: https://bugs.launchpad.net/qemu/+bug/1777777
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-5-peter.maydell@linaro.org
----
- hw/timer/arm_timer.c | 16 +++++++++++-----
-file changed, 11 insertions(+), 5 deletions(-)
-diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/arm_timer.c
-+++ b/hw/timer/arm_timer.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/irq.h"
- #include "hw/ptimer.h"
- #include "hw/qdev-properties.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- #include "qemu/log.h"
-@@ -XXX,XX +XXX,XX @@ static uint32_t arm_timer_read(void *opaque, hwaddr offset)
-     }
- }
--/* Reset the timer limit after settings have changed.  */
-+/*
-+ * Reset the timer limit after settings have changed.
-+ * May only be called from inside a ptimer transaction block.
-+ */
- static void arm_timer_recalibrate(arm_timer_state *s, int reload)
- {
-     uint32_t limit;
-@@ -XXX,XX +XXX,XX @@ static void arm_timer_write(void *opaque, hwaddr offset,
-     switch (offset >> 2) {
-     case 0: /* TimerLoad */
-         s->limit = value;
-+        ptimer_transaction_begin(s->timer);
-         arm_timer_recalibrate(s, 1);
-+        ptimer_transaction_commit(s->timer);
-         break;
-     case 1: /* TimerValue */
-         /* ??? Linux seems to want to write to this readonly register.
-            Ignore it.  */
-         break;
-     case 2: /* TimerControl */
-+        ptimer_transaction_begin(s->timer);
-         if (s->control & TIMER_CTRL_ENABLE) {
-             /* Pause the timer if it is running.  This may cause some
-                inaccuracy dure to rounding, but avoids a whole lot of other
-@@ -XXX,XX +XXX,XX @@ static void arm_timer_write(void *opaque, hwaddr offset,
-             /* Restart the timer if still enabled.  */
-             ptimer_run(s->timer, (s->control & TIMER_CTRL_ONESHOT) != 0);
-         }
-+        ptimer_transaction_commit(s->timer);
-         break;
-     case 3: /* TimerIntClr */
-         s->int_level = 0;
-         break;
-     case 6: /* TimerBGLoad */
-         s->limit = value;
-+        ptimer_transaction_begin(s->timer);
-         arm_timer_recalibrate(s, 0);
-+        ptimer_transaction_commit(s->timer);
-         break;
-     default:
-         qemu_log_mask(LOG_GUEST_ERROR,
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_arm_timer = {
- static arm_timer_state *arm_timer_init(uint32_t freq)
- {
-     arm_timer_state *s;
--    QEMUBH *bh;
-     s = (arm_timer_state *)g_malloc0(sizeof(arm_timer_state));
-     s->freq = freq;
-     s->control = TIMER_CTRL_IE;
--    bh = qemu_bh_new(arm_timer_tick, s);
--    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-+    s->timer = ptimer_init(arm_timer_tick, s, PTIMER_POLICY_DEFAULT);
-     vmstate_register(NULL, -1, &vmstate_arm_timer, s);
-     return s;
- }
---
-.20.1

-[PULL 08/68] hw/arm/musicpal.c: Switch to transaction-based ptimer API
+Deleted patch
-Switch the musicpal code away from bottom-half based ptimers to
-the new transaction-based ptimer API.  This just requires adding
-begin/commit calls around the various places that modify the ptimer
-state, and using the new ptimer_init() function to create the timer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-6-peter.maydell@linaro.org
----
- hw/arm/musicpal.c | 16 ++++++++++------
-file changed, 10 insertions(+), 6 deletions(-)
-diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/musicpal.c
-+++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ static void mv88w8618_timer_tick(void *opaque)
- static void mv88w8618_timer_init(SysBusDevice *dev, mv88w8618_timer_state *s,
-                                  uint32_t freq)
- {
--    QEMUBH *bh;
--
-     sysbus_init_irq(dev, &s->irq);
-     s->freq = freq;
--    bh = qemu_bh_new(mv88w8618_timer_tick, s);
--    s->ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-+    s->ptimer = ptimer_init(mv88w8618_timer_tick, s, PTIMER_POLICY_DEFAULT);
- }
- static uint64_t mv88w8618_pit_read(void *opaque, hwaddr offset,
-@@ -XXX,XX +XXX,XX @@ static void mv88w8618_pit_write(void *opaque, hwaddr offset,
-     case MP_PIT_TIMER1_LENGTH ... MP_PIT_TIMER4_LENGTH:
-         t = &s->timer[offset >> 2];
-         t->limit = value;
-+        ptimer_transaction_begin(t->ptimer);
-         if (t->limit > 0) {
-             ptimer_set_limit(t->ptimer, t->limit, 1);
-         } else {
-             ptimer_stop(t->ptimer);
-         }
-+        ptimer_transaction_commit(t->ptimer);
-         break;
-     case MP_PIT_CONTROL:
-         for (i = 0; i < 4; i++) {
-             t = &s->timer[i];
-+            ptimer_transaction_begin(t->ptimer);
-             if (value & 0xf && t->limit > 0) {
-                 ptimer_set_limit(t->ptimer, t->limit, 0);
-                 ptimer_set_freq(t->ptimer, t->freq);
-@@ -XXX,XX +XXX,XX @@ static void mv88w8618_pit_write(void *opaque, hwaddr offset,
-             } else {
-                 ptimer_stop(t->ptimer);
-             }
-+            ptimer_transaction_commit(t->ptimer);
-             value >>= 4;
-         }
-         break;
-@@ -XXX,XX +XXX,XX @@ static void mv88w8618_pit_reset(DeviceState *d)
-     int i;
-     for (i = 0; i < 4; i++) {
--        ptimer_stop(s->timer[i].ptimer);
--        s->timer[i].limit = 0;
-+        mv88w8618_timer_state *t = &s->timer[i];
-+        ptimer_transaction_begin(t->ptimer);
-+        ptimer_stop(t->ptimer);
-+        ptimer_transaction_commit(t->ptimer);
-+        t->limit = 0;
-     }
- }
---
-.20.1

-[PULL 09/68] hw/timer/allwinner-a10-pit.c: Switch to transaction-based ptimer API
+[PULL 34/36] hw/arm/virt: kvm: Restructure finalize_gic_version()
-Switch the allwinner-a10-pit code away from bottom-half based ptimers to
+From: Eric Auger <eric.auger@redhat.com>
 the new transaction-based ptimer API.  This just requires adding
 begin/commit calls around the various places that modify the ptimer
 state, and using the new ptimer_init() function to create the timer.
+Restructure the finalize_gic_version with switch cases and
+clearly separate the following cases:
+- KVM mode / in-kernel irqchip
+- KVM mode / userspace irqchip
+- TCG mode
+In KVM mode / in-kernel irqchip , we explictly check whether
+the chosen version is supported by the host. If the end-user
+explicitly sets v2/v3 and this is not supported by the host,
+then the user gets an explicit error message. Note that for
+old kernels where the CREATE_DEVICE ioctl doesn't exist then
+we will now fail if the user specifically asked for gicv2,
+where previously we (probably) would have succeeded.
+In KVM mode / userspace irqchip we immediatly output an error
+in case the end-user explicitly selected v3. Also we warn the
+end-user about the unexpected usage of gic-version=host in
+that case as only userspace GICv2 is supported.
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20200311131618.7187-6-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-7-peter.maydell@linaro.org
 ---
- hw/timer/allwinner-a10-pit.c | 12 ++++++++----
+ hw/arm/virt.c | 88 +++++++++++++++++++++++++++++++++++++++------------
-file changed, 8 insertions(+), 4 deletions(-)
+file changed, 67 insertions(+), 21 deletions(-)
-diff --git a/hw/timer/allwinner-a10-pit.c b/hw/timer/allwinner-a10-pit.c
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/allwinner-a10-pit.c
+--- a/hw/arm/virt.c
-+++ b/hw/timer/allwinner-a10-pit.c
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void virt_set_memmap(VirtMachineState *vms)
- #include "hw/timer/allwinner-a10-pit.h"
+  */
- #include "migration/vmstate.h"
+ static void finalize_gic_version(VirtMachineState *vms)
  #include "qemu/log.h"
 -#include "qemu/main-loop.h"
  #include "qemu/module.h"
  static void a10_pit_update_irq(AwA10PITState *s)
@@ -XXX,XX +XXX,XX @@ static uint64_t a10_pit_read(void *opaque, hwaddr offset, unsigned size)
      return 0;
  }
 +/* Must be called inside a ptimer transaction block for s->timer[index] */
  static void a10_pit_set_freq(AwA10PITState *s, int index)
  {
-     uint32_t prescaler, source, source_freq;
+-    if (vms->gic_version == VIRT_GIC_VERSION_HOST ||
-@@ -XXX,XX +XXX,XX @@ static void a10_pit_write(void *opaque, hwaddr offset, uint64_t value,
+-        vms->gic_version == VIRT_GIC_VERSION_MAX) {
-         switch (offset & 0x0f) {
+-        if (!kvm_enabled()) {
-         case AW_A10_PIT_TIMER_CONTROL:
+-            if (vms->gic_version == VIRT_GIC_VERSION_HOST) {
-             s->control[index] = value;
+-                error_report("gic-version=host requires KVM");
-+            ptimer_transaction_begin(s->timer[index]);
+-                exit(1);
-             a10_pit_set_freq(s, index);
+-            } else {
-             if (s->control[index] & AW_A10_PIT_TIMER_RELOAD) {
+-                /* "max": currently means 3 for TCG */
-                 ptimer_set_count(s->timer[index], s->interval[index]);
+-                vms->gic_version = VIRT_GIC_VERSION_3;
-@@ -XXX,XX +XXX,XX @@ static void a10_pit_write(void *opaque, hwaddr offset, uint64_t value,
+-            }
-             } else {
+-        } else {
-                 ptimer_stop(s->timer[index]);
+-            int probe_bitmap = kvm_arm_vgic_probe();
 +    if (kvm_enabled()) {
 +        int probe_bitmap;
 -            if (!probe_bitmap) {
 +        if (!kvm_irqchip_in_kernel()) {
 +            switch (vms->gic_version) {
 +            case VIRT_GIC_VERSION_HOST:
 +                warn_report(
 +                    "gic-version=host not relevant with kernel-irqchip=off "
 +                     "as only userspace GICv2 is supported. Using v2 ...");
 +                return;
 +            case VIRT_GIC_VERSION_MAX:
 +            case VIRT_GIC_VERSION_NOSEL:
 +                vms->gic_version = VIRT_GIC_VERSION_2;
 +                return;
 +            case VIRT_GIC_VERSION_2:
 +                return;
 +            case VIRT_GIC_VERSION_3:
                  error_report(
 -                    "Unable to determine GIC version supported by host");
 +                    "gic-version=3 is not supported with kernel-irqchip=off");
                  exit(1);
 -            } else {
 -                if (probe_bitmap & KVM_ARM_VGIC_V3) {
 -                    vms->gic_version = VIRT_GIC_VERSION_3;
 -                } else {
 -                    vms->gic_version = VIRT_GIC_VERSION_2;
 -                }
              }
-+            ptimer_transaction_commit(s->timer[index]);
+         }
-             break;
+-    } else if (vms->gic_version == VIRT_GIC_VERSION_NOSEL) {
-         case AW_A10_PIT_TIMER_INTERVAL:
++
-             s->interval[index] = value;
++        probe_bitmap = kvm_arm_vgic_probe();
-+            ptimer_transaction_begin(s->timer[index]);
++        if (!probe_bitmap) {
-             ptimer_set_limit(s->timer[index], s->interval[index], 1);
++            error_report("Unable to determine GIC version supported by host");
-+            ptimer_transaction_commit(s->timer[index]);
++            exit(1);
-             break;
++        }
-         case AW_A10_PIT_TIMER_COUNT:
++
-             s->count[index] = value;
++        switch (vms->gic_version) {
-@@ -XXX,XX +XXX,XX @@ static void a10_pit_reset(DeviceState *dev)
++        case VIRT_GIC_VERSION_HOST:
-         s->control[i] = AW_A10_PIT_DEFAULT_CLOCK;
++        case VIRT_GIC_VERSION_MAX:
-         s->interval[i] = 0;
++            if (probe_bitmap & KVM_ARM_VGIC_V3) {
-         s->count[i] = 0;
++                vms->gic_version = VIRT_GIC_VERSION_3;
-+        ptimer_transaction_begin(s->timer[i]);
++            } else {
-         ptimer_stop(s->timer[i]);
++                vms->gic_version = VIRT_GIC_VERSION_2;
-         a10_pit_set_freq(s, i);
++            }
-+        ptimer_transaction_commit(s->timer[i]);
++            return;
-     }
++        case VIRT_GIC_VERSION_NOSEL:
-     s->watch_dog_mode = 0;
++            vms->gic_version = VIRT_GIC_VERSION_2;
-     s->watch_dog_control = 0;
++            break;
-@@ -XXX,XX +XXX,XX @@ static void a10_pit_init(Object *obj)
++        case VIRT_GIC_VERSION_2:
- {
++        case VIRT_GIC_VERSION_3:
-     AwA10PITState *s = AW_A10_PIT(obj);
++            break;
-     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
++        }
--    QEMUBH * bh[AW_A10_PIT_TIMER_NR];
++
-     uint8_t i;
++        /* Check chosen version is effectively supported by the host */
++        if (vms->gic_version == VIRT_GIC_VERSION_2 &&
-     for (i = 0; i < AW_A10_PIT_TIMER_NR; i++) {
++            !(probe_bitmap & KVM_ARM_VGIC_V2)) {
-@@ -XXX,XX +XXX,XX @@ static void a10_pit_init(Object *obj)
++            error_report("host does not support in-kernel GICv2 emulation");
++            exit(1);
-         tc->container = s;
++        } else if (vms->gic_version == VIRT_GIC_VERSION_3 &&
-         tc->index = i;
++                   !(probe_bitmap & KVM_ARM_VGIC_V3)) {
--        bh[i] = qemu_bh_new(a10_pit_timer_cb, tc);
++            error_report("host does not support in-kernel GICv3 emulation");
--        s->timer[i] = ptimer_init_with_bh(bh[i], PTIMER_POLICY_DEFAULT);
++            exit(1);
-+        s->timer[i] = ptimer_init(a10_pit_timer_cb, tc, PTIMER_POLICY_DEFAULT);
++        }
 +        return;
 +    }
 +
 +    /* TCG mode */
 +    switch (vms->gic_version) {
 +    case VIRT_GIC_VERSION_NOSEL:
          vms->gic_version = VIRT_GIC_VERSION_2;
 +        break;
 +    case VIRT_GIC_VERSION_MAX:
 +        vms->gic_version = VIRT_GIC_VERSION_3;
 +        break;
 +    case VIRT_GIC_VERSION_HOST:
 +        error_report("gic-version=host requires KVM");
 +        exit(1);
 +    case VIRT_GIC_VERSION_2:
 +    case VIRT_GIC_VERSION_3:
 +        break;
      }
  }
 --
 .20.1

-[PULL 10/68] hw/timer/arm_mptimer.c: Switch to transaction-based ptimer API
+Deleted patch
-Switch the arm_mptimer.c code away from bottom-half based ptimers to
-the new transaction-based ptimer API.  This just requires adding
-begin/commit calls around the various places that modify the ptimer
-state, and using the new ptimer_init() function to create the timer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-8-peter.maydell@linaro.org
----
- hw/timer/arm_mptimer.c | 14 +++++++++++---
-file changed, 11 insertions(+), 3 deletions(-)
-diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/arm_mptimer.c
-+++ b/hw/timer/arm_mptimer.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/timer/arm_mptimer.h"
- #include "migration/vmstate.h"
- #include "qapi/error.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- #include "hw/core/cpu.h"
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t timerblock_scale(uint32_t control)
-     return (((control >> 8) & 0xff) + 1) * 10;
- }
-+/* Must be called within a ptimer transaction block */
- static inline void timerblock_set_count(struct ptimer_state *timer,
-                                         uint32_t control, uint64_t *count)
- {
-@@ -XXX,XX +XXX,XX @@ static inline void timerblock_set_count(struct ptimer_state *timer,
-     ptimer_set_count(timer, *count);
- }
-+/* Must be called within a ptimer transaction block */
- static inline void timerblock_run(struct ptimer_state *timer,
-                                   uint32_t control, uint32_t load)
- {
-@@ -XXX,XX +XXX,XX @@ static void timerblock_write(void *opaque, hwaddr addr,
-     uint32_t control = tb->control;
-     switch (addr) {
-     case 0: /* Load */
-+        ptimer_transaction_begin(tb->timer);
-         /* Setting load to 0 stops the timer without doing the tick if
-          * prescaler = 0.
-          */
-@@ -XXX,XX +XXX,XX @@ static void timerblock_write(void *opaque, hwaddr addr,
-         }
-         ptimer_set_limit(tb->timer, value, 1);
-         timerblock_run(tb->timer, control, value);
-+        ptimer_transaction_commit(tb->timer);
-         break;
-     case 4: /* Counter.  */
-+        ptimer_transaction_begin(tb->timer);
-         /* Setting counter to 0 stops the one-shot timer, or periodic with
-          * load = 0, without doing the tick if prescaler = 0.
-          */
-@@ -XXX,XX +XXX,XX @@ static void timerblock_write(void *opaque, hwaddr addr,
-         }
-         timerblock_set_count(tb->timer, control, &value);
-         timerblock_run(tb->timer, control, value);
-+        ptimer_transaction_commit(tb->timer);
-         break;
-     case 8: /* Control.  */
-+        ptimer_transaction_begin(tb->timer);
-         if ((control & 3) != (value & 3)) {
-             ptimer_stop(tb->timer);
-         }
-@@ -XXX,XX +XXX,XX @@ static void timerblock_write(void *opaque, hwaddr addr,
-             timerblock_run(tb->timer, value, count);
-         }
-         tb->control = value;
-+        ptimer_transaction_commit(tb->timer);
-         break;
-     case 12: /* Interrupt status.  */
-         tb->status &= ~value;
-@@ -XXX,XX +XXX,XX @@ static void timerblock_reset(TimerBlock *tb)
-     tb->control = 0;
-     tb->status = 0;
-     if (tb->timer) {
-+        ptimer_transaction_begin(tb->timer);
-         ptimer_stop(tb->timer);
-         ptimer_set_limit(tb->timer, 0, 1);
-         ptimer_set_period(tb->timer, timerblock_scale(0));
-+        ptimer_transaction_commit(tb->timer);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void arm_mptimer_realize(DeviceState *dev, Error **errp)
-      */
-     for (i = 0; i < s->num_cpu; i++) {
-         TimerBlock *tb = &s->timerblock[i];
--        QEMUBH *bh = qemu_bh_new(timerblock_tick, tb);
--        tb->timer = ptimer_init_with_bh(bh, PTIMER_POLICY);
-+        tb->timer = ptimer_init(timerblock_tick, tb, PTIMER_POLICY);
-         sysbus_init_irq(sbd, &tb->irq);
-         memory_region_init_io(&tb->iomem, OBJECT(s), &timerblock_ops, tb,
-                               "arm_mptimer_timerblock", 0x20);
---
-.20.1

-[PULL 11/68] hw/timer/cmsdk-apb-dualtimer.c: Switch to transaction-based ptimer API
+Deleted patch
-Switch the cmsdk-apb-dualtimer code away from bottom-half based
-ptimers to the new transaction-based ptimer API.  This just requires
-adding begin/commit calls around the various places that modify the
-ptimer state, and using the new ptimer_init() function to create the
-timer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-9-peter.maydell@linaro.org
----
- hw/timer/cmsdk-apb-dualtimer.c | 14 +++++++++++---
-file changed, 11 insertions(+), 3 deletions(-)
-diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/cmsdk-apb-dualtimer.c
-+++ b/hw/timer/cmsdk-apb-dualtimer.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/log.h"
- #include "trace.h"
- #include "qapi/error.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- #include "hw/sysbus.h"
- #include "hw/irq.h"
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
-     /* Handle a write to the CONTROL register */
-     uint32_t changed;
-+    ptimer_transaction_begin(m->timer);
-+
-     newctrl &= R_CONTROL_VALID_MASK;
-     changed = m->control ^ newctrl;
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
-     }
-     m->control = newctrl;
-+
-+    ptimer_transaction_commit(m->timer);
- }
- static uint64_t cmsdk_apb_dualtimer_read(void *opaque, hwaddr offset,
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_write(void *opaque, hwaddr offset,
-             if (!(m->control & R_CONTROL_SIZE_MASK)) {
-                 value &= 0xffff;
-             }
-+            ptimer_transaction_begin(m->timer);
-             if (!(m->control & R_CONTROL_MODE_MASK)) {
-                 /*
-                  * In free-running mode this won't set the limit but will
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_write(void *opaque, hwaddr offset,
-                     ptimer_run(m->timer, 1);
-                 }
-             }
-+            ptimer_transaction_commit(m->timer);
-             break;
-         case A_TIMER1BGLOAD:
-             /* Set the limit, but not the current count */
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_write(void *opaque, hwaddr offset,
-             if (!(m->control & R_CONTROL_SIZE_MASK)) {
-                 value &= 0xffff;
-             }
-+            ptimer_transaction_begin(m->timer);
-             ptimer_set_limit(m->timer, value, 0);
-+            ptimer_transaction_commit(m->timer);
-             break;
-         case A_TIMER1CONTROL:
-             cmsdk_dualtimermod_write_control(m, value);
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_reset(CMSDKAPBDualTimerModule *m)
-     m->intstatus = 0;
-     m->load = 0;
-     m->value = 0xffffffff;
-+    ptimer_transaction_begin(m->timer);
-     ptimer_stop(m->timer);
-     /*
-      * We start in free-running mode, with VALUE at 0xffffffff, and
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_reset(CMSDKAPBDualTimerModule *m)
-      */
-     ptimer_set_limit(m->timer, 0xffff, 1);
-     ptimer_set_freq(m->timer, m->parent->pclk_frq);
-+    ptimer_transaction_commit(m->timer);
- }
- static void cmsdk_apb_dualtimer_reset(DeviceState *dev)
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
-     for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
-         CMSDKAPBDualTimerModule *m = &s->timermod[i];
--        QEMUBH *bh = qemu_bh_new(cmsdk_dualtimermod_tick, m);
-         m->parent = s;
--        m->timer = ptimer_init_with_bh(bh,
-+        m->timer = ptimer_init(cmsdk_dualtimermod_tick, m,
-                                PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
-                                PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
-                                PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
---
-.20.1

-[PULL 12/68] hw/timer/cmsdk-apb-timer.c: Switch to transaction-based ptimer API
+Deleted patch
-Switch the cmsdk-apb-timer code away from bottom-half based ptimers
-to the new transaction-based ptimer API.  This just requires adding
-begin/commit calls around the various places that modify the ptimer
-state, and using the new ptimer_init() function to create the timer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-10-peter.maydell@linaro.org
----
- hw/timer/cmsdk-apb-timer.c | 15 +++++++++++----
-file changed, 11 insertions(+), 4 deletions(-)
-diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/cmsdk-apb-timer.c
-+++ b/hw/timer/cmsdk-apb-timer.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qemu/log.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- #include "qapi/error.h"
- #include "trace.h"
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
-                           "CMSDK APB timer: EXTIN input not supported\n");
-         }
-         s->ctrl = value & 0xf;
-+        ptimer_transaction_begin(s->timer);
-         if (s->ctrl & R_CTRL_EN_MASK) {
-             ptimer_run(s->timer, ptimer_get_limit(s->timer) == 0);
-         } else {
-             ptimer_stop(s->timer);
-         }
-+        ptimer_transaction_commit(s->timer);
-         break;
-     case A_RELOAD:
-         /* Writing to reload also sets the current timer value */
-+        ptimer_transaction_begin(s->timer);
-         if (!value) {
-             ptimer_stop(s->timer);
-         }
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
-              */
-             ptimer_run(s->timer, 0);
-         }
-+        ptimer_transaction_commit(s->timer);
-         break;
-     case A_VALUE:
-+        ptimer_transaction_begin(s->timer);
-         if (!value && !ptimer_get_limit(s->timer)) {
-             ptimer_stop(s->timer);
-         }
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
-         if (value && (s->ctrl & R_CTRL_EN_MASK)) {
-             ptimer_run(s->timer, ptimer_get_limit(s->timer) == 0);
-         }
-+        ptimer_transaction_commit(s->timer);
-         break;
-     case A_INTSTATUS:
-         /* Just one bit, which is W1C. */
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_reset(DeviceState *dev)
-     trace_cmsdk_apb_timer_reset();
-     s->ctrl = 0;
-     s->intstatus = 0;
-+    ptimer_transaction_begin(s->timer);
-     ptimer_stop(s->timer);
-     /* Set the limit and the count */
-     ptimer_set_limit(s->timer, 0, 1);
-+    ptimer_transaction_commit(s->timer);
- }
- static void cmsdk_apb_timer_init(Object *obj)
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
- static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
- {
-     CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
--    QEMUBH *bh;
-     if (s->pclk_frq == 0) {
-         error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
-         return;
-     }
--    bh = qemu_bh_new(cmsdk_apb_timer_tick, s);
--    s->timer = ptimer_init_with_bh(bh,
-+    s->timer = ptimer_init(cmsdk_apb_timer_tick, s,
-                            PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
-                            PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
-                            PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
-                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-+    ptimer_transaction_begin(s->timer);
-     ptimer_set_freq(s->timer, s->pclk_frq);
-+    ptimer_transaction_commit(s->timer);
- }
- static const VMStateDescription cmsdk_apb_timer_vmstate = {
---
-.20.1

-[PULL 13/68] hw/timer/digic-timer.c: Switch to transaction-based ptimer API
+Deleted patch
-Switch the digic-timer.c code away from bottom-half based ptimers to
-the new transaction-based ptimer API.  This just requires adding
-begin/commit calls around the various places that modify the ptimer
-state, and using the new ptimer_init() function to create the timer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-11-peter.maydell@linaro.org
----
- hw/timer/digic-timer.c | 16 ++++++++++++++--
-file changed, 14 insertions(+), 2 deletions(-)
-diff --git a/hw/timer/digic-timer.c b/hw/timer/digic-timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/digic-timer.c
-+++ b/hw/timer/digic-timer.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "hw/sysbus.h"
- #include "hw/ptimer.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- #include "qemu/log.h"
-@@ -XXX,XX +XXX,XX @@ static void digic_timer_reset(DeviceState *dev)
- {
-     DigicTimerState *s = DIGIC_TIMER(dev);
-+    ptimer_transaction_begin(s->ptimer);
-     ptimer_stop(s->ptimer);
-+    ptimer_transaction_commit(s->ptimer);
-     s->control = 0;
-     s->relvalue = 0;
- }
-@@ -XXX,XX +XXX,XX @@ static void digic_timer_write(void *opaque, hwaddr offset,
-             break;
-         }
-+        ptimer_transaction_begin(s->ptimer);
-         if (value & DIGIC_TIMER_CONTROL_EN) {
-             ptimer_run(s->ptimer, 0);
-         }
-         s->control = (uint32_t)value;
-+        ptimer_transaction_commit(s->ptimer);
-         break;
-     case DIGIC_TIMER_RELVALUE:
-         s->relvalue = extract32(value, 0, 16);
-+        ptimer_transaction_begin(s->ptimer);
-         ptimer_set_limit(s->ptimer, s->relvalue, 1);
-+        ptimer_transaction_commit(s->ptimer);
-         break;
-     case DIGIC_TIMER_VALUE:
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps digic_timer_ops = {
-     .endianness = DEVICE_NATIVE_ENDIAN,
- };
-+static void digic_timer_tick(void *opaque)
-+{
-+    /* Nothing to do on timer rollover */
-+}
-+
- static void digic_timer_init(Object *obj)
- {
-     DigicTimerState *s = DIGIC_TIMER(obj);
--    s->ptimer = ptimer_init_with_bh(NULL, PTIMER_POLICY_DEFAULT);
-+    s->ptimer = ptimer_init(digic_timer_tick, NULL, PTIMER_POLICY_DEFAULT);
-     /*
-      * FIXME: there is no documentation on Digic timer
-      * frequency setup so let it always run at 1 MHz
-      */
-+    ptimer_transaction_begin(s->ptimer);
-     ptimer_set_freq(s->ptimer, 1 * 1000 * 1000);
-+    ptimer_transaction_commit(s->ptimer);
-     memory_region_init_io(&s->iomem, OBJECT(s), &digic_timer_ops, s,
-                           TYPE_DIGIC_TIMER, 0x100);
---
-.20.1

-[PULL 14/68] hw/timer/exynos4210_mct.c: Switch GFRC to transaction-based ptimer API
+Deleted patch
-We want to switch the exynos MCT code away from bottom-half based ptimers to
-the new transaction-based ptimer API. The MCT is complicated
-and uses multiple different ptimers, so it's clearer to switch
-it a piece at a time. Here we change over only the GFRC.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-12-peter.maydell@linaro.org
----
- hw/timer/exynos4210_mct.c | 48 ++++++++++++++++++++++++++++++++++++---
-file changed, 45 insertions(+), 3 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
-+++ b/hw/timer/exynos4210_mct.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s);
- /*
-  * Set counter of FRC global timer.
-+ * Must be called within exynos4210_gfrc_tx_begin/commit block.
-  */
- static void exynos4210_gfrc_set_count(Exynos4210MCTGT *s, uint64_t count)
- {
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_gfrc_get_count(Exynos4210MCTGT *s)
- /*
-  * Stop global FRC timer
-+ * Must be called within exynos4210_gfrc_tx_begin/commit block.
-  */
- static void exynos4210_gfrc_stop(Exynos4210MCTGT *s)
- {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gfrc_stop(Exynos4210MCTGT *s)
- /*
-  * Start global FRC timer
-+ * Must be called within exynos4210_gfrc_tx_begin/commit block.
-  */
- static void exynos4210_gfrc_start(Exynos4210MCTGT *s)
- {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gfrc_start(Exynos4210MCTGT *s)
-     ptimer_run(s->ptimer_frc, 1);
- }
-+/*
-+ * Start ptimer transaction for global FRC timer; this is just for
-+ * consistency with the way we wrap operations like stop and run.
-+ */
-+static void exynos4210_gfrc_tx_begin(Exynos4210MCTGT *s)
-+{
-+    ptimer_transaction_begin(s->ptimer_frc);
-+}
-+
-+/* Commit ptimer transaction for global FRC timer. */
-+static void exynos4210_gfrc_tx_commit(Exynos4210MCTGT *s)
-+{
-+    ptimer_transaction_commit(s->ptimer_frc);
-+}
-+
- /*
-  * Find next nearest Comparator. If current Comparator value equals to other
-  * Comparator value, skip them both
-@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_gcomp_get_distance(Exynos4210MCTState *s, int32_t id)
- /*
-  * Restart global FRC timer
-+ * Must be called within exynos4210_gfrc_tx_begin/commit block.
-  */
- static void exynos4210_gfrc_restart(Exynos4210MCTState *s)
- {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_ltick_event(void *opaque)
-     exynos4210_ltick_int_start(&s->tick_timer);
- }
-+static void tx_ptimer_set_freq(ptimer_state *s, uint32_t freq)
-+{
-+    /*
-+     * callers of exynos4210_mct_update_freq() never do anything
-+     * else that needs to be in the same ptimer transaction, so
-+     * to avoid a lot of repetition we have a convenience function
-+     * for begin/set_freq/commit.
-+     */
-+    ptimer_transaction_begin(s);
-+    ptimer_set_freq(s, freq);
-+    ptimer_transaction_commit(s);
-+}
-+
- /* update timer frequency */
- static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
- {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
-         DPRINTF("freq=%dHz\n", s->freq);
-         /* global timer */
--        ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
-+        tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
-         /* local timer */
-         ptimer_set_freq(s->l_timer[0].tick_timer.ptimer_tick, s->freq);
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_reset(DeviceState *d)
-     /* global timer */
-     memset(&s->g_timer.reg, 0, sizeof(s->g_timer.reg));
-+    exynos4210_gfrc_tx_begin(&s->g_timer);
-     exynos4210_gfrc_stop(&s->g_timer);
-+    exynos4210_gfrc_tx_commit(&s->g_timer);
-     /* local timer */
-     memset(s->l_timer[0].reg.cnt, 0, sizeof(s->l_timer[0].reg.cnt));
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         }
-         s->g_timer.reg.cnt = new_frc;
-+        exynos4210_gfrc_tx_begin(&s->g_timer);
-         exynos4210_gfrc_restart(s);
-+        exynos4210_gfrc_tx_commit(&s->g_timer);
-         break;
-     case G_CNT_WSTAT:
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-             s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
-         }
-+        exynos4210_gfrc_tx_begin(&s->g_timer);
-         exynos4210_gfrc_restart(s);
-+        exynos4210_gfrc_tx_commit(&s->g_timer);
-         break;
-     case G_TCON:
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         DPRINTF("global timer write to reg.g_tcon %llx\n", value);
-+        exynos4210_gfrc_tx_begin(&s->g_timer);
-+
-         /* Start FRC if transition from disabled to enabled */
-         if ((value & G_TCON_TIMER_ENABLE) > (old_val &
-                 G_TCON_TIMER_ENABLE)) {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-                 exynos4210_gfrc_restart(s);
-             }
-         }
-+
-+        exynos4210_gfrc_tx_commit(&s->g_timer);
-         break;
-     case G_INT_CSTAT:
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
-     QEMUBH *bh[2];
-     /* Global timer */
--    bh[0] = qemu_bh_new(exynos4210_gfrc_event, s);
--    s->g_timer.ptimer_frc = ptimer_init_with_bh(bh[0], PTIMER_POLICY_DEFAULT);
-+    s->g_timer.ptimer_frc = ptimer_init(exynos4210_gfrc_event, s,
-+                                        PTIMER_POLICY_DEFAULT);
-     memset(&s->g_timer.reg, 0, sizeof(struct gregs));
-     /* Local timers */
---
-.20.1

-[PULL 16/68] hw/timer/exynos4210_mct.c: Switch ltick to transaction-based ptimer API
+Deleted patch
-Switch the ltick ptimer over to the ptimer transaction API.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-14-peter.maydell@linaro.org
----
- hw/timer/exynos4210_mct.c | 31 +++++++++++++++++++++++++------
-file changed, 25 insertions(+), 6 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
-+++ b/hw/timer/exynos4210_mct.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "migration/vmstate.h"
- #include "qemu/timer.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- #include "hw/ptimer.h"
-@@ -XXX,XX +XXX,XX @@ static uint32_t exynos4210_ltick_int_get_cnto(struct tick_timer *s)
- /*
-  * Start local tick cnt timer.
-+ * Must be called within exynos4210_ltick_tx_begin/commit block.
-  */
- static void exynos4210_ltick_cnt_start(struct tick_timer *s)
- {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_ltick_cnt_start(struct tick_timer *s)
- /*
-  * Stop local tick cnt timer.
-+ * Must be called within exynos4210_ltick_tx_begin/commit block.
-  */
- static void exynos4210_ltick_cnt_stop(struct tick_timer *s)
- {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_ltick_cnt_stop(struct tick_timer *s)
-     }
- }
-+/* Start ptimer transaction for local tick timer */
-+static void exynos4210_ltick_tx_begin(struct tick_timer *s)
-+{
-+    ptimer_transaction_begin(s->ptimer_tick);
-+}
-+
-+/* Commit ptimer transaction for local tick timer */
-+static void exynos4210_ltick_tx_commit(struct tick_timer *s)
-+{
-+    ptimer_transaction_commit(s->ptimer_tick);
-+}
-+
- /*
-  * Get counter for CNT timer
-  */
-@@ -XXX,XX +XXX,XX @@ static uint32_t exynos4210_ltick_cnt_get_cnto(struct tick_timer *s)
- /*
-  * Set new values of counters for CNT and INT timers
-+ * Must be called within exynos4210_ltick_tx_begin/commit block.
-  */
- static void exynos4210_ltick_set_cntb(struct tick_timer *s, uint32_t new_cnt,
-         uint32_t new_int)
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_ltick_recalc_count(struct tick_timer *s)
- static void exynos4210_ltick_timer_init(struct tick_timer *s)
- {
-     exynos4210_ltick_int_stop(s);
-+    exynos4210_ltick_tx_begin(s);
-     exynos4210_ltick_cnt_stop(s);
-+    exynos4210_ltick_tx_commit(s);
-     s->count = 0;
-     s->distance = 0;
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
-         tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
-         /* local timer */
--        ptimer_set_freq(s->l_timer[0].tick_timer.ptimer_tick, s->freq);
-+        tx_ptimer_set_freq(s->l_timer[0].tick_timer.ptimer_tick, s->freq);
-         tx_ptimer_set_freq(s->l_timer[0].ptimer_frc, s->freq);
--        ptimer_set_freq(s->l_timer[1].tick_timer.ptimer_tick, s->freq);
-+        tx_ptimer_set_freq(s->l_timer[1].tick_timer.ptimer_tick, s->freq);
-         tx_ptimer_set_freq(s->l_timer[1].ptimer_frc, s->freq);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-         s->l_timer[lt_i].reg.wstat |= L_WSTAT_TCON_WRITE;
-         s->l_timer[lt_i].reg.tcon = value;
-+        exynos4210_ltick_tx_begin(&s->l_timer[lt_i].tick_timer);
-         /* Stop local CNT */
-         if ((value & L_TCON_TICK_START) <
-                 (old_val & L_TCON_TICK_START)) {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-             DPRINTF("local timer[%d] start int\n", lt_i);
-             exynos4210_ltick_int_start(&s->l_timer[lt_i].tick_timer);
-         }
-+        exynos4210_ltick_tx_commit(&s->l_timer[lt_i].tick_timer);
-         /* Start or Stop local FRC if TCON changed */
-         exynos4210_lfrc_tx_begin(&s->l_timer[lt_i]);
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
-          * Due to this we should reload timer to nearest moment when CNT is
-          * expired and then in event handler update tcntb to new TCNTB value.
-          */
-+        exynos4210_ltick_tx_begin(&s->l_timer[lt_i].tick_timer);
-         exynos4210_ltick_set_cntb(&s->l_timer[lt_i].tick_timer, value,
-                 s->l_timer[lt_i].tick_timer.icntb);
-+        exynos4210_ltick_tx_commit(&s->l_timer[lt_i].tick_timer);
-         s->l_timer[lt_i].reg.wstat |= L_WSTAT_TCNTB_WRITE;
-         s->l_timer[lt_i].reg.cnt[L_REG_CNT_TCNTB] = value;
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
-     int i;
-     Exynos4210MCTState *s = EXYNOS4210_MCT(obj);
-     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
--    QEMUBH *bh[2];
-     /* Global timer */
-     s->g_timer.ptimer_frc = ptimer_init(exynos4210_gfrc_event, s,
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
-     /* Local timers */
-     for (i = 0; i < 2; i++) {
--        bh[0] = qemu_bh_new(exynos4210_ltick_event, &s->l_timer[i]);
-         s->l_timer[i].tick_timer.ptimer_tick =
--            ptimer_init_with_bh(bh[0], PTIMER_POLICY_DEFAULT);
-+            ptimer_init(exynos4210_ltick_event, &s->l_timer[i],
-+                        PTIMER_POLICY_DEFAULT);
-         s->l_timer[i].ptimer_frc =
-             ptimer_init(exynos4210_lfrc_event, &s->l_timer[i],
-                         PTIMER_POLICY_DEFAULT);
---
-.20.1

-[PULL 17/68] hw/timer/exynos4210_pwm.c: Switch to transaction-based ptimer API
+Deleted patch
-Switch the exynos4210_pwm code away from bottom-half based ptimers to
-the new transaction-based ptimer API.  This just requires adding
-begin/commit calls around the various places that modify the ptimer
-state, and using the new ptimer_init() function to create the timer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-15-peter.maydell@linaro.org
----
- hw/timer/exynos4210_pwm.c | 17 ++++++++++++-----
-file changed, 12 insertions(+), 5 deletions(-)
-diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_pwm.c
-+++ b/hw/timer/exynos4210_pwm.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "migration/vmstate.h"
- #include "qemu/timer.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- #include "hw/ptimer.h"
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_exynos4210_pwm_state = {
- };
- /*
-- * PWM update frequency
-+ * PWM update frequency.
-+ * Must be called within a ptimer_transaction_begin/commit block
-+ * for s->timer[id].ptimer.
-  */
- static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
- {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_write(void *opaque, hwaddr offset,
-         /* update timers frequencies */
-         for (i = 0; i < EXYNOS4210_PWM_TIMERS_NUM; i++) {
-+            ptimer_transaction_begin(s->timer[i].ptimer);
-             exynos4210_pwm_update_freq(s, s->timer[i].id);
-+            ptimer_transaction_commit(s->timer[i].ptimer);
-         }
-         break;
-     case TCON:
-         for (i = 0; i < EXYNOS4210_PWM_TIMERS_NUM; i++) {
-+            ptimer_transaction_begin(s->timer[i].ptimer);
-             if ((value & TCON_TIMER_MANUAL_UPD(i)) >
-             (s->reg_tcon & TCON_TIMER_MANUAL_UPD(i))) {
-                 /*
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_write(void *opaque, hwaddr offset,
-                 ptimer_stop(s->timer[i].ptimer);
-                 DPRINTF("stop timer %d\n", i);
-             }
-+            ptimer_transaction_commit(s->timer[i].ptimer);
-         }
-         s->reg_tcon = value;
-         break;
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_reset(DeviceState *d)
-         s->timer[i].reg_tcmpb = 0;
-         s->timer[i].reg_tcntb = 0;
-+        ptimer_transaction_begin(s->timer[i].ptimer);
-         exynos4210_pwm_update_freq(s, s->timer[i].id);
-         ptimer_stop(s->timer[i].ptimer);
-+        ptimer_transaction_commit(s->timer[i].ptimer);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_init(Object *obj)
-     Exynos4210PWMState *s = EXYNOS4210_PWM(obj);
-     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
-     int i;
--    QEMUBH *bh;
-     for (i = 0; i < EXYNOS4210_PWM_TIMERS_NUM; i++) {
--        bh = qemu_bh_new(exynos4210_pwm_tick, &s->timer[i]);
-         sysbus_init_irq(dev, &s->timer[i].irq);
--        s->timer[i].ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-+        s->timer[i].ptimer = ptimer_init(exynos4210_pwm_tick,
-+                                         &s->timer[i],
-+                                         PTIMER_POLICY_DEFAULT);
-         s->timer[i].id = i;
-         s->timer[i].parent = s;
-     }
---
-.20.1

-[PULL 18/68] hw/timer/exynos4210_rtc.c: Switch 1Hz ptimer to transaction-based API
+Deleted patch
-Switch the exynos41210_rtc 1Hz ptimer over to the transaction-based
-API. (We will switch the other ptimer used by this device in a
-separate commit.)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-16-peter.maydell@linaro.org
----
- hw/timer/exynos4210_rtc.c | 10 ++++++++--
-file changed, 8 insertions(+), 2 deletions(-)
-diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_rtc.c
-+++ b/hw/timer/exynos4210_rtc.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_write(void *opaque, hwaddr offset,
-         }
-         break;
-     case RTCCON:
-+        ptimer_transaction_begin(s->ptimer_1Hz);
-         if (value & RTC_ENABLE) {
-             exynos4210_rtc_update_freq(s, value);
-         }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_write(void *opaque, hwaddr offset,
-                 ptimer_stop(s->ptimer);
-             }
-         }
-+        ptimer_transaction_commit(s->ptimer_1Hz);
-         s->reg_rtccon = value;
-         break;
-     case TICCNT:
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_reset(DeviceState *d)
-     exynos4210_rtc_update_freq(s, s->reg_rtccon);
-     ptimer_stop(s->ptimer);
-+    ptimer_transaction_begin(s->ptimer_1Hz);
-     ptimer_stop(s->ptimer_1Hz);
-+    ptimer_transaction_commit(s->ptimer_1Hz);
- }
- static const MemoryRegionOps exynos4210_rtc_ops = {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_init(Object *obj)
-     ptimer_set_freq(s->ptimer, RTC_BASE_FREQ);
-     exynos4210_rtc_update_freq(s, 0);
--    bh = qemu_bh_new(exynos4210_rtc_1Hz_tick, s);
--    s->ptimer_1Hz = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-+    s->ptimer_1Hz = ptimer_init(exynos4210_rtc_1Hz_tick,
-+                                s, PTIMER_POLICY_DEFAULT);
-+    ptimer_transaction_begin(s->ptimer_1Hz);
-     ptimer_set_freq(s->ptimer_1Hz, RTC_BASE_FREQ);
-+    ptimer_transaction_commit(s->ptimer_1Hz);
-     sysbus_init_irq(dev, &s->alm_irq);
-     sysbus_init_irq(dev, &s->tick_irq);
---
-.20.1

-[PULL 19/68] hw/timer/exynos4210_rtc.c: Switch main ptimer to transaction-based API
+Deleted patch
-Switch the exynos41210_rtc main ptimer over to the transaction-based
-API, completing the transition for this device.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-17-peter.maydell@linaro.org
----
- hw/timer/exynos4210_rtc.c | 12 ++++++++----
-file changed, 8 insertions(+), 4 deletions(-)
-diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_rtc.c
-+++ b/hw/timer/exynos4210_rtc.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qemu-common.h"
- #include "qemu/log.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- #include "hw/sysbus.h"
- #include "migration/vmstate.h"
-@@ -XXX,XX +XXX,XX @@ static void check_alarm_raise(Exynos4210RTCState *s)
-  * RTC update frequency
-  * Parameters:
-  *     reg_value - current RTCCON register or his new value
-+ * Must be called within a ptimer_transaction_begin/commit block for s->ptimer.
-  */
- static void exynos4210_rtc_update_freq(Exynos4210RTCState *s,
-                                        uint32_t reg_value)
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_write(void *opaque, hwaddr offset,
-         break;
-     case RTCCON:
-         ptimer_transaction_begin(s->ptimer_1Hz);
-+        ptimer_transaction_begin(s->ptimer);
-         if (value & RTC_ENABLE) {
-             exynos4210_rtc_update_freq(s, value);
-         }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_write(void *opaque, hwaddr offset,
-             }
-         }
-         ptimer_transaction_commit(s->ptimer_1Hz);
-+        ptimer_transaction_commit(s->ptimer);
-         s->reg_rtccon = value;
-         break;
-     case TICCNT:
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_reset(DeviceState *d)
-     s->reg_curticcnt = 0;
-+    ptimer_transaction_begin(s->ptimer);
-     exynos4210_rtc_update_freq(s, s->reg_rtccon);
-     ptimer_stop(s->ptimer);
-+    ptimer_transaction_commit(s->ptimer);
-     ptimer_transaction_begin(s->ptimer_1Hz);
-     ptimer_stop(s->ptimer_1Hz);
-     ptimer_transaction_commit(s->ptimer_1Hz);
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_init(Object *obj)
- {
-     Exynos4210RTCState *s = EXYNOS4210_RTC(obj);
-     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
--    QEMUBH *bh;
--    bh = qemu_bh_new(exynos4210_rtc_tick, s);
--    s->ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-+    s->ptimer = ptimer_init(exynos4210_rtc_tick, s, PTIMER_POLICY_DEFAULT);
-+    ptimer_transaction_begin(s->ptimer);
-     ptimer_set_freq(s->ptimer, RTC_BASE_FREQ);
-     exynos4210_rtc_update_freq(s, 0);
-+    ptimer_transaction_commit(s->ptimer);
-     s->ptimer_1Hz = ptimer_init(exynos4210_rtc_1Hz_tick,
-                                 s, PTIMER_POLICY_DEFAULT);
---
-.20.1

-[PULL 21/68] hw/timer/imx_gpt.c: Switch to transaction-based ptimer API
+Deleted patch
-Switch the imx_epit.c code away from bottom-half based ptimers to
-the new transaction-based ptimer API.  This just requires adding
-begin/commit calls around the various places that modify the ptimer
-state, and using the new ptimer_init() function to create the timer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-19-peter.maydell@linaro.org
----
- hw/timer/imx_gpt.c | 21 +++++++++++++++++----
-file changed, 17 insertions(+), 4 deletions(-)
-diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/imx_gpt.c
-+++ b/hw/timer/imx_gpt.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/irq.h"
- #include "hw/timer/imx_gpt.h"
- #include "migration/vmstate.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- #include "qemu/log.h"
-@@ -XXX,XX +XXX,XX @@ static const IMXClk imx7_gpt_clocks[] = {
-     CLK_NONE,      /* 111 not defined */
- };
-+/* Must be called from within ptimer_transaction_begin/commit block */
- static void imx_gpt_set_freq(IMXGPTState *s)
- {
-     uint32_t clksrc = extract32(s->cr, GPT_CR_CLKSRC_SHIFT, 3);
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t imx_gpt_find_limit(uint32_t count, uint32_t reg,
-     return timeout;
- }
-+/* Must be called from within ptimer_transaction_begin/commit block */
- static void imx_gpt_compute_next_timeout(IMXGPTState *s, bool event)
- {
-     uint32_t timeout = GPT_TIMER_MAX;
-@@ -XXX,XX +XXX,XX @@ static uint64_t imx_gpt_read(void *opaque, hwaddr offset, unsigned size)
- static void imx_gpt_reset_common(IMXGPTState *s, bool is_soft_reset)
- {
-+    ptimer_transaction_begin(s->timer);
-     /* stop timer */
-     ptimer_stop(s->timer);
-@@ -XXX,XX +XXX,XX @@ static void imx_gpt_reset_common(IMXGPTState *s, bool is_soft_reset)
-     if (s->freq && (s->cr & GPT_CR_EN)) {
-         ptimer_run(s->timer, 1);
-     }
-+    ptimer_transaction_commit(s->timer);
- }
- static void imx_gpt_soft_reset(DeviceState *dev)
-@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
-             imx_gpt_soft_reset(DEVICE(s));
-         } else {
-             /* set our freq, as the source might have changed */
-+            ptimer_transaction_begin(s->timer);
-             imx_gpt_set_freq(s);
-             if ((oldreg ^ s->cr) & GPT_CR_EN) {
-@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
-                     ptimer_stop(s->timer);
-                 }
-             }
-+            ptimer_transaction_commit(s->timer);
-         }
-         break;
-     case 1: /* Prescaler */
-         s->pr = value & 0xfff;
-+        ptimer_transaction_begin(s->timer);
-         imx_gpt_set_freq(s);
-+        ptimer_transaction_commit(s->timer);
-         break;
-     case 2: /* SR */
-@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
-         s->ir = value & 0x3f;
-         imx_gpt_update_int(s);
-+        ptimer_transaction_begin(s->timer);
-         imx_gpt_compute_next_timeout(s, false);
-+        ptimer_transaction_commit(s->timer);
-         break;
-     case 4: /* OCR1 -- output compare register */
-         s->ocr1 = value;
-+        ptimer_transaction_begin(s->timer);
-         /* In non-freerun mode, reset count when this register is written */
-         if (!(s->cr & GPT_CR_FRR)) {
-             s->next_timeout = GPT_TIMER_MAX;
-@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
-         /* compute the new timeout */
-         imx_gpt_compute_next_timeout(s, false);
-+        ptimer_transaction_commit(s->timer);
-         break;
-@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
-         s->ocr2 = value;
-         /* compute the new timeout */
-+        ptimer_transaction_begin(s->timer);
-         imx_gpt_compute_next_timeout(s, false);
-+        ptimer_transaction_commit(s->timer);
-         break;
-@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
-         s->ocr3 = value;
-         /* compute the new timeout */
-+        ptimer_transaction_begin(s->timer);
-         imx_gpt_compute_next_timeout(s, false);
-+        ptimer_transaction_commit(s->timer);
-         break;
-@@ -XXX,XX +XXX,XX @@ static void imx_gpt_realize(DeviceState *dev, Error **errp)
- {
-     IMXGPTState *s = IMX_GPT(dev);
-     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
--    QEMUBH *bh;
-     sysbus_init_irq(sbd, &s->irq);
-     memory_region_init_io(&s->iomem, OBJECT(s), &imx_gpt_ops, s, TYPE_IMX_GPT,
-x00001000);
-     sysbus_init_mmio(sbd, &s->iomem);
--    bh = qemu_bh_new(imx_gpt_timeout, s);
--    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-+    s->timer = ptimer_init(imx_gpt_timeout, s, PTIMER_POLICY_DEFAULT);
- }
- static void imx_gpt_class_init(ObjectClass *klass, void *data)
---
-.20.1

-[PULL 22/68] hw/timer/mss-timerc: Switch to transaction-based ptimer API
+Deleted patch
-Switch the mss-timer code away from bottom-half based ptimers to
-the new transaction-based ptimer API.  This just requires adding
-begin/commit calls around the various places that modify the ptimer
-state, and using the new ptimer_init() function to create the timer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-20-peter.maydell@linaro.org
----
- include/hw/timer/mss-timer.h |  1 -
- hw/timer/mss-timer.c         | 11 ++++++++---
-files changed, 8 insertions(+), 4 deletions(-)
-diff --git a/include/hw/timer/mss-timer.h b/include/hw/timer/mss-timer.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/timer/mss-timer.h
-+++ b/include/hw/timer/mss-timer.h
-@@ -XXX,XX +XXX,XX @@
- #define R_TIM1_MAX        6
- struct Msf2Timer {
--    QEMUBH *bh;
-     ptimer_state *ptimer;
-     uint32_t regs[R_TIM1_MAX];
-diff --git a/hw/timer/mss-timer.c b/hw/timer/mss-timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/mss-timer.c
-+++ b/hw/timer/mss-timer.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- #include "qemu/log.h"
- #include "hw/irq.h"
-@@ -XXX,XX +XXX,XX @@ static void timer_update_irq(struct Msf2Timer *st)
-     qemu_set_irq(st->irq, (ier && isr));
- }
-+/* Must be called from within a ptimer_transaction_begin/commit block */
- static void timer_update(struct Msf2Timer *st)
- {
-     uint64_t count;
-@@ -XXX,XX +XXX,XX @@ timer_write(void *opaque, hwaddr offset,
-     switch (addr) {
-     case R_TIM_CTRL:
-         st->regs[R_TIM_CTRL] = value;
-+        ptimer_transaction_begin(st->ptimer);
-         timer_update(st);
-+        ptimer_transaction_commit(st->ptimer);
-         break;
-     case R_TIM_RIS:
-@@ -XXX,XX +XXX,XX @@ timer_write(void *opaque, hwaddr offset,
-     case R_TIM_LOADVAL:
-         st->regs[R_TIM_LOADVAL] = value;
-         if (st->regs[R_TIM_CTRL] & TIMER_CTRL_ENBL) {
-+            ptimer_transaction_begin(st->ptimer);
-             timer_update(st);
-+            ptimer_transaction_commit(st->ptimer);
-         }
-         break;
-@@ -XXX,XX +XXX,XX @@ static void mss_timer_init(Object *obj)
-     for (i = 0; i < NUM_TIMERS; i++) {
-         struct Msf2Timer *st = &t->timers[i];
--        st->bh = qemu_bh_new(timer_hit, st);
--        st->ptimer = ptimer_init_with_bh(st->bh, PTIMER_POLICY_DEFAULT);
-+        st->ptimer = ptimer_init(timer_hit, st, PTIMER_POLICY_DEFAULT);
-+        ptimer_transaction_begin(st->ptimer);
-         ptimer_set_freq(st->ptimer, t->freq_hz);
-+        ptimer_transaction_commit(st->ptimer);
-         sysbus_init_irq(SYS_BUS_DEVICE(obj), &st->irq);
-     }
---
-.20.1

-[PULL 23/68] hw/watchdog/cmsdk-apb-watchdog.c: Switch to transaction-based ptimer API
+Deleted patch
-Switch the cmsdk-apb-watchdog code away from bottom-half based
-ptimers to the new transaction-based ptimer API.  This just requires
-adding begin/commit calls around the various places that modify the
-ptimer state, and using the new ptimer_init() function to create the
-timer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-21-peter.maydell@linaro.org
----
- hw/watchdog/cmsdk-apb-watchdog.c | 13 +++++++++----
-file changed, 9 insertions(+), 4 deletions(-)
-diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/watchdog/cmsdk-apb-watchdog.c
-+++ b/hw/watchdog/cmsdk-apb-watchdog.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/log.h"
- #include "trace.h"
- #include "qapi/error.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- #include "sysemu/watchdog.h"
- #include "hw/sysbus.h"
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_write(void *opaque, hwaddr offset,
-          * Reset the load value and the current count, and make sure
-          * we're counting.
-          */
-+        ptimer_transaction_begin(s->timer);
-         ptimer_set_limit(s->timer, value, 1);
-         ptimer_run(s->timer, 0);
-+        ptimer_transaction_commit(s->timer);
-         break;
-     case A_WDOGCONTROL:
-         if (s->is_luminary && 0 != (R_WDOGCONTROL_INTEN_MASK & s->control)) {
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_write(void *opaque, hwaddr offset,
-         break;
-     case A_WDOGINTCLR:
-         s->intstatus = 0;
-+        ptimer_transaction_begin(s->timer);
-         ptimer_set_count(s->timer, ptimer_get_limit(s->timer));
-+        ptimer_transaction_commit(s->timer);
-         cmsdk_apb_watchdog_update(s);
-         break;
-     case A_WDOGLOCK:
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_reset(DeviceState *dev)
-     s->itop = 0;
-     s->resetstatus = 0;
-     /* Set the limit and the count */
-+    ptimer_transaction_begin(s->timer);
-     ptimer_set_limit(s->timer, 0xffffffff, 1);
-     ptimer_run(s->timer, 0);
-+    ptimer_transaction_commit(s->timer);
- }
- static void cmsdk_apb_watchdog_init(Object *obj)
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_init(Object *obj)
- static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
- {
-     CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
--    QEMUBH *bh;
-     if (s->wdogclk_frq == 0) {
-         error_setg(errp,
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
-         return;
-     }
--    bh = qemu_bh_new(cmsdk_apb_watchdog_tick, s);
--    s->timer = ptimer_init_with_bh(bh,
-+    s->timer = ptimer_init(cmsdk_apb_watchdog_tick, s,
-                            PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
-                            PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
-                            PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
-                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-+    ptimer_transaction_begin(s->timer);
-     ptimer_set_freq(s->timer, s->wdogclk_frq);
-+    ptimer_transaction_commit(s->timer);
- }
- static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
---
-.20.1

-[PULL 24/68] hw/net/lan9118.c: Switch to transaction-based ptimer API
+Deleted patch
-Switch the cmsdk-apb-watchdog code away from bottom-half based
-ptimers to the new transaction-based ptimer API.  This just requires
-adding begin/commit calls around the various places that modify the
-ptimer state, and using the new ptimer_init() function to create the
-timer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20191008171740.9679-22-peter.maydell@linaro.org
----
- hw/net/lan9118.c | 11 +++++++----
-file changed, 7 insertions(+), 4 deletions(-)
-diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/lan9118.c
-+++ b/hw/net/lan9118.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/ptimer.h"
- #include "hw/qdev-properties.h"
- #include "qemu/log.h"
--#include "qemu/main-loop.h"
- #include "qemu/module.h"
- /* For crc32 */
- #include <zlib.h>
-@@ -XXX,XX +XXX,XX @@ static void lan9118_reset(DeviceState *d)
-     s->e2p_data = 0;
-     s->free_timer_start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / 40;
-+    ptimer_transaction_begin(s->timer);
-     ptimer_stop(s->timer);
-     ptimer_set_count(s->timer, 0xffff);
-+    ptimer_transaction_commit(s->timer);
-     s->gpt_cfg = 0xffff;
-     s->mac_cr = MAC_CR_PRMS;
-@@ -XXX,XX +XXX,XX @@ static void lan9118_writel(void *opaque, hwaddr offset,
-         break;
-     case CSR_GPT_CFG:
-         if ((s->gpt_cfg ^ val) & GPT_TIMER_EN) {
-+            ptimer_transaction_begin(s->timer);
-             if (val & GPT_TIMER_EN) {
-                 ptimer_set_count(s->timer, val & 0xffff);
-                 ptimer_run(s->timer, 0);
-@@ -XXX,XX +XXX,XX @@ static void lan9118_writel(void *opaque, hwaddr offset,
-                 ptimer_stop(s->timer);
-                 ptimer_set_count(s->timer, 0xffff);
-             }
-+            ptimer_transaction_commit(s->timer);
-         }
-         s->gpt_cfg = val & (GPT_TIMER_EN | 0xffff);
-         break;
-@@ -XXX,XX +XXX,XX @@ static void lan9118_realize(DeviceState *dev, Error **errp)
- {
-     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-     lan9118_state *s = LAN9118(dev);
--    QEMUBH *bh;
-     int i;
-     const MemoryRegionOps *mem_ops =
-             s->mode_16bit ? &lan9118_16bit_mem_ops : &lan9118_mem_ops;
-@@ -XXX,XX +XXX,XX @@ static void lan9118_realize(DeviceState *dev, Error **errp)
-     s->pmt_ctrl = 1;
-     s->txp = &s->tx_packet;
--    bh = qemu_bh_new(lan9118_tick, s);
--    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
-+    s->timer = ptimer_init(lan9118_tick, s, PTIMER_POLICY_DEFAULT);
-+    ptimer_transaction_begin(s->timer);
-     ptimer_set_freq(s->timer, 10000);
-     ptimer_set_limit(s->timer, 0xffff, 1);
-+    ptimer_transaction_commit(s->timer);
- }
- static Property lan9118_properties[] = {
---
-.20.1

-[PULL 25/68] target/arm/arm-semi: Capture errno in softmmu version of set_swi_errno()
+Deleted patch
-The set_swi_errno() function is called to capture the errno
-from a host system call, so that we can return -1 from the
-semihosting function and later allow the guest to get a more
-specific error code with the SYS_ERRNO function. It comes in
-two versions, one for user-only and one for softmmu. We forgot
-to capture the errno in the softmmu version; fix the error.
-(Semihosting calls directed to gdb are unaffected because
-they go through a different code path that captures the
-error return from the gdbstub call in arm_semi_cb() or
-arm_semi_flen_cb().)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190916141544.17540-2-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 9 +++++----
-file changed, 5 insertions(+), 4 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
-     return code;
- }
- #else
-+static target_ulong syscall_err;
-+
- static inline uint32_t set_swi_errno(CPUARMState *env, uint32_t code)
- {
-+    if (code == (uint32_t)-1) {
-+        syscall_err = errno;
-+    }
-     return code;
- }
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t set_swi_errno(CPUARMState *env, uint32_t code)
- static target_ulong arm_semi_syscall_len;
--#if !defined(CONFIG_USER_ONLY)
--static target_ulong syscall_err;
--#endif
--
- static void arm_semi_cb(CPUState *cs, target_ulong ret, target_ulong err)
- {
-     ARMCPU *cpu = ARM_CPU(cs);
---
-.20.1

-[PULL 26/68] target/arm/arm-semi: Always set some kind of errno for failed calls
+Deleted patch
-If we fail a semihosting call we should always set the
-semihosting errno to something; we were failing to do
-this for some of the "check inputs for sanity" cases.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190916141544.17540-3-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 45 ++++++++++++++++++++++++++-----------------
-file changed, 27 insertions(+), 18 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
- #define GET_ARG(n) do {                                 \
-     if (is_a64(env)) {                                  \
-         if (get_user_u64(arg ## n, args + (n) * 8)) {   \
--            return -1;                                  \
-+            errno = EFAULT;                             \
-+            return set_swi_errno(ts, -1);               \
-         }                                               \
-     } else {                                            \
-         if (get_user_u32(arg ## n, args + (n) * 4)) {   \
--            return -1;                                  \
-+            errno = EFAULT;                             \
-+            return set_swi_errno(ts, -1);               \
-         }                                               \
-     }                                                   \
- } while (0)
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         GET_ARG(2);
-         s = lock_user_string(arg0);
-         if (!s) {
--            /* FIXME - should this error code be -TARGET_EFAULT ? */
--            return (uint32_t)-1;
-+            errno = EFAULT;
-+            return set_swi_errno(ts, -1);
-         }
-         if (arg1 >= 12) {
-             unlock_user(s, arg0, 0);
--            return (uint32_t)-1;
-+            errno = EINVAL;
-+            return set_swi_errno(ts, -1);
-         }
-         if (strcmp(s, ":tt") == 0) {
-             int result_fileno = arg1 < 4 ? STDIN_FILENO : STDOUT_FILENO;
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         } else {
-             s = lock_user_string(arg0);
-             if (!s) {
--                /* FIXME - should this error code be -TARGET_EFAULT ? */
--                return (uint32_t)-1;
-+                errno = EFAULT;
-+                return set_swi_errno(ts, -1);
-             }
-             ret =  set_swi_errno(ts, remove(s));
-             unlock_user(s, arg0, 0);
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             char *s2;
-             s = lock_user_string(arg0);
-             s2 = lock_user_string(arg2);
--            if (!s || !s2)
--                /* FIXME - should this error code be -TARGET_EFAULT ? */
--                ret = (uint32_t)-1;
--            else
-+            if (!s || !s2) {
-+                errno = EFAULT;
-+                ret = set_swi_errno(ts, -1);
-+            } else {
-                 ret = set_swi_errno(ts, rename(s, s2));
-+            }
-             if (s2)
-                 unlock_user(s2, arg2, 0);
-             if (s)
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         } else {
-             s = lock_user_string(arg0);
-             if (!s) {
--                /* FIXME - should this error code be -TARGET_EFAULT ? */
--                return (uint32_t)-1;
-+                errno = EFAULT;
-+                return set_swi_errno(ts, -1);
-             }
-             ret = set_swi_errno(ts, system(s));
-             unlock_user(s, arg0, 0);
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             if (output_size > input_size) {
-                 /* Not enough space to store command-line arguments.  */
--                return -1;
-+                errno = E2BIG;
-+                return set_swi_errno(ts, -1);
-             }
-             /* Adjust the command-line length.  */
-             if (SET_ARG(1, output_size - 1)) {
-                 /* Couldn't write back to argument block */
--                return -1;
-+                errno = EFAULT;
-+                return set_swi_errno(ts, -1);
-             }
-             /* Lock the buffer on the ARM side.  */
-             output_buffer = lock_user(VERIFY_WRITE, arg0, output_size, 0);
-             if (!output_buffer) {
--                return -1;
-+                errno = EFAULT;
-+                return set_swi_errno(ts, -1);
-             }
-             /* Copy the command-line arguments.  */
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             if (copy_from_user(output_buffer, ts->info->arg_start,
-                                output_size)) {
--                status = -1;
-+                errno = EFAULT;
-+                status = set_swi_errno(ts, -1);
-                 goto out;
-             }
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-                 if (fail) {
-                     /* Couldn't write back to argument block */
--                    return -1;
-+                    errno = EFAULT;
-+                    return set_swi_errno(ts, -1);
-                 }
-             }
-             return 0;
---
-.20.1

-[PULL 27/68] target/arm/arm-semi: Correct comment about gdb syscall races
+Deleted patch
-In arm_gdb_syscall() we have a comment suggesting a race
-because the syscall completion callback might not happen
-before the gdb_do_syscallv() call returns. The comment is
-correct that the callback may not happen but incorrect about
-the effects. Correct it and note the important caveat that
-callers must never do any work of any kind after return from
-arm_gdb_syscall() that depends on its return value.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190916141544.17540-4-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 19 +++++++++++++++----
-file changed, 15 insertions(+), 4 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
-     gdb_do_syscallv(cb, fmt, va);
-     va_end(va);
--    /* FIXME: we are implicitly relying on the syscall completing
--     * before this point, which is not guaranteed. We should
--     * put in an explicit synchronization between this and
--     * the callback function.
-+    /*
-+     * FIXME: in softmmu mode, the gdbstub will schedule our callback
-+     * to occur, but will not actually call it to complete the syscall
-+     * until after this function has returned and we are back in the
-+     * CPU main loop. Therefore callers to this function must not
-+     * do anything with its return value, because it is not necessarily
-+     * the result of the syscall, but could just be the old value of X0.
-+     * The only thing safe to do with this is that the callers of
-+     * do_arm_semihosting() will write it straight back into X0.
-+     * (In linux-user mode, the callback will have happened before
-+     * gdb_do_syscallv() returns.)
-+     *
-+     * We should tidy this up so neither this function nor
-+     * do_arm_semihosting() return a value, so the mistake of
-+     * doing something with the return value is not possible to make.
-      */
-     return is_a64(env) ? env->xregs[0] : env->regs[0];
---
-.20.1

-[PULL 29/68] target/arm/arm-semi: Restrict use of TaskState*
+Deleted patch
-The semihosting code needs accuss to the linux-user only
-TaskState pointer so it can set the semihosting errno per-thread
-for linux-user mode. At the moment we do this by having some
-ifdefs so that we define a 'ts' local in do_arm_semihosting()
-which is either a real TaskState * or just a CPUARMState *,
-depending on which mode we're compiling for.
-This is awkward if we want to refactor do_arm_semihosting()
-into other functions which might need to be passed the TaskState.
-Restrict usage of the TaskState local by:
- * making set_swi_errno() always take the CPUARMState pointer
-   and (for the linux-user version) get TaskState from that
- * creating a new get_swi_errno() which reads the errno
- * having the two semihosting calls which need the TaskState
-   for other purposes (SYS_GET_CMDLINE and SYS_HEAPINFO)
-   define a variable with scope restricted to just that code
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190916141544.17540-6-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 111 ++++++++++++++++++++++++------------------
-file changed, 63 insertions(+), 48 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static GuestFD *get_guestfd(int guestfd)
-     return gf;
- }
--#ifdef CONFIG_USER_ONLY
--static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
--{
--    if (code == (uint32_t)-1)
--        ts->swi_errno = errno;
--    return code;
--}
--#else
-+/*
-+ * The semihosting API has no concept of its errno being thread-safe,
-+ * as the API design predates SMP CPUs and was intended as a simple
-+ * real-hardware set of debug functionality. For QEMU, we make the
-+ * errno be per-thread in linux-user mode; in softmmu it is a simple
-+ * global, and we assume that the guest takes care of avoiding any races.
-+ */
-+#ifndef CONFIG_USER_ONLY
- static target_ulong syscall_err;
-+#include "exec/softmmu-semi.h"
-+#endif
-+
- static inline uint32_t set_swi_errno(CPUARMState *env, uint32_t code)
- {
-     if (code == (uint32_t)-1) {
-+#ifdef CONFIG_USER_ONLY
-+        CPUState *cs = env_cpu(env);
-+        TaskState *ts = cs->opaque;
-+
-+        ts->swi_errno = errno;
-+#else
-         syscall_err = errno;
-+#endif
-     }
-     return code;
- }
--#include "exec/softmmu-semi.h"
-+static inline uint32_t get_swi_errno(CPUARMState *env)
-+{
-+#ifdef CONFIG_USER_ONLY
-+    CPUState *cs = env_cpu(env);
-+    TaskState *ts = cs->opaque;
-+
-+    return ts->swi_errno;
-+#else
-+    return syscall_err;
- #endif
-+}
- static target_ulong arm_semi_syscall_len;
-@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
-     if (is_a64(env)) {                                  \
-         if (get_user_u64(arg ## n, args + (n) * 8)) {   \
-             errno = EFAULT;                             \
--            return set_swi_errno(ts, -1);               \
-+            return set_swi_errno(env, -1);              \
-         }                                               \
-     } else {                                            \
-         if (get_user_u32(arg ## n, args + (n) * 4)) {   \
-             errno = EFAULT;                             \
--            return set_swi_errno(ts, -1);               \
-+            return set_swi_errno(env, -1);              \
-         }                                               \
-     }                                                   \
- } while (0)
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-     int nr;
-     uint32_t ret;
-     uint32_t len;
--#ifdef CONFIG_USER_ONLY
--    TaskState *ts = cs->opaque;
--#else
--    CPUARMState *ts = env;
--#endif
-     GuestFD *gf;
-     if (is_a64(env)) {
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         s = lock_user_string(arg0);
-         if (!s) {
-             errno = EFAULT;
--            return set_swi_errno(ts, -1);
-+            return set_swi_errno(env, -1);
-         }
-         if (arg1 >= 12) {
-             unlock_user(s, arg0, 0);
-             errno = EINVAL;
--            return set_swi_errno(ts, -1);
-+            return set_swi_errno(env, -1);
-         }
-         guestfd = alloc_guestfd();
-         if (guestfd < 0) {
-             unlock_user(s, arg0, 0);
-             errno = EMFILE;
--            return set_swi_errno(ts, -1);
-+            return set_swi_errno(env, -1);
-         }
-         if (strcmp(s, ":tt") == 0) {
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                   (int)arg2+1, gdb_open_modeflags[arg1]);
-         } else {
--            ret = set_swi_errno(ts, open(s, open_modeflags[arg1], 0644));
-+            ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
-             if (ret == (uint32_t)-1) {
-                 dealloc_guestfd(guestfd);
-             } else {
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         gf = get_guestfd(arg0);
-         if (!gf) {
-             errno = EBADF;
--            return set_swi_errno(ts, -1);
-+            return set_swi_errno(env, -1);
-         }
-         if (use_gdb_syscalls()) {
-             ret = arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
-         } else {
--            ret = set_swi_errno(ts, close(gf->hostfd));
-+            ret = set_swi_errno(env, close(gf->hostfd));
-         }
-         dealloc_guestfd(arg0);
-         return ret;
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         gf = get_guestfd(arg0);
-         if (!gf) {
-             errno = EBADF;
--            return set_swi_errno(ts, -1);
-+            return set_swi_errno(env, -1);
-         }
-         if (use_gdb_syscalls()) {
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-                 /* Return bytes not written on error */
-                 return len;
-             }
--            ret = set_swi_errno(ts, write(gf->hostfd, s, len));
-+            ret = set_swi_errno(env, write(gf->hostfd, s, len));
-             unlock_user(s, arg1, 0);
-             if (ret == (uint32_t)-1) {
-                 ret = 0;
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         gf = get_guestfd(arg0);
-         if (!gf) {
-             errno = EBADF;
--            return set_swi_errno(ts, -1);
-+            return set_swi_errno(env, -1);
-         }
-         if (use_gdb_syscalls()) {
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-                 return len;
-             }
-             do {
--                ret = set_swi_errno(ts, read(gf->hostfd, s, len));
-+                ret = set_swi_errno(env, read(gf->hostfd, s, len));
-             } while (ret == -1 && errno == EINTR);
-             unlock_user(s, arg1, len);
-             if (ret == (uint32_t)-1) {
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         gf = get_guestfd(arg0);
-         if (!gf) {
-             errno = EBADF;
--            return set_swi_errno(ts, -1);
-+            return set_swi_errno(env, -1);
-         }
-         if (use_gdb_syscalls()) {
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         gf = get_guestfd(arg0);
-         if (!gf) {
-             errno = EBADF;
--            return set_swi_errno(ts, -1);
-+            return set_swi_errno(env, -1);
-         }
-         if (use_gdb_syscalls()) {
-             return arm_gdb_syscall(cpu, arm_semi_cb, "lseek,%x,%x,0",
-                                    gf->hostfd, arg1);
-         } else {
--            ret = set_swi_errno(ts, lseek(gf->hostfd, arg1, SEEK_SET));
-+            ret = set_swi_errno(env, lseek(gf->hostfd, arg1, SEEK_SET));
-             if (ret == (uint32_t)-1)
-               return -1;
-             return 0;
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         gf = get_guestfd(arg0);
-         if (!gf) {
-             errno = EBADF;
--            return set_swi_errno(ts, -1);
-+            return set_swi_errno(env, -1);
-         }
-         if (use_gdb_syscalls()) {
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-                                    gf->hostfd, arm_flen_buf(cpu));
-         } else {
-             struct stat buf;
--            ret = set_swi_errno(ts, fstat(gf->hostfd, &buf));
-+            ret = set_swi_errno(env, fstat(gf->hostfd, &buf));
-             if (ret == (uint32_t)-1)
-                 return -1;
-             return buf.st_size;
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             s = lock_user_string(arg0);
-             if (!s) {
-                 errno = EFAULT;
--                return set_swi_errno(ts, -1);
-+                return set_swi_errno(env, -1);
-             }
--            ret =  set_swi_errno(ts, remove(s));
-+            ret =  set_swi_errno(env, remove(s));
-             unlock_user(s, arg0, 0);
-         }
-         return ret;
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             s2 = lock_user_string(arg2);
-             if (!s || !s2) {
-                 errno = EFAULT;
--                ret = set_swi_errno(ts, -1);
-+                ret = set_swi_errno(env, -1);
-             } else {
--                ret = set_swi_errno(ts, rename(s, s2));
-+                ret = set_swi_errno(env, rename(s, s2));
-             }
-             if (s2)
-                 unlock_user(s2, arg2, 0);
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-     case TARGET_SYS_CLOCK:
-         return clock() / (CLOCKS_PER_SEC / 100);
-     case TARGET_SYS_TIME:
--        return set_swi_errno(ts, time(NULL));
-+        return set_swi_errno(env, time(NULL));
-     case TARGET_SYS_SYSTEM:
-         GET_ARG(0);
-         GET_ARG(1);
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             s = lock_user_string(arg0);
-             if (!s) {
-                 errno = EFAULT;
--                return set_swi_errno(ts, -1);
-+                return set_swi_errno(env, -1);
-             }
--            ret = set_swi_errno(ts, system(s));
-+            ret = set_swi_errno(env, system(s));
-             unlock_user(s, arg0, 0);
-             return ret;
-         }
-     case TARGET_SYS_ERRNO:
--#ifdef CONFIG_USER_ONLY
--        return ts->swi_errno;
--#else
--        return syscall_err;
--#endif
-+        return get_swi_errno(env);
-     case TARGET_SYS_GET_CMDLINE:
-         {
-             /* Build a command-line from the original argv.
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             int status = 0;
- #if !defined(CONFIG_USER_ONLY)
-             const char *cmdline;
-+#else
-+            TaskState *ts = cs->opaque;
- #endif
-             GET_ARG(0);
-             GET_ARG(1);
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             if (output_size > input_size) {
-                 /* Not enough space to store command-line arguments.  */
-                 errno = E2BIG;
--                return set_swi_errno(ts, -1);
-+                return set_swi_errno(env, -1);
-             }
-             /* Adjust the command-line length.  */
-             if (SET_ARG(1, output_size - 1)) {
-                 /* Couldn't write back to argument block */
-                 errno = EFAULT;
--                return set_swi_errno(ts, -1);
-+                return set_swi_errno(env, -1);
-             }
-             /* Lock the buffer on the ARM side.  */
-             output_buffer = lock_user(VERIFY_WRITE, arg0, output_size, 0);
-             if (!output_buffer) {
-                 errno = EFAULT;
--                return set_swi_errno(ts, -1);
-+                return set_swi_errno(env, -1);
-             }
-             /* Copy the command-line arguments.  */
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             if (copy_from_user(output_buffer, ts->info->arg_start,
-                                output_size)) {
-                 errno = EFAULT;
--                status = set_swi_errno(ts, -1);
-+                status = set_swi_errno(env, -1);
-                 goto out;
-             }
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             target_ulong retvals[4];
-             target_ulong limit;
-             int i;
-+#ifdef CONFIG_USER_ONLY
-+            TaskState *ts = cs->opaque;
-+#endif
-             GET_ARG(0);
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-                 if (fail) {
-                     /* Couldn't write back to argument block */
-                     errno = EFAULT;
--                    return set_swi_errno(ts, -1);
-+                    return set_swi_errno(env, -1);
-                 }
-             }
-             return 0;
---
-.20.1

-[PULL 30/68] target/arm/arm-semi: Use set_swi_errno() in gdbstub callback functions
+Deleted patch
-When we are routing semihosting operations through the gdbstub, the
-work of sorting out the return value and setting errno if necessary
-is done by callback functions which are invoked by the gdbstub code.
-Clean up some ifdeffery in those functions by having them call
-set_swi_errno() to set the semihosting errno.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190916141544.17540-7-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 27 ++++++---------------------
-file changed, 6 insertions(+), 21 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static void arm_semi_cb(CPUState *cs, target_ulong ret, target_ulong err)
- {
-     ARMCPU *cpu = ARM_CPU(cs);
-     CPUARMState *env = &cpu->env;
--#ifdef CONFIG_USER_ONLY
--    TaskState *ts = cs->opaque;
--#endif
-     target_ulong reg0 = is_a64(env) ? env->xregs[0] : env->regs[0];
-     if (ret == (target_ulong)-1) {
--#ifdef CONFIG_USER_ONLY
--        ts->swi_errno = err;
--#else
--        syscall_err = err;
--#endif
-+        errno = err;
-+        set_swi_errno(env, -1);
-         reg0 = ret;
-     } else {
-         /* Fixup syscalls that use nonstardard return conventions.  */
-@@ -XXX,XX +XXX,XX @@ static void arm_semi_flen_cb(CPUState *cs, target_ulong ret, target_ulong err)
-     } else {
-         env->regs[0] = size;
-     }
--#ifdef CONFIG_USER_ONLY
--    ((TaskState *)cs->opaque)->swi_errno = err;
--#else
--    syscall_err = err;
--#endif
-+    errno = err;
-+    set_swi_errno(env, -1);
- }
- static int arm_semi_open_guestfd;
-@@ -XXX,XX +XXX,XX @@ static void arm_semi_open_cb(CPUState *cs, target_ulong ret, target_ulong err)
- {
-     ARMCPU *cpu = ARM_CPU(cs);
-     CPUARMState *env = &cpu->env;
--#ifdef CONFIG_USER_ONLY
--    TaskState *ts = cs->opaque;
--#endif
-     if (ret == (target_ulong)-1) {
--#ifdef CONFIG_USER_ONLY
--        ts->swi_errno = err;
--#else
--        syscall_err = err;
--#endif
-+        errno = err;
-+        set_swi_errno(env, -1);
-         dealloc_guestfd(arm_semi_open_guestfd);
-     } else {
-         associate_guestfd(arm_semi_open_guestfd, ret);
---
-.20.1

-[PULL 31/68] target/arm/arm-semi: Factor out implementation of SYS_CLOSE
+Deleted patch
-Currently for the semihosting calls which take a file descriptor
-(SYS_CLOSE, SYS_WRITE, SYS_READ, SYS_ISTTY, SYS_SEEK, SYS_FLEN)
-we have effectively two implementations, one for real host files
-and one for when we indirect via the gdbstub. We want to add a
-third one to deal with the magic :semihosting-features file.
-Instead of having a three-way if statement in each of these
-cases, factor out the implementation of the calls to separate
-functions which we dispatch to via function pointers selected
-via the GuestFDType for the guest fd.
-In this commit, we set up the framework for the dispatch,
-and convert the SYS_CLOSE call to use it.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190916141544.17540-8-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 44 ++++++++++++++++++++++++++++++++++++-------
-file changed, 37 insertions(+), 7 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static int open_modeflags[12] = {
- typedef enum GuestFDType {
-     GuestFDUnused = 0,
-     GuestFDHost = 1,
-+    GuestFDGDB = 2,
- } GuestFDType;
- /*
-@@ -XXX,XX +XXX,XX @@ static GuestFD *do_get_guestfd(int guestfd)
- /*
-  * Associate the specified guest fd (which must have been
-  * allocated via alloc_fd() and not previously used) with
-- * the specified host fd.
-+ * the specified host/gdb fd.
-  */
- static void associate_guestfd(int guestfd, int hostfd)
- {
-     GuestFD *gf = do_get_guestfd(guestfd);
-     assert(gf);
--    gf->type = GuestFDHost;
-+    gf->type = use_gdb_syscalls() ? GuestFDGDB : GuestFDHost;
-     gf->hostfd = hostfd;
- }
-@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
-     return is_a64(env) ? env->xregs[0] : env->regs[0];
- }
-+/*
-+ * Types for functions implementing various semihosting calls
-+ * for specific types of guest file descriptor. These must all
-+ * do the work and return the required return value for the guest,
-+ * setting the guest errno if appropriate.
-+ */
-+typedef uint32_t sys_closefn(ARMCPU *cpu, GuestFD *gf);
-+
-+static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
-+{
-+    CPUARMState *env = &cpu->env;
-+
-+    return set_swi_errno(env, close(gf->hostfd));
-+}
-+
-+static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
-+{
-+    return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
-+}
-+
-+typedef struct GuestFDFunctions {
-+    sys_closefn *closefn;
-+} GuestFDFunctions;
-+
-+static const GuestFDFunctions guestfd_fns[] = {
-+    [GuestFDHost] = {
-+        .closefn = host_closefn,
-+    },
-+    [GuestFDGDB] = {
-+        .closefn = gdb_closefn,
-+    },
-+};
-+
- /* Read the input value from the argument block; fail the semihosting
-  * call if the memory read fails.
-  */
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             return set_swi_errno(env, -1);
-         }
--        if (use_gdb_syscalls()) {
--            ret = arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
--        } else {
--            ret = set_swi_errno(env, close(gf->hostfd));
--        }
-+        ret = guestfd_fns[gf->type].closefn(cpu, gf);
-         dealloc_guestfd(arg0);
-         return ret;
-     case TARGET_SYS_WRITEC:
---
-.20.1

-[PULL 32/68] target/arm/arm-semi: Factor out implementation of SYS_WRITE
+Deleted patch
-Factor out the implementation of SYS_WRITE via the
-new function tables.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190916141544.17540-9-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 51 ++++++++++++++++++++++++++++---------------
-file changed, 33 insertions(+), 18 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
-  * setting the guest errno if appropriate.
-  */
- typedef uint32_t sys_closefn(ARMCPU *cpu, GuestFD *gf);
-+typedef uint32_t sys_writefn(ARMCPU *cpu, GuestFD *gf,
-+                             target_ulong buf, uint32_t len);
- static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
- {
-@@ -XXX,XX +XXX,XX @@ static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
-     return set_swi_errno(env, close(gf->hostfd));
- }
-+static uint32_t host_writefn(ARMCPU *cpu, GuestFD *gf,
-+                             target_ulong buf, uint32_t len)
-+{
-+    uint32_t ret;
-+    CPUARMState *env = &cpu->env;
-+    char *s = lock_user(VERIFY_READ, buf, len, 1);
-+    if (!s) {
-+        /* Return bytes not written on error */
-+        return len;
-+    }
-+    ret = set_swi_errno(env, write(gf->hostfd, s, len));
-+    unlock_user(s, buf, 0);
-+    if (ret == (uint32_t)-1) {
-+        ret = 0;
-+    }
-+    /* Return bytes not written */
-+    return len - ret;
-+}
-+
- static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
- {
-     return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
- }
-+static uint32_t gdb_writefn(ARMCPU *cpu, GuestFD *gf,
-+                            target_ulong buf, uint32_t len)
-+{
-+    arm_semi_syscall_len = len;
-+    return arm_gdb_syscall(cpu, arm_semi_cb, "write,%x,%x,%x",
-+                           gf->hostfd, buf, len);
-+}
-+
- typedef struct GuestFDFunctions {
-     sys_closefn *closefn;
-+    sys_writefn *writefn;
- } GuestFDFunctions;
- static const GuestFDFunctions guestfd_fns[] = {
-     [GuestFDHost] = {
-         .closefn = host_closefn,
-+        .writefn = host_writefn,
-     },
-     [GuestFDGDB] = {
-         .closefn = gdb_closefn,
-+        .writefn = gdb_writefn,
-     },
- };
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             return set_swi_errno(env, -1);
-         }
--        if (use_gdb_syscalls()) {
--            arm_semi_syscall_len = len;
--            return arm_gdb_syscall(cpu, arm_semi_cb, "write,%x,%x,%x",
--                                   gf->hostfd, arg1, len);
--        } else {
--            s = lock_user(VERIFY_READ, arg1, len, 1);
--            if (!s) {
--                /* Return bytes not written on error */
--                return len;
--            }
--            ret = set_swi_errno(env, write(gf->hostfd, s, len));
--            unlock_user(s, arg1, 0);
--            if (ret == (uint32_t)-1) {
--                ret = 0;
--            }
--            /* Return bytes not written */
--            return len - ret;
--        }
-+        return guestfd_fns[gf->type].writefn(cpu, gf, arg1, len);
-     case TARGET_SYS_READ:
-         GET_ARG(0);
-         GET_ARG(1);
---
-.20.1

-[PULL 33/68] target/arm/arm-semi: Factor out implementation of SYS_READ
+Deleted patch
-Factor out the implementation of SYS_READ via the
-new function tables.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190916141544.17540-10-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 55 +++++++++++++++++++++++++++----------------
-file changed, 35 insertions(+), 20 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
- typedef uint32_t sys_closefn(ARMCPU *cpu, GuestFD *gf);
- typedef uint32_t sys_writefn(ARMCPU *cpu, GuestFD *gf,
-                              target_ulong buf, uint32_t len);
-+typedef uint32_t sys_readfn(ARMCPU *cpu, GuestFD *gf,
-+                            target_ulong buf, uint32_t len);
- static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
- {
-@@ -XXX,XX +XXX,XX @@ static uint32_t host_writefn(ARMCPU *cpu, GuestFD *gf,
-     return len - ret;
- }
-+static uint32_t host_readfn(ARMCPU *cpu, GuestFD *gf,
-+                            target_ulong buf, uint32_t len)
-+{
-+    uint32_t ret;
-+    CPUARMState *env = &cpu->env;
-+    char *s = lock_user(VERIFY_WRITE, buf, len, 0);
-+    if (!s) {
-+        /* return bytes not read */
-+        return len;
-+    }
-+    do {
-+        ret = set_swi_errno(env, read(gf->hostfd, s, len));
-+    } while (ret == -1 && errno == EINTR);
-+    unlock_user(s, buf, len);
-+    if (ret == (uint32_t)-1) {
-+        ret = 0;
-+    }
-+    /* Return bytes not read */
-+    return len - ret;
-+}
-+
- static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
- {
-     return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
-@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_writefn(ARMCPU *cpu, GuestFD *gf,
-                            gf->hostfd, buf, len);
- }
-+static uint32_t gdb_readfn(ARMCPU *cpu, GuestFD *gf,
-+                           target_ulong buf, uint32_t len)
-+{
-+    arm_semi_syscall_len = len;
-+    return arm_gdb_syscall(cpu, arm_semi_cb, "read,%x,%x,%x",
-+                           gf->hostfd, buf, len);
-+}
-+
- typedef struct GuestFDFunctions {
-     sys_closefn *closefn;
-     sys_writefn *writefn;
-+    sys_readfn *readfn;
- } GuestFDFunctions;
- static const GuestFDFunctions guestfd_fns[] = {
-     [GuestFDHost] = {
-         .closefn = host_closefn,
-         .writefn = host_writefn,
-+        .readfn = host_readfn,
-     },
-     [GuestFDGDB] = {
-         .closefn = gdb_closefn,
-         .writefn = gdb_writefn,
-+        .readfn = gdb_readfn,
-     },
- };
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             return set_swi_errno(env, -1);
-         }
--        if (use_gdb_syscalls()) {
--            arm_semi_syscall_len = len;
--            return arm_gdb_syscall(cpu, arm_semi_cb, "read,%x,%x,%x",
--                                   gf->hostfd, arg1, len);
--        } else {
--            s = lock_user(VERIFY_WRITE, arg1, len, 0);
--            if (!s) {
--                /* return bytes not read */
--                return len;
--            }
--            do {
--                ret = set_swi_errno(env, read(gf->hostfd, s, len));
--            } while (ret == -1 && errno == EINTR);
--            unlock_user(s, arg1, len);
--            if (ret == (uint32_t)-1) {
--                ret = 0;
--            }
--            /* Return bytes not read */
--            return len - ret;
--        }
-+        return guestfd_fns[gf->type].readfn(cpu, gf, arg1, len);
-     case TARGET_SYS_READC:
-         qemu_log_mask(LOG_UNIMP, "%s: SYS_READC not implemented", __func__);
-         return 0;
---
-.20.1

-[PULL 34/68] target/arm/arm-semi: Factor out implementation of SYS_ISTTY
+Deleted patch
-Factor out the implementation of SYS_ISTTY via the new function
-tables.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190916141544.17540-11-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 20 +++++++++++++++-----
-file changed, 15 insertions(+), 5 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ typedef uint32_t sys_writefn(ARMCPU *cpu, GuestFD *gf,
-                              target_ulong buf, uint32_t len);
- typedef uint32_t sys_readfn(ARMCPU *cpu, GuestFD *gf,
-                             target_ulong buf, uint32_t len);
-+typedef uint32_t sys_isattyfn(ARMCPU *cpu, GuestFD *gf);
- static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
- {
-@@ -XXX,XX +XXX,XX @@ static uint32_t host_readfn(ARMCPU *cpu, GuestFD *gf,
-     return len - ret;
- }
-+static uint32_t host_isattyfn(ARMCPU *cpu, GuestFD *gf)
-+{
-+    return isatty(gf->hostfd);
-+}
-+
- static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
- {
-     return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
-@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_readfn(ARMCPU *cpu, GuestFD *gf,
-                            gf->hostfd, buf, len);
- }
-+static uint32_t gdb_isattyfn(ARMCPU *cpu, GuestFD *gf)
-+{
-+    return arm_gdb_syscall(cpu, arm_semi_cb, "isatty,%x", gf->hostfd);
-+}
-+
- typedef struct GuestFDFunctions {
-     sys_closefn *closefn;
-     sys_writefn *writefn;
-     sys_readfn *readfn;
-+    sys_isattyfn *isattyfn;
- } GuestFDFunctions;
- static const GuestFDFunctions guestfd_fns[] = {
-@@ -XXX,XX +XXX,XX @@ static const GuestFDFunctions guestfd_fns[] = {
-         .closefn = host_closefn,
-         .writefn = host_writefn,
-         .readfn = host_readfn,
-+        .isattyfn = host_isattyfn,
-     },
-     [GuestFDGDB] = {
-         .closefn = gdb_closefn,
-         .writefn = gdb_writefn,
-         .readfn = gdb_readfn,
-+        .isattyfn = gdb_isattyfn,
-     },
- };
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             return set_swi_errno(env, -1);
-         }
--        if (use_gdb_syscalls()) {
--            return arm_gdb_syscall(cpu, arm_semi_cb, "isatty,%x", gf->hostfd);
--        } else {
--            return isatty(gf->hostfd);
--        }
-+        return guestfd_fns[gf->type].isattyfn(cpu, gf);
-     case TARGET_SYS_SEEK:
-         GET_ARG(0);
-         GET_ARG(1);
---
-.20.1

-[PULL 35/68] target/arm/arm-semi: Factor out implementation of SYS_SEEK
+Deleted patch
-Factor out the implementation of SYS_SEEK via the new function
-tables.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190916141544.17540-12-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 31 ++++++++++++++++++++++---------
-file changed, 22 insertions(+), 9 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ typedef uint32_t sys_writefn(ARMCPU *cpu, GuestFD *gf,
- typedef uint32_t sys_readfn(ARMCPU *cpu, GuestFD *gf,
-                             target_ulong buf, uint32_t len);
- typedef uint32_t sys_isattyfn(ARMCPU *cpu, GuestFD *gf);
-+typedef uint32_t sys_seekfn(ARMCPU *cpu, GuestFD *gf,
-+                            target_ulong offset);
- static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
- {
-@@ -XXX,XX +XXX,XX @@ static uint32_t host_isattyfn(ARMCPU *cpu, GuestFD *gf)
-     return isatty(gf->hostfd);
- }
-+static uint32_t host_seekfn(ARMCPU *cpu, GuestFD *gf, target_ulong offset)
-+{
-+    CPUARMState *env = &cpu->env;
-+    uint32_t ret = set_swi_errno(env, lseek(gf->hostfd, offset, SEEK_SET));
-+    if (ret == (uint32_t)-1) {
-+        return -1;
-+    }
-+    return 0;
-+}
-+
- static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
- {
-     return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
-@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_isattyfn(ARMCPU *cpu, GuestFD *gf)
-     return arm_gdb_syscall(cpu, arm_semi_cb, "isatty,%x", gf->hostfd);
- }
-+static uint32_t gdb_seekfn(ARMCPU *cpu, GuestFD *gf, target_ulong offset)
-+{
-+    return arm_gdb_syscall(cpu, arm_semi_cb, "lseek,%x,%x,0",
-+                           gf->hostfd, offset);
-+}
-+
- typedef struct GuestFDFunctions {
-     sys_closefn *closefn;
-     sys_writefn *writefn;
-     sys_readfn *readfn;
-     sys_isattyfn *isattyfn;
-+    sys_seekfn *seekfn;
- } GuestFDFunctions;
- static const GuestFDFunctions guestfd_fns[] = {
-@@ -XXX,XX +XXX,XX @@ static const GuestFDFunctions guestfd_fns[] = {
-         .writefn = host_writefn,
-         .readfn = host_readfn,
-         .isattyfn = host_isattyfn,
-+        .seekfn = host_seekfn,
-     },
-     [GuestFDGDB] = {
-         .closefn = gdb_closefn,
-         .writefn = gdb_writefn,
-         .readfn = gdb_readfn,
-         .isattyfn = gdb_isattyfn,
-+        .seekfn = gdb_seekfn,
-     },
- };
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             return set_swi_errno(env, -1);
-         }
--        if (use_gdb_syscalls()) {
--            return arm_gdb_syscall(cpu, arm_semi_cb, "lseek,%x,%x,0",
--                                   gf->hostfd, arg1);
--        } else {
--            ret = set_swi_errno(env, lseek(gf->hostfd, arg1, SEEK_SET));
--            if (ret == (uint32_t)-1)
--              return -1;
--            return 0;
--        }
-+        return guestfd_fns[gf->type].seekfn(cpu, gf, arg1);
-     case TARGET_SYS_FLEN:
-         GET_ARG(0);
---
-.20.1

-[PULL 36/68] target/arm/arm-semi: Factor out implementation of SYS_FLEN
+Deleted patch
-Factor out the implementation of SYS_FLEN via the new
-function tables.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190916141544.17540-13-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 32 ++++++++++++++++++++++----------
-file changed, 22 insertions(+), 10 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ typedef uint32_t sys_readfn(ARMCPU *cpu, GuestFD *gf,
- typedef uint32_t sys_isattyfn(ARMCPU *cpu, GuestFD *gf);
- typedef uint32_t sys_seekfn(ARMCPU *cpu, GuestFD *gf,
-                             target_ulong offset);
-+typedef uint32_t sys_flenfn(ARMCPU *cpu, GuestFD *gf);
- static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
- {
-@@ -XXX,XX +XXX,XX @@ static uint32_t host_seekfn(ARMCPU *cpu, GuestFD *gf, target_ulong offset)
-     return 0;
- }
-+static uint32_t host_flenfn(ARMCPU *cpu, GuestFD *gf)
-+{
-+    CPUARMState *env = &cpu->env;
-+    struct stat buf;
-+    uint32_t ret = set_swi_errno(env, fstat(gf->hostfd, &buf));
-+    if (ret == (uint32_t)-1) {
-+        return -1;
-+    }
-+    return buf.st_size;
-+}
-+
- static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
- {
-     return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
-@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_seekfn(ARMCPU *cpu, GuestFD *gf, target_ulong offset)
-                            gf->hostfd, offset);
- }
-+static uint32_t gdb_flenfn(ARMCPU *cpu, GuestFD *gf)
-+{
-+    return arm_gdb_syscall(cpu, arm_semi_flen_cb, "fstat,%x,%x",
-+                           gf->hostfd, arm_flen_buf(cpu));
-+}
-+
- typedef struct GuestFDFunctions {
-     sys_closefn *closefn;
-     sys_writefn *writefn;
-     sys_readfn *readfn;
-     sys_isattyfn *isattyfn;
-     sys_seekfn *seekfn;
-+    sys_flenfn *flenfn;
- } GuestFDFunctions;
- static const GuestFDFunctions guestfd_fns[] = {
-@@ -XXX,XX +XXX,XX @@ static const GuestFDFunctions guestfd_fns[] = {
-         .readfn = host_readfn,
-         .isattyfn = host_isattyfn,
-         .seekfn = host_seekfn,
-+        .flenfn = host_flenfn,
-     },
-     [GuestFDGDB] = {
-         .closefn = gdb_closefn,
-@@ -XXX,XX +XXX,XX @@ static const GuestFDFunctions guestfd_fns[] = {
-         .readfn = gdb_readfn,
-         .isattyfn = gdb_isattyfn,
-         .seekfn = gdb_seekfn,
-+        .flenfn = gdb_flenfn,
-     },
- };
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             return set_swi_errno(env, -1);
-         }
--        if (use_gdb_syscalls()) {
--            return arm_gdb_syscall(cpu, arm_semi_flen_cb, "fstat,%x,%x",
--                                   gf->hostfd, arm_flen_buf(cpu));
--        } else {
--            struct stat buf;
--            ret = set_swi_errno(env, fstat(gf->hostfd, &buf));
--            if (ret == (uint32_t)-1)
--                return -1;
--            return buf.st_size;
--        }
-+        return guestfd_fns[gf->type].flenfn(cpu, gf);
-     case TARGET_SYS_TMPNAM:
-         qemu_log_mask(LOG_UNIMP, "%s: SYS_TMPNAM not implemented", __func__);
-         return -1;
---
-.20.1

-[PULL 38/68] target/arm/arm-semi: Implement SH_EXT_EXIT_EXTENDED extension
+Deleted patch
-SH_EXT_EXIT_EXTENDED is a v2.0 semihosting extension: it
-indicates that the implementation supports the SYS_EXIT_EXTENDED
-function. This function allows both A64 and A32/T32 guests to
-exit with a specified exit status, unlike the older SYS_EXIT
-function which only allowed this for A64 guests. Implement
-this extension.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190916141544.17540-15-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 19 ++++++++++++++-----
-file changed, 14 insertions(+), 5 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@
- #define TARGET_SYS_HEAPINFO    0x16
- #define TARGET_SYS_EXIT        0x18
- #define TARGET_SYS_SYNCCACHE   0x19
-+#define TARGET_SYS_EXIT_EXTENDED 0x20
- /* ADP_Stopped_ApplicationExit is used for exit(0),
-  * anything else is implemented as exit(1) */
-@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_flenfn(ARMCPU *cpu, GuestFD *gf)
- #define SHFB_MAGIC_2 0x46
- #define SHFB_MAGIC_3 0x42
-+/* Feature bits reportable in feature byte 0 */
-+#define SH_EXT_EXIT_EXTENDED (1 << 0)
-+
- static const uint8_t featurefile_data[] = {
-     SHFB_MAGIC_0,
-     SHFB_MAGIC_1,
-     SHFB_MAGIC_2,
-     SHFB_MAGIC_3,
--    0, /* Feature byte 0 */
-+    SH_EXT_EXIT_EXTENDED, /* Feature byte 0 */
- };
- static void init_featurefile_guestfd(int guestfd)
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             return 0;
-         }
-     case TARGET_SYS_EXIT:
--        if (is_a64(env)) {
-+    case TARGET_SYS_EXIT_EXTENDED:
-+        if (nr == TARGET_SYS_EXIT_EXTENDED || is_a64(env)) {
-             /*
--             * The A64 version of this call takes a parameter block,
-+             * The A64 version of SYS_EXIT takes a parameter block,
-              * so the application-exit type can return a subcode which
-              * is the exit status code from the application.
-+             * SYS_EXIT_EXTENDED is an a new-in-v2.0 optional function
-+             * which allows A32/T32 guests to also provide a status code.
-              */
-             GET_ARG(0);
-             GET_ARG(1);
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-             }
-         } else {
-             /*
--             * ARM specifies only Stopped_ApplicationExit as normal
--             * exit, everything else is considered an error
-+             * The A32/T32 version of SYS_EXIT specifies only
-+             * Stopped_ApplicationExit as normal exit, but does not
-+             * allow the guest to specify the exit status code.
-+             * Everything else is considered an error.
-              */
-             ret = (args == ADP_Stopped_ApplicationExit) ? 0 : 1;
-         }
---
-.20.1

-[PULL 39/68] target/arm/arm-semi: Implement SH_EXT_STDOUT_STDERR extension
+Deleted patch
-SH_EXT_STDOUT_STDERR is a v2.0 semihosting extension: the guest
-can open ":tt" with a file mode requesting append access in
-order to open stderr, in addition to the existing "open for
-read for stdin or write for stdout". Implement this and
-report it via the :semihosting-features data.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190916141544.17540-16-peter.maydell@linaro.org
----
- target/arm/arm-semi.c | 19 +++++++++++++++++--
-file changed, 17 insertions(+), 2 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_flenfn(ARMCPU *cpu, GuestFD *gf)
- /* Feature bits reportable in feature byte 0 */
- #define SH_EXT_EXIT_EXTENDED (1 << 0)
-+#define SH_EXT_STDOUT_STDERR (1 << 1)
- static const uint8_t featurefile_data[] = {
-     SHFB_MAGIC_0,
-     SHFB_MAGIC_1,
-     SHFB_MAGIC_2,
-     SHFB_MAGIC_3,
--    SH_EXT_EXIT_EXTENDED, /* Feature byte 0 */
-+    SH_EXT_EXIT_EXTENDED | SH_EXT_STDOUT_STDERR, /* Feature byte 0 */
- };
- static void init_featurefile_guestfd(int guestfd)
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
-         }
-         if (strcmp(s, ":tt") == 0) {
--            int result_fileno = arg1 < 4 ? STDIN_FILENO : STDOUT_FILENO;
-+            int result_fileno;
-+
-+            /*
-+             * We implement SH_EXT_STDOUT_STDERR, so:
-+             *  open for read == stdin
-+             *  open for write == stdout
-+             *  open for append == stderr
-+             */
-+            if (arg1 < 4) {
-+                result_fileno = STDIN_FILENO;
-+            } else if (arg1 < 8) {
-+                result_fileno = STDOUT_FILENO;
-+            } else {
-+                result_fileno = STDERR_FILENO;
-+            }
-             associate_guestfd(guestfd, result_fileno);
-             unlock_user(s, arg0, 0);
-             return guestfd;
---
-.20.1

-[PULL 40/68] aspeed/wdt: Check correct register for clock source
+[PULL 35/36] hw/arm/virt: kvm: allow gicv3 by default if v2 cannot work
-From: Amithash Prasad <amithash@fb.com>
+From: Eric Auger <eric.auger@redhat.com>
-When WDT_RESTART is written, the data is not the contents
+At the moment if the end-user does not specify the gic-version along
-of the WDT_CTRL register. Hence ensure we are looking at
+with KVM acceleration, v2 is set by default. However most of the
-WDT_CTRL to check if bit WDT_CTRL_1MHZ_CLK is set or not.
+systems now have GICv3 and sometimes they do not support GICv2
 compatibility.
-Signed-off-by: Amithash Prasad <amithash@fb.com>
+This patch keeps the default v2 selection in all cases except
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+in the KVM accelerated mode when either
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+- the host does not support GICv2 in-kernel emulation or
-Message-id: 20190925143248.10000-2-clg@kaod.org
+- number of VCPUS exceeds 8.
-[clg: improved Suject prefix ]
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Those cases did not work anyway so we do not break any compatibility.
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+Now we get v3 selected in such a case.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20200311131618.7187-7-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/watchdog/wdt_aspeed.c | 2 +-
+ hw/arm/virt.c | 17 ++++++++++++++++-
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 16 insertions(+), 1 deletion(-)
-diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/watchdog/wdt_aspeed.c
+--- a/hw/arm/virt.c
-+++ b/hw/watchdog/wdt_aspeed.c
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
+@@ -XXX,XX +XXX,XX @@ static void virt_set_memmap(VirtMachineState *vms)
-     case WDT_RESTART:
+  */
-         if ((data & 0xFFFF) == WDT_RESTART_MAGIC) {
+ static void finalize_gic_version(VirtMachineState *vms)
-             s->regs[WDT_STATUS] = s->regs[WDT_RELOAD_VALUE];
+ {
--            aspeed_wdt_reload(s, !(data & WDT_CTRL_1MHZ_CLK));
++    unsigned int max_cpus = MACHINE(vms)->smp.max_cpus;
-+            aspeed_wdt_reload(s, !(s->regs[WDT_CTRL] & WDT_CTRL_1MHZ_CLK));
++
-         }
+     if (kvm_enabled()) {
-         break;
+         int probe_bitmap;
-     case WDT_CTRL:
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
              }
              return;
          case VIRT_GIC_VERSION_NOSEL:
 -            vms->gic_version = VIRT_GIC_VERSION_2;
 +            if ((probe_bitmap & KVM_ARM_VGIC_V2) && max_cpus <= GIC_NCPU) {
 +                vms->gic_version = VIRT_GIC_VERSION_2;
 +            } else if (probe_bitmap & KVM_ARM_VGIC_V3) {
 +                /*
 +                 * in case the host does not support v2 in-kernel emulation or
 +                 * the end-user requested more than 8 VCPUs we now default
 +                 * to v3. In any case defaulting to v2 would be broken.
 +                 */
 +                vms->gic_version = VIRT_GIC_VERSION_3;
 +            } else if (max_cpus > GIC_NCPU) {
 +                error_report("host only supports in-kernel GICv2 emulation "
 +                             "but more than 8 vcpus are requested");
 +                exit(1);
 +            }
              break;
          case VIRT_GIC_VERSION_2:
          case VIRT_GIC_VERSION_3:
 --
 .20.1

-[PULL 44/68] aspeed/timer: Add support for control register 3
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-The AST2500 timer has a third control register that is used to
-implement a set-to-clear feature for the main control register.
-This models the behaviour expected by the AST2500 while maintaining
-the same behaviour for the AST2400.
-The vmstate version is not increased yet because the structure is
-modified again in the following patches.
-Based on previous work from Joel Stanley.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
-Message-id: 20190925143248.10000-6-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/timer/aspeed_timer.h |  1 +
- hw/timer/aspeed_timer.c         | 19 +++++++++++++++++++
-files changed, 20 insertions(+)
-diff --git a/include/hw/timer/aspeed_timer.h b/include/hw/timer/aspeed_timer.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/timer/aspeed_timer.h
-+++ b/include/hw/timer/aspeed_timer.h
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedTimerCtrlState {
-     uint32_t ctrl;
-     uint32_t ctrl2;
-+    uint32_t ctrl3;
-     AspeedTimer timers[ASPEED_TIMER_NR_TIMERS];
-     AspeedSCUState *scu;
-diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/aspeed_timer.c
-+++ b/hw/timer/aspeed_timer.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2500_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
-     switch (offset) {
-     case 0x38:
-+        value = s->ctrl3 & BIT(0);
-+        break;
-     case 0x3C:
-     default:
-         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2500_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
- static void aspeed_2500_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
-                                     uint64_t value)
- {
-+    const uint32_t tv = (uint32_t)(value & 0xFFFFFFFF);
-+    uint8_t command;
-+
-     switch (offset) {
-     case 0x38:
-+        command = (value >> 1) & 0xFF;
-+        if (command == 0xAE) {
-+            s->ctrl3 = 0x1;
-+        } else if (command == 0xEA) {
-+            s->ctrl3 = 0x0;
-+        }
-+        break;
-     case 0x3C:
-+        if (s->ctrl3 & BIT(0)) {
-+            aspeed_timer_set_ctrl(s, s->ctrl & ~tv);
-+        }
-+        break;
-+
-     default:
-         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
-                 __func__, offset);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_reset(DeviceState *dev)
-     }
-     s->ctrl = 0;
-     s->ctrl2 = 0;
-+    s->ctrl3 = 0;
- }
- static const VMStateDescription vmstate_aspeed_timer = {
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_timer_state = {
-     .fields = (VMStateField[]) {
-         VMSTATE_UINT32(ctrl, AspeedTimerCtrlState),
-         VMSTATE_UINT32(ctrl2, AspeedTimerCtrlState),
-+        VMSTATE_UINT32(ctrl3, AspeedTimerCtrlState),
-         VMSTATE_STRUCT_ARRAY(timers, AspeedTimerCtrlState,
-                              ASPEED_TIMER_NR_TIMERS, 1, vmstate_aspeed_timer,
-                              AspeedTimer),
---
-.20.1

-[PULL 49/68] watchdog/aspeed: Introduce an object class per SoC
+[PULL 36/36] target/arm: kvm: Inject events at the last stage of sync
-From: Cédric Le Goater <clg@kaod.org>
+From: Beata Michalska <beata.michalska@linaro.org>
-It cleanups the current models for the Aspeed AST2400 and AST2500 SoCs
+KVM_SET_VCPU_EVENTS might actually lead to vcpu registers being modified.
-and prepares ground for future SoCs.
+As such this should be the last step of sync to avoid potential overwriting
 of whatever changes KVM might have done.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Beata Michalska <beata.michalska@linaro.org>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
-Message-id: 20190925143248.10000-11-clg@kaod.org
+Message-id: 20200312003401.29017-2-beata.michalska@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/watchdog/wdt_aspeed.h |  18 ++++-
+ target/arm/kvm32.c | 15 ++++++++++-----
- hw/arm/aspeed_soc.c              |   9 ++-
+ target/arm/kvm64.c | 15 ++++++++++-----
- hw/watchdog/wdt_aspeed.c         | 122 ++++++++++++++++---------------
+files changed, 20 insertions(+), 10 deletions(-)
 files changed, 86 insertions(+), 63 deletions(-)
-diff --git a/include/hw/watchdog/wdt_aspeed.h b/include/hw/watchdog/wdt_aspeed.h
+diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/watchdog/wdt_aspeed.h
+--- a/target/arm/kvm32.c
-+++ b/include/hw/watchdog/wdt_aspeed.h
++++ b/target/arm/kvm32.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
- #define TYPE_ASPEED_WDT "aspeed.wdt"
+         return ret;
  #define ASPEED_WDT(obj) \
      OBJECT_CHECK(AspeedWDTState, (obj), TYPE_ASPEED_WDT)
 +#define TYPE_ASPEED_2400_WDT TYPE_ASPEED_WDT "-ast2400"
 +#define TYPE_ASPEED_2500_WDT TYPE_ASPEED_WDT "-ast2500"
  #define ASPEED_WDT_REGS_MAX        (0x20 / 4)
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedWDTState {
      AspeedSCUState *scu;
      uint32_t pclk_freq;
 -    uint32_t silicon_rev;
 -    uint32_t ext_pulse_width_mask;
  } AspeedWDTState;
 +#define ASPEED_WDT_CLASS(klass) \
 +     OBJECT_CLASS_CHECK(AspeedWDTClass, (klass), TYPE_ASPEED_WDT)
 +#define ASPEED_WDT_GET_CLASS(obj) \
 +     OBJECT_GET_CLASS(AspeedWDTClass, (obj), TYPE_ASPEED_WDT)
 +
 +typedef struct AspeedWDTClass {
 +    SysBusDeviceClass parent_class;
 +
 +    uint32_t offset;
 +    uint32_t ext_pulse_width_mask;
 +    uint32_t reset_ctrl_reg;
 +    void (*reset_pulse)(AspeedWDTState *s, uint32_t property);
 +}  AspeedWDTClass;
 +
  #endif /* WDT_ASPEED_H */
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                                "max-ram-size", &error_abort);
      for (i = 0; i < sc->info->wdts_num; i++) {
 +        snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
          sysbus_init_child_obj(obj, "wdt[*]", OBJECT(&s->wdt[i]),
 -                              sizeof(s->wdt[i]), TYPE_ASPEED_WDT);
 -        qdev_prop_set_uint32(DEVICE(&s->wdt[i]), "silicon-rev",
 -                                    sc->info->silicon_rev);
 +                              sizeof(s->wdt[i]), typename);
          object_property_add_const_link(OBJECT(&s->wdt[i]), "scu",
                                         OBJECT(&s->scu), &error_abort);
      }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
+-    ret = kvm_put_vcpu_events(cpu);
-     /* Watch dog */
+-    if (ret) {
-     for (i = 0; i < sc->info->wdts_num; i++) {
+-        return ret;
 +        AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(&s->wdt[i]);
 +
          object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
          if (err) {
              error_propagate(errp, err);
              return;
          }
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
 -                        sc->info->memmap[ASPEED_WDT] + i * 0x20);
 +                        sc->info->memmap[ASPEED_WDT] + i * awc->offset);
      }
      /* Net */
 diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/watchdog/wdt_aspeed.c
 +++ b/hw/watchdog/wdt_aspeed.c
@@ -XXX,XX +XXX,XX @@ static bool aspeed_wdt_is_enabled(const AspeedWDTState *s)
      return s->regs[WDT_CTRL] & WDT_CTRL_ENABLE;
  }
 -static bool is_ast2500(const AspeedWDTState *s)
 -{
 -    switch (s->silicon_rev) {
 -    case AST2500_A0_SILICON_REV:
 -    case AST2500_A1_SILICON_REV:
 -        return true;
 -    case AST2400_A0_SILICON_REV:
 -    case AST2400_A1_SILICON_REV:
 -    default:
 -        break;
 -    }
 -
--    return false;
+     write_cpustate_to_list(cpu, true);
--}
--
+     if (!write_list_to_kvmstate(cpu, level)) {
- static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)
+         return EINVAL;
- {
+     }
-     AspeedWDTState *s = ASPEED_WDT(opaque);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
++    /*
-                              unsigned size)
++     * Setting VCPU events should be triggered after syncing the registers
- {
++     * to avoid overwriting potential changes made by KVM upon calling
-     AspeedWDTState *s = ASPEED_WDT(opaque);
++     * KVM_SET_VCPU_EVENTS ioctl
-+    AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(s);
++     */
-     bool enable = data & WDT_CTRL_ENABLE;
++    ret = kvm_put_vcpu_events(cpu);
++    if (ret) {
-     offset >>= 2;
++        return ret;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
++    }
          }
          break;
      case WDT_RESET_WIDTH:
 -    {
 -        uint32_t property = data & WDT_POLARITY_MASK;
 -
 -        if (property && is_ast2500(s)) {
 -            if (property == WDT_ACTIVE_HIGH_MAGIC) {
 -                s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_ACTIVE_HIGH;
 -            } else if (property == WDT_ACTIVE_LOW_MAGIC) {
 -                s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_ACTIVE_HIGH;
 -            } else if (property == WDT_PUSH_PULL_MAGIC) {
 -                s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_PUSH_PULL;
 -            } else if (property == WDT_OPEN_DRAIN_MAGIC) {
 -                s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_PUSH_PULL;
 -            }
 +        if (awc->reset_pulse) {
 +            awc->reset_pulse(s, data & WDT_POLARITY_MASK);
          }
 -        s->regs[WDT_RESET_WIDTH] &= ~s->ext_pulse_width_mask;
 -        s->regs[WDT_RESET_WIDTH] |= data & s->ext_pulse_width_mask;
 +        s->regs[WDT_RESET_WIDTH] &= ~awc->ext_pulse_width_mask;
 +        s->regs[WDT_RESET_WIDTH] |= data & awc->ext_pulse_width_mask;
          break;
 -    }
 +
-     case WDT_TIMEOUT_STATUS:
+     kvm_arm_sync_mpstate_to_kvm(cpu);
-     case WDT_TIMEOUT_CLEAR:
-         qemu_log_mask(LOG_UNIMP,
+     return ret;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_reset(DeviceState *dev)
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
- static void aspeed_wdt_timer_expired(void *dev)
+index XXXXXXX..XXXXXXX 100644
- {
+--- a/target/arm/kvm64.c
-     AspeedWDTState *s = ASPEED_WDT(dev);
++++ b/target/arm/kvm64.c
-+    uint32_t reset_ctrl_reg = ASPEED_WDT_GET_CLASS(s)->reset_ctrl_reg;
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
+         return ret;
      /* Do not reset on SDRAM controller reset */
 -    if (s->scu->regs[SCU_RESET_CONTROL1] & SCU_RESET_SDRAM) {
 +    if (s->scu->regs[reset_ctrl_reg] & SCU_RESET_SDRAM) {
          timer_del(s->timer);
          s->regs[WDT_CTRL] = 0;
          return;
@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_realize(DeviceState *dev, Error **errp)
      }
-     s->scu = ASPEED_SCU(obj);
+-    ret = kvm_put_vcpu_events(cpu);
--    if (!is_supported_silicon_rev(s->silicon_rev)) {
+-    if (ret) {
--        error_setg(errp, "Unknown silicon revision: 0x%" PRIx32,
+-        return ret;
 -                s->silicon_rev);
 -        return;
 -    }
 -
--    switch (s->silicon_rev) {
+     write_cpustate_to_list(cpu, true);
--    case AST2400_A0_SILICON_REV:
--    case AST2400_A1_SILICON_REV:
+     if (!write_list_to_kvmstate(cpu, level)) {
--        s->ext_pulse_width_mask = 0xff;
+         return -EINVAL;
--        break;
+     }
--    case AST2500_A0_SILICON_REV:
--    case AST2500_A1_SILICON_REV:
++   /*
--        s->ext_pulse_width_mask = 0xfffff;
++    * Setting VCPU events should be triggered after syncing the registers
--        break;
++    * to avoid overwriting potential changes made by KVM upon calling
--    default:
++    * KVM_SET_VCPU_EVENTS ioctl
--        g_assert_not_reached();
++    */
--    }
++    ret = kvm_put_vcpu_events(cpu);
--
++    if (ret) {
-     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, aspeed_wdt_timer_expired, dev);
++        return ret;
++    }
      /* FIXME: This setting should be derived from the SCU hw strapping
@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_realize(DeviceState *dev, Error **errp)
      sysbus_init_mmio(sbd, &s->iomem);
  }
 -static Property aspeed_wdt_properties[] = {
 -    DEFINE_PROP_UINT32("silicon-rev", AspeedWDTState, silicon_rev, 0),
 -    DEFINE_PROP_END_OF_LIST(),
 -};
 -
  static void aspeed_wdt_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
 +    dc->desc = "ASPEED Watchdog Controller";
      dc->realize = aspeed_wdt_realize;
      dc->reset = aspeed_wdt_reset;
      set_bit(DEVICE_CATEGORY_MISC, dc->categories);
      dc->vmsd = &vmstate_aspeed_wdt;
 -    dc->props = aspeed_wdt_properties;
  }
  static const TypeInfo aspeed_wdt_info = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_wdt_info = {
      .name  = TYPE_ASPEED_WDT,
      .instance_size  = sizeof(AspeedWDTState),
      .class_init = aspeed_wdt_class_init,
 +    .class_size    = sizeof(AspeedWDTClass),
 +    .abstract      = true,
 +};
 +
-+static void aspeed_2400_wdt_class_init(ObjectClass *klass, void *data)
+     kvm_arm_sync_mpstate_to_kvm(cpu);
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
+     return ret;
 +    AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
 +
 +    dc->desc = "ASPEED 2400 Watchdog Controller";
 +    awc->offset = 0x20;
 +    awc->ext_pulse_width_mask = 0xff;
 +    awc->reset_ctrl_reg = SCU_RESET_CONTROL1;
 +}
 +
 +static const TypeInfo aspeed_2400_wdt_info = {
 +    .name = TYPE_ASPEED_2400_WDT,
 +    .parent = TYPE_ASPEED_WDT,
 +    .instance_size = sizeof(AspeedWDTState),
 +    .class_init = aspeed_2400_wdt_class_init,
 +};
 +
 +static void aspeed_2500_wdt_reset_pulse(AspeedWDTState *s, uint32_t property)
 +{
 +    if (property) {
 +        if (property == WDT_ACTIVE_HIGH_MAGIC) {
 +            s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_ACTIVE_HIGH;
 +        } else if (property == WDT_ACTIVE_LOW_MAGIC) {
 +            s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_ACTIVE_HIGH;
 +        } else if (property == WDT_PUSH_PULL_MAGIC) {
 +            s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_PUSH_PULL;
 +        } else if (property == WDT_OPEN_DRAIN_MAGIC) {
 +            s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_PUSH_PULL;
 +        }
 +    }
 +}
 +
 +static void aspeed_2500_wdt_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
 +
 +    dc->desc = "ASPEED 2500 Watchdog Controller";
 +    awc->offset = 0x20;
 +    awc->ext_pulse_width_mask = 0xfffff;
 +    awc->reset_ctrl_reg = SCU_RESET_CONTROL1;
 +    awc->reset_pulse = aspeed_2500_wdt_reset_pulse;
 +}
 +
 +static const TypeInfo aspeed_2500_wdt_info = {
 +    .name = TYPE_ASPEED_2500_WDT,
 +    .parent = TYPE_ASPEED_WDT,
 +    .instance_size = sizeof(AspeedWDTState),
 +    .class_init = aspeed_2500_wdt_class_init,
  };
  static void wdt_aspeed_register_types(void)
  {
      watchdog_add_model(&model);
      type_register_static(&aspeed_wdt_info);
 +    type_register_static(&aspeed_2400_wdt_info);
 +    type_register_static(&aspeed_2500_wdt_info);
  }
  type_init(wdt_aspeed_register_types)
 --
 .20.1

-[PULL 50/68] hw: wdt_aspeed: Add AST2600 support
+Deleted patch
-From: Joel Stanley <joel@jms.id.au>
-The AST2600 has four watchdogs, and they each have a 0x40 of registers.
-When running as part of an ast2600 system we must check a different
-offset for the system reset control register in the SCU.
-Signed-off-by: Joel Stanley <joel@jms.id.au>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 20190925143248.10000-12-clg@kaod.org
-[clg: - reworked model integration into new object class ]
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/aspeed_soc.h      |  2 +-
- include/hw/watchdog/wdt_aspeed.h |  1 +
- hw/watchdog/wdt_aspeed.c         | 29 +++++++++++++++++++++++++++++
-files changed, 31 insertions(+), 1 deletion(-)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
-+++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sd/aspeed_sdhci.h"
- #define ASPEED_SPIS_NUM  2
--#define ASPEED_WDTS_NUM  3
-+#define ASPEED_WDTS_NUM  4
- #define ASPEED_CPUS_NUM  2
- #define ASPEED_MACS_NUM  2
-diff --git a/include/hw/watchdog/wdt_aspeed.h b/include/hw/watchdog/wdt_aspeed.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/watchdog/wdt_aspeed.h
-+++ b/include/hw/watchdog/wdt_aspeed.h
-@@ -XXX,XX +XXX,XX @@
-     OBJECT_CHECK(AspeedWDTState, (obj), TYPE_ASPEED_WDT)
- #define TYPE_ASPEED_2400_WDT TYPE_ASPEED_WDT "-ast2400"
- #define TYPE_ASPEED_2500_WDT TYPE_ASPEED_WDT "-ast2500"
-+#define TYPE_ASPEED_2600_WDT TYPE_ASPEED_WDT "-ast2600"
- #define ASPEED_WDT_REGS_MAX        (0x20 / 4)
-diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/watchdog/wdt_aspeed.c
-+++ b/hw/watchdog/wdt_aspeed.c
-@@ -XXX,XX +XXX,XX @@
- #define     WDT_DRIVE_TYPE_MASK         (0xFF << 24)
- #define     WDT_PUSH_PULL_MAGIC         (0xA8 << 24)
- #define     WDT_OPEN_DRAIN_MAGIC        (0x8A << 24)
-+#define WDT_RESET_MASK1                 (0x1c / 4)
- #define WDT_TIMEOUT_STATUS              (0x10 / 4)
- #define WDT_TIMEOUT_CLEAR               (0x14 / 4)
- #define WDT_RESTART_MAGIC               0x4755
-+#define AST2600_SCU_RESET_CONTROL1      (0x40 / 4)
- #define SCU_RESET_CONTROL1              (0x04 / 4)
- #define    SCU_RESET_SDRAM              BIT(0)
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)
-         return s->regs[WDT_CTRL];
-     case WDT_RESET_WIDTH:
-         return s->regs[WDT_RESET_WIDTH];
-+    case WDT_RESET_MASK1:
-+        return s->regs[WDT_RESET_MASK1];
-     case WDT_TIMEOUT_STATUS:
-     case WDT_TIMEOUT_CLEAR:
-         qemu_log_mask(LOG_UNIMP,
-@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
-         s->regs[WDT_RESET_WIDTH] |= data & awc->ext_pulse_width_mask;
-         break;
-+    case WDT_RESET_MASK1:
-+        /* TODO: implement */
-+        s->regs[WDT_RESET_MASK1] = data;
-+        break;
-+
-     case WDT_TIMEOUT_STATUS:
-     case WDT_TIMEOUT_CLEAR:
-         qemu_log_mask(LOG_UNIMP,
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_2500_wdt_info = {
-     .class_init = aspeed_2500_wdt_class_init,
- };
-+static void aspeed_2600_wdt_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+    AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
-+
-+    dc->desc = "ASPEED 2600 Watchdog Controller";
-+    awc->offset = 0x40;
-+    awc->ext_pulse_width_mask = 0xfffff; /* TODO */
-+    awc->reset_ctrl_reg = AST2600_SCU_RESET_CONTROL1;
-+    awc->reset_pulse = aspeed_2500_wdt_reset_pulse;
-+}
-+
-+static const TypeInfo aspeed_2600_wdt_info = {
-+    .name = TYPE_ASPEED_2600_WDT,
-+    .parent = TYPE_ASPEED_WDT,
-+    .instance_size = sizeof(AspeedWDTState),
-+    .class_init = aspeed_2600_wdt_class_init,
-+};
-+
- static void wdt_aspeed_register_types(void)
- {
-     watchdog_add_model(&model);
-     type_register_static(&aspeed_wdt_info);
-     type_register_static(&aspeed_2400_wdt_info);
-     type_register_static(&aspeed_2500_wdt_info);
-+    type_register_static(&aspeed_2600_wdt_info);
- }
- type_init(wdt_aspeed_register_types)
---
-.20.1

A large arm pullreq, mostly because of 3 series:
 * aspeed 2600 support
 * semihosting v2.0 support
 * transaction-based ptimers

thanks
-- PMM

The following changes since commit 22dbfdecc3c52228d3489da3fe81da92b21197bf:

Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20191010.0' into staging (2019-10-14 15:09:08 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191014

for you to fetch changes up to bca1936f8f66c5f8a111569ffd14969de208bf3b:

hw/misc/bcm2835_mbox: Add trace events (2019-10-14 16:48:56 +0100)

----------------------------------------------------------------
target-arm queue:
 * Add Aspeed AST2600 SoC and board support
 * aspeed/wdt: Check correct register for clock source
 * bcm2835: code cleanups, better logging, trace events
 * implement v2.0 of the Arm semihosting specification
 * provide new 'transaction-based' ptimer API and use it
   for the Arm devices that use ptimers
 * ARM: KVM: support more than 256 CPUs

----------------------------------------------------------------
Amithash Prasad (1):
      aspeed/wdt: Check correct register for clock source

Cédric Le Goater (15):
      aspeed/timer: Introduce an object class per SoC
      aspeed/timer: Add support for control register 3
      aspeed/timer: Add AST2600 support
      aspeed/timer: Add support for IRQ status register on the AST2600
      aspeed/sdmc: Introduce an object class per SoC
      watchdog/aspeed: Introduce an object class per SoC
      aspeed/smc: Introduce segment operations
      aspeed/smc: Add AST2600 support
      aspeed/i2c: Introduce an object class per SoC
      aspeed/i2c: Add AST2600 support
      aspeed: Introduce an object class per SoC
      aspeed/soc: Add AST2600 support
      m25p80: Add support for w25q512jv
      aspeed: Add an AST2600 eval board
      aspeed: add support for the Aspeed MII controller of the AST2600

Eddie James (1):
      hw/sd/aspeed_sdhci: New device

Eric Auger (3):
      linux headers: update against v5.4-rc1
      intc/arm_gic: Support IRQ injection for more than 256 vpus
      ARM: KVM: Check KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 for smp_cpus > 256

Joel Stanley (5):
      hw: aspeed_scu: Add AST2600 support
      aspeed/sdmc: Add AST2600 support
      hw: wdt_aspeed: Add AST2600 support
      aspeed: Parameterise number of MACs
      aspeed/soc: Add ASPEED Video stub

Peter Maydell (36):
      ptimer: Rename ptimer_init() to ptimer_init_with_bh()
      ptimer: Provide new transaction-based API
      tests/ptimer-test: Switch to transaction-based ptimer API
      hw/timer/arm_timer.c: Switch to transaction-based ptimer API
      hw/arm/musicpal.c: Switch to transaction-based ptimer API
      hw/timer/allwinner-a10-pit.c: Switch to transaction-based ptimer API
      hw/timer/arm_mptimer.c: Switch to transaction-based ptimer API
      hw/timer/cmsdk-apb-dualtimer.c: Switch to transaction-based ptimer API
      hw/timer/cmsdk-apb-timer.c: Switch to transaction-based ptimer API
      hw/timer/digic-timer.c: Switch to transaction-based ptimer API
      hw/timer/exynos4210_mct.c: Switch GFRC to transaction-based ptimer API
      hw/timer/exynos4210_mct.c: Switch LFRC to transaction-based ptimer API
      hw/timer/exynos4210_mct.c: Switch ltick to transaction-based ptimer API
      hw/timer/exynos4210_pwm.c: Switch to transaction-based ptimer API
      hw/timer/exynos4210_rtc.c: Switch 1Hz ptimer to transaction-based API
      hw/timer/exynos4210_rtc.c: Switch main ptimer to transaction-based API
      hw/timer/imx_epit.c: Switch to transaction-based ptimer API
      hw/timer/imx_gpt.c: Switch to transaction-based ptimer API
      hw/timer/mss-timerc: Switch to transaction-based ptimer API
      hw/watchdog/cmsdk-apb-watchdog.c: Switch to transaction-based ptimer API
      hw/net/lan9118.c: Switch to transaction-based ptimer API
      target/arm/arm-semi: Capture errno in softmmu version of set_swi_errno()
      target/arm/arm-semi: Always set some kind of errno for failed calls
      target/arm/arm-semi: Correct comment about gdb syscall races
      target/arm/arm-semi: Make semihosting code hand out its own file descriptors
      target/arm/arm-semi: Restrict use of TaskState*
      target/arm/arm-semi: Use set_swi_errno() in gdbstub callback functions
      target/arm/arm-semi: Factor out implementation of SYS_CLOSE
      target/arm/arm-semi: Factor out implementation of SYS_WRITE
      target/arm/arm-semi: Factor out implementation of SYS_READ
      target/arm/arm-semi: Factor out implementation of SYS_ISTTY
      target/arm/arm-semi: Factor out implementation of SYS_SEEK
      target/arm/arm-semi: Factor out implementation of SYS_FLEN
      target/arm/arm-semi: Implement support for semihosting feature detection
      target/arm/arm-semi: Implement SH_EXT_EXIT_EXTENDED extension
      target/arm/arm-semi: Implement SH_EXT_STDOUT_STDERR extension

Philippe Mathieu-Daudé (6):
      hw/arm/raspi: Use the IEC binary prefix definitions
      hw/arm/bcm2835_peripherals: Improve logging
      hw/arm/bcm2835_peripherals: Name various address spaces
      hw/arm/bcm2835: Rename some definitions
      hw/arm/bcm2835: Add various unimplemented peripherals
      hw/misc/bcm2835_mbox: Add trace events

Rashmica Gupta (1):
      hw/gpio: Add in AST2600 specific implementation

From: Eric Auger <eric.auger@redhat.com>

Update the headers against commit:
0f1a7b3fac05 ("timer-of: don't use conditional expression
with mixed 'void' types")

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Message-id: 20191003154640.22451-2-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/standard-headers/asm-x86/bootparam.h  |   2 +
 include/standard-headers/asm-x86/kvm_para.h   |   1 +
 include/standard-headers/linux/ethtool.h      |  24 +++
 include/standard-headers/linux/pci_regs.h     |  19 +-
 include/standard-headers/linux/virtio_fs.h    |  19 ++
 include/standard-headers/linux/virtio_ids.h   |   2 +
 include/standard-headers/linux/virtio_iommu.h | 165 ++++++++++++++++++
 include/standard-headers/linux/virtio_pmem.h  |   6 +-
 linux-headers/asm-arm/kvm.h                   |  16 +-
 linux-headers/asm-arm/unistd-common.h         |   2 +
 linux-headers/asm-arm64/kvm.h                 |  21 ++-
 linux-headers/asm-generic/mman-common.h       |  18 +-
 linux-headers/asm-generic/mman.h              |  10 +-
 linux-headers/asm-generic/unistd.h            |  10 +-
 linux-headers/asm-mips/mman.h                 |   3 +
 linux-headers/asm-mips/unistd_n32.h           |   1 +
 linux-headers/asm-mips/unistd_n64.h           |   1 +
 linux-headers/asm-mips/unistd_o32.h           |   1 +
 linux-headers/asm-powerpc/mman.h              |   6 +-
 linux-headers/asm-powerpc/unistd_32.h         |   2 +
 linux-headers/asm-powerpc/unistd_64.h         |   2 +
 linux-headers/asm-s390/kvm.h                  |   6 +
 linux-headers/asm-s390/unistd_32.h            |   2 +
 linux-headers/asm-s390/unistd_64.h            |   2 +
 linux-headers/asm-x86/kvm.h                   |  28 ++-
 linux-headers/asm-x86/unistd.h                |   2 +-
 linux-headers/asm-x86/unistd_32.h             |   2 +
 linux-headers/asm-x86/unistd_64.h             |   2 +
 linux-headers/asm-x86/unistd_x32.h            |   2 +
 linux-headers/linux/kvm.h                     |  12 +-
 linux-headers/linux/psp-sev.h                 |   5 +-
 linux-headers/linux/vfio.h                    |  71 +++++---
 32 files changed, 406 insertions(+), 59 deletions(-)
 create mode 100644 include/standard-headers/linux/virtio_fs.h
 create mode 100644 include/standard-headers/linux/virtio_iommu.h

diff --git a/include/standard-headers/asm-x86/bootparam.h b/include/standard-headers/asm-x86/bootparam.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/asm-x86/bootparam.h
+++ b/include/standard-headers/asm-x86/bootparam.h
@@ -XXX,XX +XXX,XX @@
 #define XLF_EFI_HANDOVER_32		(1<<2)
 #define XLF_EFI_HANDOVER_64		(1<<3)
 #define XLF_EFI_KEXEC			(1<<4)
+#define XLF_5LEVEL			(1<<5)
+#define XLF_5LEVEL_ENABLED		(1<<6)
 
 
 #endif /* _ASM_X86_BOOTPARAM_H */
diff --git a/include/standard-headers/asm-x86/kvm_para.h b/include/standard-headers/asm-x86/kvm_para.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/asm-x86/kvm_para.h
+++ b/include/standard-headers/asm-x86/kvm_para.h
@@ -XXX,XX +XXX,XX @@
 #define KVM_FEATURE_ASYNC_PF_VMEXIT	10
 #define KVM_FEATURE_PV_SEND_IPI	11
 #define KVM_FEATURE_POLL_CONTROL	12
+#define KVM_FEATURE_PV_SCHED_YIELD	13
 
 #define KVM_HINTS_REALTIME      0
 
diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/ethtool.h
+++ b/include/standard-headers/linux/ethtool.h
@@ -XXX,XX +XXX,XX @@ struct ethtool_tunable {
 #define ETHTOOL_PHY_FAST_LINK_DOWN_ON	0
 #define ETHTOOL_PHY_FAST_LINK_DOWN_OFF	0xff
 
+/* Energy Detect Power Down (EDPD) is a feature supported by some PHYs, where
+ * the PHY's RX & TX blocks are put into a low-power mode when there is no
+ * link detected (typically cable is un-plugged). For RX, only a minimal
+ * link-detection is available, and for TX the PHY wakes up to send link pulses
+ * to avoid any lock-ups in case the peer PHY may also be running in EDPD mode.
+ *
+ * Some PHYs may support configuration of the wake-up interval for TX pulses,
+ * and some PHYs may support only disabling TX pulses entirely. For the latter
+ * a special value is required (ETHTOOL_PHY_EDPD_NO_TX) so that this can be
+ * configured from userspace (should the user want it).
+ *
+ * The interval units for TX wake-up are in milliseconds, since this should
+ * cover a reasonable range of intervals:
+ *  - from 1 millisecond, which does not sound like much of a power-saver
+ *  - to ~65 seconds which is quite a lot to wait for a link to come up when
+ *    plugging a cable
+ */
+#define ETHTOOL_PHY_EDPD_DFLT_TX_MSECS		0xffff
+#define ETHTOOL_PHY_EDPD_NO_TX			0xfffe
+#define ETHTOOL_PHY_EDPD_DISABLE		0
+
 enum phy_tunable_id {
 	ETHTOOL_PHY_ID_UNSPEC,
 	ETHTOOL_PHY_DOWNSHIFT,
 	ETHTOOL_PHY_FAST_LINK_DOWN,
+	ETHTOOL_PHY_EDPD,
 	/*
 	 * Add your fresh new phy tunable attribute above and remember to update
 	 * phy_tunable_strings[] in net/core/ethtool.c
@@ -XXX,XX +XXX,XX @@ enum ethtool_link_mode_bit_indices {
 	ETHTOOL_LINK_MODE_200000baseLR4_ER4_FR4_Full_BIT = 64,
 	ETHTOOL_LINK_MODE_200000baseDR4_Full_BIT	 = 65,
 	ETHTOOL_LINK_MODE_200000baseCR4_Full_BIT	 = 66,
+	ETHTOOL_LINK_MODE_100baseT1_Full_BIT		 = 67,
+	ETHTOOL_LINK_MODE_1000baseT1_Full_BIT		 = 68,
 
 	/* must be last entry */
 	__ETHTOOL_LINK_MODE_MASK_NBITS
diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/pci_regs.h
+++ b/include/standard-headers/linux/pci_regs.h
@@ -XXX,XX +XXX,XX @@
 #define  PCI_EXP_LNKCAP_SLS_5_0GB 0x00000002 /* LNKCAP2 SLS Vector bit 1 */
 #define  PCI_EXP_LNKCAP_SLS_8_0GB 0x00000003 /* LNKCAP2 SLS Vector bit 2 */
 #define  PCI_EXP_LNKCAP_SLS_16_0GB 0x00000004 /* LNKCAP2 SLS Vector bit 3 */
+#define  PCI_EXP_LNKCAP_SLS_32_0GB 0x00000005 /* LNKCAP2 SLS Vector bit 4 */
 #define  PCI_EXP_LNKCAP_MLW	0x000003f0 /* Maximum Link Width */
 #define  PCI_EXP_LNKCAP_ASPMS	0x00000c00 /* ASPM Support */
 #define  PCI_EXP_LNKCAP_L0SEL	0x00007000 /* L0s Exit Latency */
@@ -XXX,XX +XXX,XX @@
 #define  PCI_EXP_LNKSTA_CLS_5_0GB 0x0002 /* Current Link Speed 5.0GT/s */
 #define  PCI_EXP_LNKSTA_CLS_8_0GB 0x0003 /* Current Link Speed 8.0GT/s */
 #define  PCI_EXP_LNKSTA_CLS_16_0GB 0x0004 /* Current Link Speed 16.0GT/s */
+#define  PCI_EXP_LNKSTA_CLS_32_0GB 0x0005 /* Current Link Speed 32.0GT/s */
 #define  PCI_EXP_LNKSTA_NLW	0x03f0	/* Negotiated Link Width */
 #define  PCI_EXP_LNKSTA_NLW_X1	0x0010	/* Current Link Width x1 */
 #define  PCI_EXP_LNKSTA_NLW_X2	0x0020	/* Current Link Width x2 */
@@ -XXX,XX +XXX,XX @@
 #define  PCI_EXP_SLTCTL_CCIE	0x0010	/* Command Completed Interrupt Enable */
 #define  PCI_EXP_SLTCTL_HPIE	0x0020	/* Hot-Plug Interrupt Enable */
 #define  PCI_EXP_SLTCTL_AIC	0x00c0	/* Attention Indicator Control */
+#define  PCI_EXP_SLTCTL_ATTN_IND_SHIFT 6      /* Attention Indicator shift */
 #define  PCI_EXP_SLTCTL_ATTN_IND_ON    0x0040 /* Attention Indicator on */
 #define  PCI_EXP_SLTCTL_ATTN_IND_BLINK 0x0080 /* Attention Indicator blinking */
 #define  PCI_EXP_SLTCTL_ATTN_IND_OFF   0x00c0 /* Attention Indicator off */
@@ -XXX,XX +XXX,XX @@
 #define  PCI_EXP_LNKCAP2_SLS_5_0GB	0x00000004 /* Supported Speed 5GT/s */
 #define  PCI_EXP_LNKCAP2_SLS_8_0GB	0x00000008 /* Supported Speed 8GT/s */
 #define  PCI_EXP_LNKCAP2_SLS_16_0GB	0x00000010 /* Supported Speed 16GT/s */
+#define  PCI_EXP_LNKCAP2_SLS_32_0GB	0x00000020 /* Supported Speed 32GT/s */
 #define  PCI_EXP_LNKCAP2_CROSSLINK	0x00000100 /* Crosslink supported */
 #define PCI_EXP_LNKCTL2		48	/* Link Control 2 */
 #define  PCI_EXP_LNKCTL2_TLS		0x000f
@@ -XXX,XX +XXX,XX @@
 #define  PCI_EXP_LNKCTL2_TLS_5_0GT	0x0002 /* Supported Speed 5GT/s */
 #define  PCI_EXP_LNKCTL2_TLS_8_0GT	0x0003 /* Supported Speed 8GT/s */
 #define  PCI_EXP_LNKCTL2_TLS_16_0GT	0x0004 /* Supported Speed 16GT/s */
+#define  PCI_EXP_LNKCTL2_TLS_32_0GT	0x0005 /* Supported Speed 32GT/s */
 #define PCI_EXP_LNKSTA2		50	/* Link Status 2 */
 #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2	52	/* v2 endpoints with link end here */
 #define PCI_EXP_SLTCAP2		52	/* Slot Capabilities 2 */
@@ -XXX,XX +XXX,XX @@
 #define PCI_EXT_CAP_ID_DPC	0x1D	/* Downstream Port Containment */
 #define PCI_EXT_CAP_ID_L1SS	0x1E	/* L1 PM Substates */
 #define PCI_EXT_CAP_ID_PTM	0x1F	/* Precision Time Measurement */
-#define PCI_EXT_CAP_ID_MAX	PCI_EXT_CAP_ID_PTM
+#define PCI_EXT_CAP_ID_DLF	0x25	/* Data Link Feature */
+#define PCI_EXT_CAP_ID_PL_16GT	0x26	/* Physical Layer 16.0 GT/s */
+#define PCI_EXT_CAP_ID_MAX	PCI_EXT_CAP_ID_PL_16GT
 
 #define PCI_EXT_CAP_DSN_SIZEOF	12
 #define PCI_EXT_CAP_MCAST_ENDPOINT_SIZEOF 40
@@ -XXX,XX +XXX,XX @@
 #define  PCI_L1SS_CTL1_LTR_L12_TH_SCALE	0xe0000000  /* LTR_L1.2_THRESHOLD_Scale */
 #define PCI_L1SS_CTL2		0x0c	/* Control 2 Register */
 
+/* Data Link Feature */
+#define PCI_DLF_CAP		0x04	/* Capabilities Register */
+#define  PCI_DLF_EXCHANGE_ENABLE	0x80000000  /* Data Link Feature Exchange Enable */
+
+/* Physical Layer 16.0 GT/s */
+#define PCI_PL_16GT_LE_CTRL	0x20	/* Lane Equalization Control Register */
+#define  PCI_PL_16GT_LE_CTRL_DSP_TX_PRESET_MASK		0x0000000F
+#define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_MASK		0x000000F0
+#define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_SHIFT	4
+
 #endif /* LINUX_PCI_REGS_H */
diff --git a/include/standard-headers/linux/virtio_fs.h b/include/standard-headers/linux/virtio_fs.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/standard-headers/linux/virtio_fs.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+
+#ifndef _LINUX_VIRTIO_FS_H
+#define _LINUX_VIRTIO_FS_H
+
+#include "standard-headers/linux/types.h"
+#include "standard-headers/linux/virtio_ids.h"
+#include "standard-headers/linux/virtio_config.h"
+#include "standard-headers/linux/virtio_types.h"
+
+struct virtio_fs_config {
+	/* Filesystem name (UTF-8, not NUL-terminated, padded with NULs) */
+	uint8_t tag[36];
+
+	/* Number of request queues */
+	uint32_t num_request_queues;
+} QEMU_PACKED;
+
+#endif /* _LINUX_VIRTIO_FS_H */
diff --git a/include/standard-headers/linux/virtio_ids.h b/include/standard-headers/linux/virtio_ids.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_ids.h
+++ b/include/standard-headers/linux/virtio_ids.h
@@ -XXX,XX +XXX,XX @@
 #define VIRTIO_ID_INPUT        18 /* virtio input */
 #define VIRTIO_ID_VSOCK        19 /* virtio vsock transport */
 #define VIRTIO_ID_CRYPTO       20 /* virtio crypto */
+#define VIRTIO_ID_IOMMU        23 /* virtio IOMMU */
+#define VIRTIO_ID_FS           26 /* virtio filesystem */
 #define VIRTIO_ID_PMEM         27 /* virtio pmem */
 
 #endif /* _LINUX_VIRTIO_IDS_H */
diff --git a/include/standard-headers/linux/virtio_iommu.h b/include/standard-headers/linux/virtio_iommu.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/standard-headers/linux/virtio_iommu.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+/*
+ * Virtio-iommu definition v0.12
+ *
+ * Copyright (C) 2019 Arm Ltd.
+ */
+#ifndef _LINUX_VIRTIO_IOMMU_H
+#define _LINUX_VIRTIO_IOMMU_H
+
+#include "standard-headers/linux/types.h"
+
+/* Feature bits */
+#define VIRTIO_IOMMU_F_INPUT_RANGE		0
+#define VIRTIO_IOMMU_F_DOMAIN_RANGE		1
+#define VIRTIO_IOMMU_F_MAP_UNMAP		2
+#define VIRTIO_IOMMU_F_BYPASS			3
+#define VIRTIO_IOMMU_F_PROBE			4
+#define VIRTIO_IOMMU_F_MMIO			5
+
+struct virtio_iommu_range_64 {
+	uint64_t					start;
+	uint64_t					end;
+};
+
+struct virtio_iommu_range_32 {
+	uint32_t					start;
+	uint32_t					end;
+};
+
+struct virtio_iommu_config {
+	/* Supported page sizes */
+	uint64_t					page_size_mask;
+	/* Supported IOVA range */
+	struct virtio_iommu_range_64		input_range;
+	/* Max domain ID size */
+	struct virtio_iommu_range_32		domain_range;
+	/* Probe buffer size */
+	uint32_t					probe_size;
+};
+
+/* Request types */
+#define VIRTIO_IOMMU_T_ATTACH			0x01
+#define VIRTIO_IOMMU_T_DETACH			0x02
+#define VIRTIO_IOMMU_T_MAP			0x03
+#define VIRTIO_IOMMU_T_UNMAP			0x04
+#define VIRTIO_IOMMU_T_PROBE			0x05
+
+/* Status types */
+#define VIRTIO_IOMMU_S_OK			0x00
+#define VIRTIO_IOMMU_S_IOERR			0x01
+#define VIRTIO_IOMMU_S_UNSUPP			0x02
+#define VIRTIO_IOMMU_S_DEVERR			0x03
+#define VIRTIO_IOMMU_S_INVAL			0x04
+#define VIRTIO_IOMMU_S_RANGE			0x05
+#define VIRTIO_IOMMU_S_NOENT			0x06
+#define VIRTIO_IOMMU_S_FAULT			0x07
+#define VIRTIO_IOMMU_S_NOMEM			0x08
+
+struct virtio_iommu_req_head {
+	uint8_t					type;
+	uint8_t					reserved[3];
+};
+
+struct virtio_iommu_req_tail {
+	uint8_t					status;
+	uint8_t					reserved[3];
+};
+
+struct virtio_iommu_req_attach {
+	struct virtio_iommu_req_head		head;
+	uint32_t					domain;
+	uint32_t					endpoint;
+	uint8_t					reserved[8];
+	struct virtio_iommu_req_tail		tail;
+};
+
+struct virtio_iommu_req_detach {
+	struct virtio_iommu_req_head		head;
+	uint32_t					domain;
+	uint32_t					endpoint;
+	uint8_t					reserved[8];
+	struct virtio_iommu_req_tail		tail;
+};
+
+#define VIRTIO_IOMMU_MAP_F_READ			(1 << 0)
+#define VIRTIO_IOMMU_MAP_F_WRITE		(1 << 1)
+#define VIRTIO_IOMMU_MAP_F_MMIO			(1 << 2)
+
+#define VIRTIO_IOMMU_MAP_F_MASK			(VIRTIO_IOMMU_MAP_F_READ |	\
+						 VIRTIO_IOMMU_MAP_F_WRITE |	\
+						 VIRTIO_IOMMU_MAP_F_MMIO)
+
+struct virtio_iommu_req_map {
+	struct virtio_iommu_req_head		head;
+	uint32_t					domain;
+	uint64_t					virt_start;
+	uint64_t					virt_end;
+	uint64_t					phys_start;
+	uint32_t					flags;
+	struct virtio_iommu_req_tail		tail;
+};
+
+struct virtio_iommu_req_unmap {
+	struct virtio_iommu_req_head		head;
+	uint32_t					domain;
+	uint64_t					virt_start;
+	uint64_t					virt_end;
+	uint8_t					reserved[4];
+	struct virtio_iommu_req_tail		tail;
+};
+
+#define VIRTIO_IOMMU_PROBE_T_NONE		0
+#define VIRTIO_IOMMU_PROBE_T_RESV_MEM		1
+
+#define VIRTIO_IOMMU_PROBE_T_MASK		0xfff
+
+struct virtio_iommu_probe_property {
+	uint16_t					type;
+	uint16_t					length;
+};
+
+#define VIRTIO_IOMMU_RESV_MEM_T_RESERVED	0
+#define VIRTIO_IOMMU_RESV_MEM_T_MSI		1
+
+struct virtio_iommu_probe_resv_mem {
+	struct virtio_iommu_probe_property	head;
+	uint8_t					subtype;
+	uint8_t					reserved[3];
+	uint64_t					start;
+	uint64_t					end;
+};
+
+struct virtio_iommu_req_probe {
+	struct virtio_iommu_req_head		head;
+	uint32_t					endpoint;
+	uint8_t					reserved[64];
+
+	uint8_t					properties[];
+
+	/*
+	 * Tail follows the variable-length properties array. No padding,
+	 * property lengths are all aligned on 8 bytes.
+	 */
+};
+
+/* Fault types */
+#define VIRTIO_IOMMU_FAULT_R_UNKNOWN		0
+#define VIRTIO_IOMMU_FAULT_R_DOMAIN		1
+#define VIRTIO_IOMMU_FAULT_R_MAPPING		2
+
+#define VIRTIO_IOMMU_FAULT_F_READ		(1 << 0)
+#define VIRTIO_IOMMU_FAULT_F_WRITE		(1 << 1)
+#define VIRTIO_IOMMU_FAULT_F_EXEC		(1 << 2)
+#define VIRTIO_IOMMU_FAULT_F_ADDRESS		(1 << 8)
+
+struct virtio_iommu_fault {
+	uint8_t					reason;
+	uint8_t					reserved[3];
+	uint32_t					flags;
+	uint32_t					endpoint;
+	uint8_t					reserved2[4];
+	uint64_t					address;
+};
+
+#endif
diff --git a/include/standard-headers/linux/virtio_pmem.h b/include/standard-headers/linux/virtio_pmem.h
index XXXXXXX..XXXXXXX 100644
--- a/include/standard-headers/linux/virtio_pmem.h
+++ b/include/standard-headers/linux/virtio_pmem.h
@@ -XXX,XX +XXX,XX @@
-/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
+/* SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause */
 /*
  * Definitions for virtio-pmem devices.
  *
@@ -XXX,XX +XXX,XX @@
  * Author(s): Pankaj Gupta <pagupta@redhat.com>
  */
 
-#ifndef _UAPI_LINUX_VIRTIO_PMEM_H
-#define _UAPI_LINUX_VIRTIO_PMEM_H
+#ifndef _LINUX_VIRTIO_PMEM_H
+#define _LINUX_VIRTIO_PMEM_H
 
 #include "standard-headers/linux/types.h"
 #include "standard-headers/linux/virtio_ids.h"
diff --git a/linux-headers/asm-arm/kvm.h b/linux-headers/asm-arm/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-arm/kvm.h
+++ b/linux-headers/asm-arm/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_vcpu_events {
 #define KVM_REG_ARM_FW_REG(r)		(KVM_REG_ARM | KVM_REG_SIZE_U64 | \
 					 KVM_REG_ARM_FW | ((r) & 0xffff))
 #define KVM_REG_ARM_PSCI_VERSION	KVM_REG_ARM_FW_REG(0)
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1	KVM_REG_ARM_FW_REG(1)
+	/* Higher values mean better protection. */
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL		0
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL		1
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_REQUIRED	2
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2	KVM_REG_ARM_FW_REG(2)
+	/* Higher values mean better protection. */
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL		0
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN		1
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL		2
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED	3
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED	(1U << 4)
 
 /* Device Control API: ARM VGIC */
 #define KVM_DEV_ARM_VGIC_GRP_ADDR	0
@@ -XXX,XX +XXX,XX @@ struct kvm_vcpu_events {
 #define   KVM_DEV_ARM_ITS_CTRL_RESET		4
 
 /* KVM_IRQ_LINE irq field index values */
+#define KVM_ARM_IRQ_VCPU2_SHIFT		28
+#define KVM_ARM_IRQ_VCPU2_MASK		0xf
 #define KVM_ARM_IRQ_TYPE_SHIFT		24
-#define KVM_ARM_IRQ_TYPE_MASK		0xff
+#define KVM_ARM_IRQ_TYPE_MASK		0xf
 #define KVM_ARM_IRQ_VCPU_SHIFT		16
 #define KVM_ARM_IRQ_VCPU_MASK		0xff
 #define KVM_ARM_IRQ_NUM_SHIFT		0
diff --git a/linux-headers/asm-arm/unistd-common.h b/linux-headers/asm-arm/unistd-common.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-arm/unistd-common.h
+++ b/linux-headers/asm-arm/unistd-common.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_fsconfig (__NR_SYSCALL_BASE + 431)
 #define __NR_fsmount (__NR_SYSCALL_BASE + 432)
 #define __NR_fspick (__NR_SYSCALL_BASE + 433)
+#define __NR_pidfd_open (__NR_SYSCALL_BASE + 434)
+#define __NR_clone3 (__NR_SYSCALL_BASE + 435)
 
 #endif /* _ASM_ARM_UNISTD_COMMON_H */
diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-arm64/kvm.h
+++ b/linux-headers/asm-arm64/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_vcpu_events {
 #define KVM_REG_ARM_FW_REG(r)		(KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
 					 KVM_REG_ARM_FW | ((r) & 0xffff))
 #define KVM_REG_ARM_PSCI_VERSION	KVM_REG_ARM_FW_REG(0)
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1	KVM_REG_ARM_FW_REG(1)
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_AVAIL		0
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_AVAIL		1
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1_NOT_REQUIRED	2
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2	KVM_REG_ARM_FW_REG(2)
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_AVAIL		0
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN		1
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_AVAIL		2
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED	3
+#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED     	(1U << 4)
 
 /* SVE registers */
 #define KVM_REG_ARM64_SVE		(0x15 << KVM_REG_ARM_COPROC_SHIFT)
@@ -XXX,XX +XXX,XX @@ struct kvm_vcpu_events {
 	 KVM_REG_SIZE_U256 |						\
 	 ((i) & (KVM_ARM64_SVE_MAX_SLICES - 1)))
 
+/*
+ * Register values for KVM_REG_ARM64_SVE_ZREG(), KVM_REG_ARM64_SVE_PREG() and
+ * KVM_REG_ARM64_SVE_FFR() are represented in memory in an endianness-
+ * invariant layout which differs from the layout used for the FPSIMD
+ * V-registers on big-endian systems: see sigcontext.h for more explanation.
+ */
+
 #define KVM_ARM64_SVE_VQ_MIN __SVE_VQ_MIN
 #define KVM_ARM64_SVE_VQ_MAX __SVE_VQ_MAX
 
@@ -XXX,XX +XXX,XX @@ struct kvm_vcpu_events {
 #define   KVM_ARM_VCPU_TIMER_IRQ_PTIMER		1
 
 /* KVM_IRQ_LINE irq field index values */
+#define KVM_ARM_IRQ_VCPU2_SHIFT		28
+#define KVM_ARM_IRQ_VCPU2_MASK		0xf
 #define KVM_ARM_IRQ_TYPE_SHIFT		24
-#define KVM_ARM_IRQ_TYPE_MASK		0xff
+#define KVM_ARM_IRQ_TYPE_MASK		0xf
 #define KVM_ARM_IRQ_VCPU_SHIFT		16
 #define KVM_ARM_IRQ_VCPU_MASK		0xff
 #define KVM_ARM_IRQ_NUM_SHIFT		0
diff --git a/linux-headers/asm-generic/mman-common.h b/linux-headers/asm-generic/mman-common.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-generic/mman-common.h
+++ b/linux-headers/asm-generic/mman-common.h
@@ -XXX,XX +XXX,XX @@
 #define MAP_TYPE	0x0f		/* Mask for type of mapping */
 #define MAP_FIXED	0x10		/* Interpret addr exactly */
 #define MAP_ANONYMOUS	0x20		/* don't use a file */
-#ifdef CONFIG_MMAP_ALLOW_UNINITIALIZED
-# define MAP_UNINITIALIZED 0x4000000	/* For anonymous mmap, memory could be uninitialized */
-#else
-# define MAP_UNINITIALIZED 0x0		/* Don't support this flag */
-#endif
 
-/* 0x0100 - 0x80000 flags are defined in asm-generic/mman.h */
+/* 0x0100 - 0x4000 flags are defined in asm-generic/mman.h */
+#define MAP_POPULATE		0x008000	/* populate (prefault) pagetables */
+#define MAP_NONBLOCK		0x010000	/* do not block on IO */
+#define MAP_STACK		0x020000	/* give out an address that is best suited for process/thread stacks */
+#define MAP_HUGETLB		0x040000	/* create a huge page mapping */
+#define MAP_SYNC		0x080000 /* perform synchronous page faults for the mapping */
 #define MAP_FIXED_NOREPLACE	0x100000	/* MAP_FIXED which doesn't unmap underlying mapping */
 
+#define MAP_UNINITIALIZED 0x4000000	/* For anonymous mmap, memory could be
+					 * uninitialized */
+
 /*
  * Flags for mlock
  */
@@ -XXX,XX +XXX,XX @@
 #define MADV_WIPEONFORK 18		/* Zero memory on fork, child only */
 #define MADV_KEEPONFORK 19		/* Undo MADV_WIPEONFORK */
 
+#define MADV_COLD	20		/* deactivate these pages */
+#define MADV_PAGEOUT	21		/* reclaim these pages */
+
 /* compatibility flags */
 #define MAP_FILE	0
 
diff --git a/linux-headers/asm-generic/mman.h b/linux-headers/asm-generic/mman.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-generic/mman.h
+++ b/linux-headers/asm-generic/mman.h
@@ -XXX,XX +XXX,XX @@
 #define MAP_EXECUTABLE	0x1000		/* mark it as an executable */
 #define MAP_LOCKED	0x2000		/* pages are locked */
 #define MAP_NORESERVE	0x4000		/* don't check for reservations */
-#define MAP_POPULATE	0x8000		/* populate (prefault) pagetables */
-#define MAP_NONBLOCK	0x10000		/* do not block on IO */
-#define MAP_STACK	0x20000		/* give out an address that is best suited for process/thread stacks */
-#define MAP_HUGETLB	0x40000		/* create a huge page mapping */
-#define MAP_SYNC	0x80000		/* perform synchronous page faults for the mapping */
 
-/* Bits [26:31] are reserved, see mman-common.h for MAP_HUGETLB usage */
+/*
+ * Bits [26:31] are reserved, see asm-generic/hugetlb_encode.h
+ * for MAP_HUGETLB usage
+ */
 
 #define MCL_CURRENT	1		/* lock all current mappings */
 #define MCL_FUTURE	2		/* lock all future mappings */
diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-generic/unistd.h
+++ b/linux-headers/asm-generic/unistd.h
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_semget, sys_semget)
 __SC_COMP(__NR_semctl, sys_semctl, compat_sys_semctl)
 #if defined(__ARCH_WANT_TIME32_SYSCALLS) || __BITS_PER_LONG != 32
 #define __NR_semtimedop 192
-__SC_COMP(__NR_semtimedop, sys_semtimedop, sys_semtimedop_time32)
+__SC_3264(__NR_semtimedop, sys_semtimedop_time32, sys_semtimedop)
 #endif
 #define __NR_semop 193
 __SYSCALL(__NR_semop, sys_semop)
@@ -XXX,XX +XXX,XX @@ __SYSCALL(__NR_fsconfig, sys_fsconfig)
 __SYSCALL(__NR_fsmount, sys_fsmount)
 #define __NR_fspick 433
 __SYSCALL(__NR_fspick, sys_fspick)
+#define __NR_pidfd_open 434
+__SYSCALL(__NR_pidfd_open, sys_pidfd_open)
+#ifdef __ARCH_WANT_SYS_CLONE3
+#define __NR_clone3 435
+__SYSCALL(__NR_clone3, sys_clone3)
+#endif
 
 #undef __NR_syscalls
-#define __NR_syscalls 434
+#define __NR_syscalls 436
 
 /*
  * 32 bit systems traditionally used different
diff --git a/linux-headers/asm-mips/mman.h b/linux-headers/asm-mips/mman.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/mman.h
+++ b/linux-headers/asm-mips/mman.h
@@ -XXX,XX +XXX,XX @@
 #define MADV_WIPEONFORK 18		/* Zero memory on fork, child only */
 #define MADV_KEEPONFORK 19		/* Undo MADV_WIPEONFORK */
 
+#define MADV_COLD	20		/* deactivate these pages */
+#define MADV_PAGEOUT	21		/* reclaim these pages */
+
 /* compatibility flags */
 #define MAP_FILE	0
 
diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_n32.h
+++ b/linux-headers/asm-mips/unistd_n32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_fsconfig	(__NR_Linux + 431)
 #define __NR_fsmount	(__NR_Linux + 432)
 #define __NR_fspick	(__NR_Linux + 433)
+#define __NR_pidfd_open	(__NR_Linux + 434)
 
 
 #endif /* _ASM_MIPS_UNISTD_N32_H */
diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_n64.h
+++ b/linux-headers/asm-mips/unistd_n64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_fsconfig	(__NR_Linux + 431)
 #define __NR_fsmount	(__NR_Linux + 432)
 #define __NR_fspick	(__NR_Linux + 433)
+#define __NR_pidfd_open	(__NR_Linux + 434)
 
 
 #endif /* _ASM_MIPS_UNISTD_N64_H */
diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-mips/unistd_o32.h
+++ b/linux-headers/asm-mips/unistd_o32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_fsconfig	(__NR_Linux + 431)
 #define __NR_fsmount	(__NR_Linux + 432)
 #define __NR_fspick	(__NR_Linux + 433)
+#define __NR_pidfd_open	(__NR_Linux + 434)
 
 
 #endif /* _ASM_MIPS_UNISTD_O32_H */
diff --git a/linux-headers/asm-powerpc/mman.h b/linux-headers/asm-powerpc/mman.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-powerpc/mman.h
+++ b/linux-headers/asm-powerpc/mman.h
@@ -XXX,XX +XXX,XX @@
 #define MAP_DENYWRITE	0x0800		/* ETXTBSY */
 #define MAP_EXECUTABLE	0x1000		/* mark it as an executable */
 
+
 #define MCL_CURRENT     0x2000          /* lock all currently mapped pages */
 #define MCL_FUTURE      0x4000          /* lock all additions to address space */
 #define MCL_ONFAULT	0x8000		/* lock all pages that are faulted in */
 
-#define MAP_POPULATE	0x8000		/* populate (prefault) pagetables */
-#define MAP_NONBLOCK	0x10000		/* do not block on IO */
-#define MAP_STACK	0x20000		/* give out an address that is best suited for process/thread stacks */
-#define MAP_HUGETLB	0x40000		/* create a huge page mapping */
-
 /* Override any generic PKEY permission defines */
 #define PKEY_DISABLE_EXECUTE   0x4
 #undef PKEY_ACCESS_MASK
diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-powerpc/unistd_32.h
+++ b/linux-headers/asm-powerpc/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_fsconfig	431
 #define __NR_fsmount	432
 #define __NR_fspick	433
+#define __NR_pidfd_open	434
+#define __NR_clone3	435
 
 
 #endif /* _ASM_POWERPC_UNISTD_32_H */
diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-powerpc/unistd_64.h
+++ b/linux-headers/asm-powerpc/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_fsconfig	431
 #define __NR_fsmount	432
 #define __NR_fspick	433
+#define __NR_pidfd_open	434
+#define __NR_clone3	435
 
 
 #endif /* _ASM_POWERPC_UNISTD_64_H */
diff --git a/linux-headers/asm-s390/kvm.h b/linux-headers/asm-s390/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-s390/kvm.h
+++ b/linux-headers/asm-s390/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_guest_debug_arch {
 #define KVM_SYNC_GSCB   (1UL << 9)
 #define KVM_SYNC_BPBC   (1UL << 10)
 #define KVM_SYNC_ETOKEN (1UL << 11)
+
+#define KVM_SYNC_S390_VALID_FIELDS \
+	(KVM_SYNC_PREFIX | KVM_SYNC_GPRS | KVM_SYNC_ACRS | KVM_SYNC_CRS | \
+	 KVM_SYNC_ARCH0 | KVM_SYNC_PFAULT | KVM_SYNC_VRS | KVM_SYNC_RICCB | \
+	 KVM_SYNC_FPRS | KVM_SYNC_GSCB | KVM_SYNC_BPBC | KVM_SYNC_ETOKEN)
+
 /* length and alignment of the sdnx as a power of two */
 #define SDNXC 8
 #define SDNXL (1UL << SDNXC)
diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-s390/unistd_32.h
+++ b/linux-headers/asm-s390/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_fsconfig 431
 #define __NR_fsmount 432
 #define __NR_fspick 433
+#define __NR_pidfd_open 434
+#define __NR_clone3 435
 
 #endif /* _ASM_S390_UNISTD_32_H */
diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-s390/unistd_64.h
+++ b/linux-headers/asm-s390/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_fsconfig 431
 #define __NR_fsmount 432
 #define __NR_fspick 433
+#define __NR_pidfd_open 434
+#define __NR_clone3 435
 
 #endif /* _ASM_S390_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/kvm.h
+++ b/linux-headers/asm-x86/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_sync_regs {
 	struct kvm_vcpu_events events;
 };
 
-#define KVM_X86_QUIRK_LINT0_REENABLED	(1 << 0)
-#define KVM_X86_QUIRK_CD_NW_CLEARED	(1 << 1)
-#define KVM_X86_QUIRK_LAPIC_MMIO_HOLE	(1 << 2)
-#define KVM_X86_QUIRK_OUT_7E_INC_RIP	(1 << 3)
+#define KVM_X86_QUIRK_LINT0_REENABLED	   (1 << 0)
+#define KVM_X86_QUIRK_CD_NW_CLEARED	   (1 << 1)
+#define KVM_X86_QUIRK_LAPIC_MMIO_HOLE	   (1 << 2)
+#define KVM_X86_QUIRK_OUT_7E_INC_RIP	   (1 << 3)
+#define KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT (1 << 4)
 
 #define KVM_STATE_NESTED_FORMAT_VMX	0
-#define KVM_STATE_NESTED_FORMAT_SVM	1
+#define KVM_STATE_NESTED_FORMAT_SVM	1	/* unused */
 
 #define KVM_STATE_NESTED_GUEST_MODE	0x00000001
 #define KVM_STATE_NESTED_RUN_PENDING	0x00000002
 #define KVM_STATE_NESTED_EVMCS		0x00000004
 
-#define KVM_STATE_NESTED_VMX_VMCS_SIZE	0x1000
-
 #define KVM_STATE_NESTED_SMM_GUEST_MODE	0x00000001
 #define KVM_STATE_NESTED_SMM_VMXON	0x00000002
 
+#define KVM_STATE_NESTED_VMX_VMCS_SIZE	0x1000
+
 struct kvm_vmx_nested_state_data {
 	__u8 vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
 	__u8 shadow_vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
@@ -XXX,XX +XXX,XX @@ struct kvm_nested_state {
 	} data;
 };
 
+/* for KVM_CAP_PMU_EVENT_FILTER */
+struct kvm_pmu_event_filter {
+	__u32 action;
+	__u32 nevents;
+	__u32 fixed_counter_bitmap;
+	__u32 flags;
+	__u32 pad[4];
+	__u64 events[0];
+};
+
+#define KVM_PMU_EVENT_ALLOW 0
+#define KVM_PMU_EVENT_DENY 1
+
 #endif /* _ASM_X86_KVM_H */
diff --git a/linux-headers/asm-x86/unistd.h b/linux-headers/asm-x86/unistd.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd.h
+++ b/linux-headers/asm-x86/unistd.h
@@ -XXX,XX +XXX,XX @@
 #define _ASM_X86_UNISTD_H
 
 /* x32 syscall flag bit */
-#define __X32_SYSCALL_BIT	0x40000000
+#define __X32_SYSCALL_BIT	0x40000000UL
 
 # ifdef __i386__
 #  include <asm/unistd_32.h>
diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_32.h
+++ b/linux-headers/asm-x86/unistd_32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_fsconfig 431
 #define __NR_fsmount 432
 #define __NR_fspick 433
+#define __NR_pidfd_open 434
+#define __NR_clone3 435
 
 #endif /* _ASM_X86_UNISTD_32_H */
diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_64.h
+++ b/linux-headers/asm-x86/unistd_64.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_fsconfig 431
 #define __NR_fsmount 432
 #define __NR_fspick 433
+#define __NR_pidfd_open 434
+#define __NR_clone3 435
 
 #endif /* _ASM_X86_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/asm-x86/unistd_x32.h
+++ b/linux-headers/asm-x86/unistd_x32.h
@@ -XXX,XX +XXX,XX @@
 #define __NR_fsconfig (__X32_SYSCALL_BIT + 431)
 #define __NR_fsmount (__X32_SYSCALL_BIT + 432)
 #define __NR_fspick (__X32_SYSCALL_BIT + 433)
+#define __NR_pidfd_open (__X32_SYSCALL_BIT + 434)
+#define __NR_clone3 (__X32_SYSCALL_BIT + 435)
 #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
 #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
 #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_irq_level {
 	 * ACPI gsi notion of irq.
 	 * For IA-64 (APIC model) IOAPIC0: irq 0-23; IOAPIC1: irq 24-47..
 	 * For X86 (standard AT mode) PIC0/1: irq 0-15. IOAPIC0: 0-23..
-	 * For ARM: See Documentation/virtual/kvm/api.txt
+	 * For ARM: See Documentation/virt/kvm/api.txt
 	 */
 	union {
 		__u32 irq;
@@ -XXX,XX +XXX,XX @@ struct kvm_hyperv_exit {
 #define KVM_INTERNAL_ERROR_SIMUL_EX	2
 /* Encounter unexpected vm-exit due to delivery event. */
 #define KVM_INTERNAL_ERROR_DELIVERY_EV	3
+/* Encounter unexpected vm-exit reason */
+#define KVM_INTERNAL_ERROR_UNEXPECTED_EXIT_REASON	4
 
 /* for KVM_RUN, returned by mmap(vcpu_fd, offset=0) */
 struct kvm_run {
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_ARM_SVE 170
 #define KVM_CAP_ARM_PTRAUTH_ADDRESS 171
 #define KVM_CAP_ARM_PTRAUTH_GENERIC 172
+#define KVM_CAP_PMU_EVENT_FILTER 173
+#define KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 174
+#define KVM_CAP_HYPERV_DIRECT_TLBFLUSH 175
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
@@ -XXX,XX +XXX,XX @@ struct kvm_xen_hvm_config {
  *
  * KVM_IRQFD_FLAG_RESAMPLE indicates resamplefd is valid and specifies
  * the irqfd to operate in resampling mode for level triggered interrupt
- * emulation.  See Documentation/virtual/kvm/api.txt.
+ * emulation.  See Documentation/virt/kvm/api.txt.
  */
 #define KVM_IRQFD_FLAG_RESAMPLE (1 << 1)
 
@@ -XXX,XX +XXX,XX @@ struct kvm_dirty_tlb {
 #define KVM_REG_S390		0x5000000000000000ULL
 #define KVM_REG_ARM64		0x6000000000000000ULL
 #define KVM_REG_MIPS		0x7000000000000000ULL
+#define KVM_REG_RISCV		0x8000000000000000ULL
 
 #define KVM_REG_SIZE_SHIFT	52
 #define KVM_REG_SIZE_MASK	0x00f0000000000000ULL
@@ -XXX,XX +XXX,XX @@ struct kvm_s390_ucas_mapping {
 #define KVM_PPC_GET_RMMU_INFO	  _IOW(KVMIO,  0xb0, struct kvm_ppc_rmmu_info)
 /* Available with KVM_CAP_PPC_GET_CPU_CHAR */
 #define KVM_PPC_GET_CPU_CHAR	  _IOR(KVMIO,  0xb1, struct kvm_ppc_cpu_char)
+/* Available with KVM_CAP_PMU_EVENT_FILTER */
+#define KVM_SET_PMU_EVENT_FILTER  _IOW(KVMIO,  0xb2, struct kvm_pmu_event_filter)
 
 /* ioctl for vm fd */
 #define KVM_CREATE_DEVICE	  _IOWR(KVMIO,  0xe0, struct kvm_create_device)
diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/psp-sev.h
+++ b/linux-headers/linux/psp-sev.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
 /*
  * Userspace interface for AMD Secure Encrypted Virtualization (SEV)
  * platform management commands.
@@ -XXX,XX +XXX,XX @@
  * Author: Brijesh Singh <brijesh.singh@amd.com>
  *
  * SEV API specification is available at: https://developer.amd.com/sev/
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
  */
 
 #ifndef __PSP_SEV_USER_H__
diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/vfio.h
+++ b/linux-headers/linux/vfio.h
@@ -XXX,XX +XXX,XX @@ struct vfio_region_info_cap_type {
 	__u32 subtype;	/* type specific */
 };
 
+/*
+ * List of region types, global per bus driver.
+ * If you introduce a new type, please add it here.
+ */
+
+/* PCI region type containing a PCI vendor part */
 #define VFIO_REGION_TYPE_PCI_VENDOR_TYPE	(1 << 31)
 #define VFIO_REGION_TYPE_PCI_VENDOR_MASK	(0xffff)
+#define VFIO_REGION_TYPE_GFX                    (1)
+#define VFIO_REGION_TYPE_CCW			(2)
 
-/* 8086 Vendor sub-types */
+/* sub-types for VFIO_REGION_TYPE_PCI_* */
+
+/* 8086 vendor PCI sub-types */
 #define VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION	(1)
 #define VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG	(2)
 #define VFIO_REGION_SUBTYPE_INTEL_IGD_LPC_CFG	(3)
 
-#define VFIO_REGION_TYPE_GFX                    (1)
+/* 10de vendor PCI sub-types */
+/*
+ * NVIDIA GPU NVlink2 RAM is coherent RAM mapped onto the host address space.
+ */
+#define VFIO_REGION_SUBTYPE_NVIDIA_NVLINK2_RAM	(1)
+
+/* 1014 vendor PCI sub-types */
+/*
+ * IBM NPU NVlink2 ATSD (Address Translation Shootdown) register of NPU
+ * to do TLB invalidation on a GPU.
+ */
+#define VFIO_REGION_SUBTYPE_IBM_NVLINK2_ATSD	(1)
+
+/* sub-types for VFIO_REGION_TYPE_GFX */
 #define VFIO_REGION_SUBTYPE_GFX_EDID            (1)
 
 /**
@@ -XXX,XX +XXX,XX @@ struct vfio_region_gfx_edid {
 #define VFIO_DEVICE_GFX_LINK_STATE_DOWN  2
 };
 
-#define VFIO_REGION_TYPE_CCW			(2)
-/* ccw sub-types */
+/* sub-types for VFIO_REGION_TYPE_CCW */
 #define VFIO_REGION_SUBTYPE_CCW_ASYNC_CMD	(1)
 
-/*
- * 10de vendor sub-type
- *
- * NVIDIA GPU NVlink2 RAM is coherent RAM mapped onto the host address space.
- */
-#define VFIO_REGION_SUBTYPE_NVIDIA_NVLINK2_RAM	(1)
-
-/*
- * 1014 vendor sub-type
- *
- * IBM NPU NVlink2 ATSD (Address Translation Shootdown) register of NPU
- * to do TLB invalidation on a GPU.
- */
-#define VFIO_REGION_SUBTYPE_IBM_NVLINK2_ATSD	(1)
-
 /*
  * The MSIX mappable capability informs that MSIX data of a BAR can be mmapped
  * which allows direct access to non-MSIX registers which happened to be within
@@ -XXX,XX +XXX,XX @@ struct vfio_iommu_type1_info {
 	__u32	argsz;
 	__u32	flags;
 #define VFIO_IOMMU_INFO_PGSIZES (1 << 0)	/* supported page sizes info */
-	__u64	iova_pgsizes;		/* Bitmap of supported page sizes */
+#define VFIO_IOMMU_INFO_CAPS	(1 << 1)	/* Info supports caps */
+	__u64	iova_pgsizes;	/* Bitmap of supported page sizes */
+	__u32   cap_offset;	/* Offset within info struct of first cap */
+};
+
+/*
+ * The IOVA capability allows to report the valid IOVA range(s)
+ * excluding any non-relaxable reserved regions exposed by
+ * devices attached to the container. Any DMA map attempt
+ * outside the valid iova range will return error.
+ *
+ * The structures below define version 1 of this capability.
+ */
+#define VFIO_IOMMU_TYPE1_INFO_CAP_IOVA_RANGE  1
+
+struct vfio_iova_range {
+	__u64	start;
+	__u64	end;
+};
+
+struct vfio_iommu_type1_info_cap_iova_range {
+	struct	vfio_info_cap_header header;
+	__u32	nr_iovas;
+	__u32	reserved;
+	struct	vfio_iova_range iova_ranges[];
 };
 
 #define VFIO_IOMMU_GET_INFO _IO(VFIO_TYPE, VFIO_BASE + 12)
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Host kernels that expose the KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 capability
allow injection of interrupts along with vcpu ids larger than 255.
Let's encode the vpcu id on 12 bits according to the upgraded KVM_IRQ_LINE
ABI when needed.

Given that we have two callsites that need to assemble
the value for kvm_set_irq(), a new helper routine, kvm_arm_set_irq
is introduced.

Without that patch qemu exits with "kvm_set_irq: Invalid argument"
message.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Zenghui Yu <yuzenghui@huawei.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Message-id: 20191003154640.22451-3-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h  |  1 +
 hw/intc/arm_gic_kvm.c |  7 ++-----
 target/arm/cpu.c      | 10 ++++------
 target/arm/kvm.c      | 12 ++++++++++++
 4 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void);
 
 void kvm_arm_pmu_set_irq(CPUState *cs, int irq);
 void kvm_arm_pmu_init(CPUState *cs);
+int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
 
 #else
 
diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic_kvm.c
+++ b/hw/intc/arm_gic_kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arm_gic_set_irq(uint32_t num_irq, int irq, int level)
      * has separate fields in the irq number for type,
      * CPU number and interrupt number.
      */
-    int kvm_irq, irqtype, cpu;
+    int irqtype, cpu;
 
     if (irq < (num_irq - GIC_INTERNAL)) {
         /* External interrupt. The kernel numbers these like the GIC
@@ -XXX,XX +XXX,XX @@ void kvm_arm_gic_set_irq(uint32_t num_irq, int irq, int level)
         cpu = irq / GIC_INTERNAL;
         irq %= GIC_INTERNAL;
     }
-    kvm_irq = (irqtype << KVM_ARM_IRQ_TYPE_SHIFT)
-        | (cpu << KVM_ARM_IRQ_VCPU_SHIFT) | irq;
-
-    kvm_set_irq(kvm_state, kvm_irq, !!level);
+    kvm_arm_set_irq(cpu, irqtype, irq, !!level);
 }
 
 static void kvm_arm_gicv2_set_irq(void *opaque, int irq, int level)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_kvm_set_irq(void *opaque, int irq, int level)
     ARMCPU *cpu = opaque;
     CPUARMState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
-    int kvm_irq = KVM_ARM_IRQ_TYPE_CPU << KVM_ARM_IRQ_TYPE_SHIFT;
     uint32_t linestate_bit;
+    int irq_id;
 
     switch (irq) {
     case ARM_CPU_IRQ:
-        kvm_irq |= KVM_ARM_IRQ_CPU_IRQ;
+        irq_id = KVM_ARM_IRQ_CPU_IRQ;
         linestate_bit = CPU_INTERRUPT_HARD;
         break;
     case ARM_CPU_FIQ:
-        kvm_irq |= KVM_ARM_IRQ_CPU_FIQ;
+        irq_id = KVM_ARM_IRQ_CPU_FIQ;
         linestate_bit = CPU_INTERRUPT_FIQ;
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_kvm_set_irq(void *opaque, int irq, int level)
     } else {
         env->irq_line_state &= ~linestate_bit;
     }
-
-    kvm_irq |= cs->cpu_index << KVM_ARM_IRQ_VCPU_SHIFT;
-    kvm_set_irq(kvm_state, kvm_irq, level ? 1 : 0);
+    kvm_arm_set_irq(cs->cpu_index, KVM_ARM_IRQ_TYPE_CPU, irq_id, !!level);
 #endif
 }
 
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void)
     }
 }
 
+int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level)
+{
+    int kvm_irq = (irqtype << KVM_ARM_IRQ_TYPE_SHIFT) | irq;
+    int cpu_idx1 = cpu % 256;
+    int cpu_idx2 = cpu / 256;
+
+    kvm_irq |= (cpu_idx1 << KVM_ARM_IRQ_VCPU_SHIFT) |
+               (cpu_idx2 << KVM_ARM_IRQ_VCPU2_SHIFT);
+
+    return kvm_set_irq(kvm_state, kvm_irq, !!level);
+}
+
 int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
                              uint64_t address, uint32_t data, PCIDevice *dev)
 {
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Host kernel within [4.18, 5.3] report an erroneous KVM_MAX_VCPUS=512
for ARM. The actual capability to instantiate more than 256 vcpus
was fixed in 5.4 with the upgrade of the KVM_IRQ_LINE ABI to support
vcpu id encoded on 12 bits instead of 8 and a redistributor consuming
a single KVM IO device instead of 2.

So let's check this capability when attempting to use more than 256
vcpus within any ARM kvm accelerated machine.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Message-id: 20191003154640.22451-4-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
 
 int kvm_arch_init(MachineState *ms, KVMState *s)
 {
+    int ret = 0;
     /* For ARM interrupt delivery is always asynchronous,
      * whether we are using an in-kernel VGIC or not.
      */
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
 
     cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
 
-    return 0;
+    if (ms->smp.cpus > 256 &&
+        !kvm_check_extension(s, KVM_CAP_ARM_IRQ_LINE_LAYOUT_2)) {
+        error_report("Using more than 256 vcpus requires a host kernel "
+                     "with KVM_CAP_ARM_IRQ_LINE_LAYOUT_2");
+        ret = -EINVAL;
+    }
+
+    return ret;
 }
 
 unsigned long kvm_arch_vcpu_id(CPUState *cpu)
-- 
2.20.1

Currently the ptimer design uses a QEMU bottom-half as its
mechanism for calling back into the device model using the
ptimer when the timer has expired. Unfortunately this design
is fatally flawed, because it means that there is a lag
between the ptimer updating its own state and the device
callback function updating device state, and guest accesses
to device registers between the two can return inconsistent
device state.

We want to replace the bottom-half design with one where
the guest device's callback is called either immediately
(when the ptimer triggers by timeout) or when the device
model code closes a transaction-begin/end section (when the
ptimer triggers because the device model changed the
ptimer's count value or other state). As the first step,
rename ptimer_init() to ptimer_init_with_bh(), to free up
the ptimer_init() name for the new API. We can then convert
all the ptimer users away from ptimer_init_with_bh() before
removing it entirely.

(Commit created with
 git grep -l ptimer_init | xargs sed -i -e 's/ptimer_init/ptimer_init_with_bh/'
and three overlong lines folded by hand.)

diff --git a/include/hw/ptimer.h b/include/hw/ptimer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ptimer.h
+++ b/include/hw/ptimer.h
@@ -XXX,XX +XXX,XX @@
  * ptimer_set_count() or ptimer_set_limit() will not trigger the timer
  * (though it will cause a reload). Only a counter decrement to "0"
  * will cause a trigger. Not compatible with NO_IMMEDIATE_TRIGGER;
- * ptimer_init() will assert() that you don't set both.
+ * ptimer_init_with_bh() will assert() that you don't set both.
  */
 #define PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT (1 << 5)
 
@@ -XXX,XX +XXX,XX @@ typedef struct ptimer_state ptimer_state;
 typedef void (*ptimer_cb)(void *opaque);
 
 /**
- * ptimer_init - Allocate and return a new ptimer
+ * ptimer_init_with_bh - Allocate and return a new ptimer
  * @bh: QEMU bottom half which is run on timer expiry
  * @policy: PTIMER_POLICY_* bits specifying behaviour
  *
@@ -XXX,XX +XXX,XX @@ typedef void (*ptimer_cb)(void *opaque);
  * The ptimer takes ownership of @bh and will delete it
  * when the ptimer is eventually freed.
  */
-ptimer_state *ptimer_init(QEMUBH *bh, uint8_t policy_mask);
+ptimer_state *ptimer_init_with_bh(QEMUBH *bh, uint8_t policy_mask);
 
 /**
  * ptimer_free - Free a ptimer
  * @s: timer to free
  *
- * Free a ptimer created using ptimer_init() (including
+ * Free a ptimer created using ptimer_init_with_bh() (including
  * deleting the bottom half which it is using).
  */
 void ptimer_free(ptimer_state *s);
@@ -XXX,XX +XXX,XX @@ void ptimer_set_count(ptimer_state *s, uint64_t count);
  * @oneshot: non-zero if this timer should only count down once
  *
  * Start a ptimer counting down; when it reaches zero the bottom half
- * passed to ptimer_init() will be invoked. If the @oneshot argument is zero,
+ * passed to ptimer_init_with_bh() will be invoked.
+ * If the @oneshot argument is zero,
  * the counter value will then be reloaded from the limit and it will
  * start counting down again. If @oneshot is non-zero, then the counter
  * will disable itself when it reaches zero.
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static void mv88w8618_timer_init(SysBusDevice *dev, mv88w8618_timer_state *s,
     s->freq = freq;
 
     bh = qemu_bh_new(mv88w8618_timer_tick, s);
-    s->ptimer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+    s->ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
 }
 
 static uint64_t mv88w8618_pit_read(void *opaque, hwaddr offset,
diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/ptimer.c
+++ b/hw/core/ptimer.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_ptimer = {
     }
 };
 
-ptimer_state *ptimer_init(QEMUBH *bh, uint8_t policy_mask)
+ptimer_state *ptimer_init_with_bh(QEMUBH *bh, uint8_t policy_mask)
 {
     ptimer_state *s;
 
diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -XXX,XX +XXX,XX @@ static void xilinx_axidma_realize(DeviceState *dev, Error **errp)
 
         st->nr = i;
         st->bh = qemu_bh_new(timer_hit, st);
-        st->ptimer = ptimer_init(st->bh, PTIMER_POLICY_DEFAULT);
+        st->ptimer = ptimer_init_with_bh(st->bh, PTIMER_POLICY_DEFAULT);
         ptimer_set_freq(st->ptimer, s->freqhz);
     }
     return;
diff --git a/hw/m68k/mcf5206.c b/hw/m68k/mcf5206.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/m68k/mcf5206.c
+++ b/hw/m68k/mcf5206.c
@@ -XXX,XX +XXX,XX @@ static m5206_timer_state *m5206_timer_init(qemu_irq irq)
 
     s = g_new0(m5206_timer_state, 1);
     bh = qemu_bh_new(m5206_timer_trigger, s);
-    s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
     s->irq = irq;
     m5206_timer_reset(s);
     return s;
diff --git a/hw/m68k/mcf5208.c b/hw/m68k/mcf5208.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/m68k/mcf5208.c
+++ b/hw/m68k/mcf5208.c
@@ -XXX,XX +XXX,XX @@ static void mcf5208_sys_init(MemoryRegion *address_space, qemu_irq *pic)
     for (i = 0; i < 2; i++) {
         s = g_new0(m5208_timer_state, 1);
         bh = qemu_bh_new(m5208_timer_trigger, s);
-        s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+        s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
         memory_region_init_io(&s->iomem, NULL, &m5208_timer_ops, s,
                               "m5208-timer", 0x00004000);
         memory_region_add_subregion(address_space, 0xfc080000 + 0x4000 * i,
diff --git a/hw/net/fsl_etsec/etsec.c b/hw/net/fsl_etsec/etsec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/fsl_etsec/etsec.c
+++ b/hw/net/fsl_etsec/etsec.c
@@ -XXX,XX +XXX,XX @@ static void etsec_realize(DeviceState *dev, Error **errp)
 
 
     etsec->bh     = qemu_bh_new(etsec_timer_hit, etsec);
-    etsec->ptimer = ptimer_init(etsec->bh, PTIMER_POLICY_DEFAULT);
+    etsec->ptimer = ptimer_init_with_bh(etsec->bh, PTIMER_POLICY_DEFAULT);
     ptimer_set_freq(etsec->ptimer, 100);
 }
 
diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -XXX,XX +XXX,XX @@ static void lan9118_realize(DeviceState *dev, Error **errp)
     s->txp = &s->tx_packet;
 
     bh = qemu_bh_new(lan9118_tick, s);
-    s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
     ptimer_set_freq(s->timer, 10000);
     ptimer_set_limit(s->timer, 0xffff, 1);
 }
diff --git a/hw/timer/allwinner-a10-pit.c b/hw/timer/allwinner-a10-pit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/allwinner-a10-pit.c
+++ b/hw/timer/allwinner-a10-pit.c
@@ -XXX,XX +XXX,XX @@ static void a10_pit_init(Object *obj)
         tc->container = s;
         tc->index = i;
         bh[i] = qemu_bh_new(a10_pit_timer_cb, tc);
-        s->timer[i] = ptimer_init(bh[i], PTIMER_POLICY_DEFAULT);
+        s->timer[i] = ptimer_init_with_bh(bh[i], PTIMER_POLICY_DEFAULT);
     }
 }
 
diff --git a/hw/timer/altera_timer.c b/hw/timer/altera_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/altera_timer.c
+++ b/hw/timer/altera_timer.c
@@ -XXX,XX +XXX,XX @@ static void altera_timer_realize(DeviceState *dev, Error **errp)
     }
 
     t->bh = qemu_bh_new(timer_hit, t);
-    t->ptimer = ptimer_init(t->bh, PTIMER_POLICY_DEFAULT);
+    t->ptimer = ptimer_init_with_bh(t->bh, PTIMER_POLICY_DEFAULT);
     ptimer_set_freq(t->ptimer, t->freq_hz);
 
     memory_region_init_io(&t->mmio, OBJECT(t), &timer_ops, t,
diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -XXX,XX +XXX,XX @@ static void arm_mptimer_reset(DeviceState *dev)
     }
 }
 
-static void arm_mptimer_init(Object *obj)
+static void arm_mptimer_init_with_bh(Object *obj)
 {
     ARMMPTimerState *s = ARM_MPTIMER(obj);
 
@@ -XXX,XX +XXX,XX @@ static void arm_mptimer_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < s->num_cpu; i++) {
         TimerBlock *tb = &s->timerblock[i];
         QEMUBH *bh = qemu_bh_new(timerblock_tick, tb);
-        tb->timer = ptimer_init(bh, PTIMER_POLICY);
+        tb->timer = ptimer_init_with_bh(bh, PTIMER_POLICY);
         sysbus_init_irq(sbd, &tb->irq);
         memory_region_init_io(&tb->iomem, OBJECT(s), &timerblock_ops, tb,
                               "arm_mptimer_timerblock", 0x20);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo arm_mptimer_info = {
     .name          = TYPE_ARM_MPTIMER,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(ARMMPTimerState),
-    .instance_init = arm_mptimer_init,
+    .instance_init = arm_mptimer_init_with_bh,
     .class_init    = arm_mptimer_class_init,
 };
 
diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -XXX,XX +XXX,XX @@ static arm_timer_state *arm_timer_init(uint32_t freq)
     s->control = TIMER_CTRL_IE;
 
     bh = qemu_bh_new(arm_timer_tick, s);
-    s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
     vmstate_register(NULL, -1, &vmstate_arm_timer, s);
     return s;
 }
diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-dualtimer.c
+++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
         QEMUBH *bh = qemu_bh_new(cmsdk_dualtimermod_tick, m);
 
         m->parent = s;
-        m->timer = ptimer_init(bh,
+        m->timer = ptimer_init_with_bh(bh,
                                PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
                                PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
                                PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
     }
 
     bh = qemu_bh_new(cmsdk_apb_timer_tick, s);
-    s->timer = ptimer_init(bh,
+    s->timer = ptimer_init_with_bh(bh,
                            PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
                            PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
                            PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
diff --git a/hw/timer/digic-timer.c b/hw/timer/digic-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/digic-timer.c
+++ b/hw/timer/digic-timer.c
@@ -XXX,XX +XXX,XX @@ static void digic_timer_init(Object *obj)
 {
     DigicTimerState *s = DIGIC_TIMER(obj);
 
-    s->ptimer = ptimer_init(NULL, PTIMER_POLICY_DEFAULT);
+    s->ptimer = ptimer_init_with_bh(NULL, PTIMER_POLICY_DEFAULT);
 
     /*
      * FIXME: there is no documentation on Digic timer
diff --git a/hw/timer/etraxfs_timer.c b/hw/timer/etraxfs_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/etraxfs_timer.c
+++ b/hw/timer/etraxfs_timer.c
@@ -XXX,XX +XXX,XX @@ static void etraxfs_timer_realize(DeviceState *dev, Error **errp)
     t->bh_t0 = qemu_bh_new(timer0_hit, t);
     t->bh_t1 = qemu_bh_new(timer1_hit, t);
     t->bh_wd = qemu_bh_new(watchdog_hit, t);
-    t->ptimer_t0 = ptimer_init(t->bh_t0, PTIMER_POLICY_DEFAULT);
-    t->ptimer_t1 = ptimer_init(t->bh_t1, PTIMER_POLICY_DEFAULT);
-    t->ptimer_wd = ptimer_init(t->bh_wd, PTIMER_POLICY_DEFAULT);
+    t->ptimer_t0 = ptimer_init_with_bh(t->bh_t0, PTIMER_POLICY_DEFAULT);
+    t->ptimer_t1 = ptimer_init_with_bh(t->bh_t1, PTIMER_POLICY_DEFAULT);
+    t->ptimer_wd = ptimer_init_with_bh(t->bh_wd, PTIMER_POLICY_DEFAULT);
 
     sysbus_init_irq(sbd, &t->irq);
     sysbus_init_irq(sbd, &t->nmi);
diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
 
     /* Global timer */
     bh[0] = qemu_bh_new(exynos4210_gfrc_event, s);
-    s->g_timer.ptimer_frc = ptimer_init(bh[0], PTIMER_POLICY_DEFAULT);
+    s->g_timer.ptimer_frc = ptimer_init_with_bh(bh[0], PTIMER_POLICY_DEFAULT);
     memset(&s->g_timer.reg, 0, sizeof(struct gregs));
 
     /* Local timers */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
         bh[0] = qemu_bh_new(exynos4210_ltick_event, &s->l_timer[i]);
         bh[1] = qemu_bh_new(exynos4210_lfrc_event, &s->l_timer[i]);
         s->l_timer[i].tick_timer.ptimer_tick =
-                                   ptimer_init(bh[0], PTIMER_POLICY_DEFAULT);
-        s->l_timer[i].ptimer_frc = ptimer_init(bh[1], PTIMER_POLICY_DEFAULT);
+            ptimer_init_with_bh(bh[0], PTIMER_POLICY_DEFAULT);
+        s->l_timer[i].ptimer_frc =
+            ptimer_init_with_bh(bh[1], PTIMER_POLICY_DEFAULT);
         s->l_timer[i].id = i;
     }
 
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_init(Object *obj)
     for (i = 0; i < EXYNOS4210_PWM_TIMERS_NUM; i++) {
         bh = qemu_bh_new(exynos4210_pwm_tick, &s->timer[i]);
         sysbus_init_irq(dev, &s->timer[i].irq);
-        s->timer[i].ptimer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+        s->timer[i].ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
         s->timer[i].id = i;
         s->timer[i].parent = s;
     }
diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_rtc.c
+++ b/hw/timer/exynos4210_rtc.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_init(Object *obj)
     QEMUBH *bh;
 
     bh = qemu_bh_new(exynos4210_rtc_tick, s);
-    s->ptimer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+    s->ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
     ptimer_set_freq(s->ptimer, RTC_BASE_FREQ);
     exynos4210_rtc_update_freq(s, 0);
 
     bh = qemu_bh_new(exynos4210_rtc_1Hz_tick, s);
-    s->ptimer_1Hz = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+    s->ptimer_1Hz = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
     ptimer_set_freq(s->ptimer_1Hz, RTC_BASE_FREQ);
 
     sysbus_init_irq(dev, &s->alm_irq);
diff --git a/hw/timer/grlib_gptimer.c b/hw/timer/grlib_gptimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/grlib_gptimer.c
+++ b/hw/timer/grlib_gptimer.c
@@ -XXX,XX +XXX,XX @@ static void grlib_gptimer_realize(DeviceState *dev, Error **errp)
 
         timer->unit   = unit;
         timer->bh     = qemu_bh_new(grlib_gptimer_hit, timer);
-        timer->ptimer = ptimer_init(timer->bh, PTIMER_POLICY_DEFAULT);
+        timer->ptimer = ptimer_init_with_bh(timer->bh, PTIMER_POLICY_DEFAULT);
         timer->id     = i;
 
         /* One IRQ line for each timer */
diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/imx_epit.c
+++ b/hw/timer/imx_epit.c
@@ -XXX,XX +XXX,XX @@ static void imx_epit_realize(DeviceState *dev, Error **errp)
                           0x00001000);
     sysbus_init_mmio(sbd, &s->iomem);
 
-    s->timer_reload = ptimer_init(NULL, PTIMER_POLICY_DEFAULT);
+    s->timer_reload = ptimer_init_with_bh(NULL, PTIMER_POLICY_DEFAULT);
 
     bh = qemu_bh_new(imx_epit_cmp, s);
-    s->timer_cmp = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+    s->timer_cmp = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
 }
 
 static void imx_epit_class_init(ObjectClass *klass, void *data)
diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/imx_gpt.c
+++ b/hw/timer/imx_gpt.c
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &s->iomem);
 
     bh = qemu_bh_new(imx_gpt_timeout, s);
-    s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
 }
 
 static void imx_gpt_class_init(ObjectClass *klass, void *data)
diff --git a/hw/timer/lm32_timer.c b/hw/timer/lm32_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/lm32_timer.c
+++ b/hw/timer/lm32_timer.c
@@ -XXX,XX +XXX,XX @@ static void lm32_timer_realize(DeviceState *dev, Error **errp)
     LM32TimerState *s = LM32_TIMER(dev);
 
     s->bh = qemu_bh_new(timer_hit, s);
-    s->ptimer = ptimer_init(s->bh, PTIMER_POLICY_DEFAULT);
+    s->ptimer = ptimer_init_with_bh(s->bh, PTIMER_POLICY_DEFAULT);
 
     ptimer_set_freq(s->ptimer, s->freq_hz);
 }
diff --git a/hw/timer/milkymist-sysctl.c b/hw/timer/milkymist-sysctl.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/milkymist-sysctl.c
+++ b/hw/timer/milkymist-sysctl.c
@@ -XXX,XX +XXX,XX @@ static void milkymist_sysctl_realize(DeviceState *dev, Error **errp)
 
     s->bh0 = qemu_bh_new(timer0_hit, s);
     s->bh1 = qemu_bh_new(timer1_hit, s);
-    s->ptimer0 = ptimer_init(s->bh0, PTIMER_POLICY_DEFAULT);
-    s->ptimer1 = ptimer_init(s->bh1, PTIMER_POLICY_DEFAULT);
+    s->ptimer0 = ptimer_init_with_bh(s->bh0, PTIMER_POLICY_DEFAULT);
+    s->ptimer1 = ptimer_init_with_bh(s->bh1, PTIMER_POLICY_DEFAULT);
 
     ptimer_set_freq(s->ptimer0, s->freq_hz);
     ptimer_set_freq(s->ptimer1, s->freq_hz);
diff --git a/hw/timer/mss-timer.c b/hw/timer/mss-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/mss-timer.c
+++ b/hw/timer/mss-timer.c
@@ -XXX,XX +XXX,XX @@ static void mss_timer_init(Object *obj)
         struct Msf2Timer *st = &t->timers[i];
 
         st->bh = qemu_bh_new(timer_hit, st);
-        st->ptimer = ptimer_init(st->bh, PTIMER_POLICY_DEFAULT);
+        st->ptimer = ptimer_init_with_bh(st->bh, PTIMER_POLICY_DEFAULT);
         ptimer_set_freq(st->ptimer, t->freq_hz);
         sysbus_init_irq(SYS_BUS_DEVICE(obj), &st->irq);
     }
diff --git a/hw/timer/puv3_ost.c b/hw/timer/puv3_ost.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/puv3_ost.c
+++ b/hw/timer/puv3_ost.c
@@ -XXX,XX +XXX,XX @@ static void puv3_ost_realize(DeviceState *dev, Error **errp)
     sysbus_init_irq(sbd, &s->irq);
 
     s->bh = qemu_bh_new(puv3_ost_tick, s);
-    s->ptimer = ptimer_init(s->bh, PTIMER_POLICY_DEFAULT);
+    s->ptimer = ptimer_init_with_bh(s->bh, PTIMER_POLICY_DEFAULT);
     ptimer_set_freq(s->ptimer, 50 * 1000 * 1000);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &puv3_ost_ops, s, "puv3_ost",
diff --git a/hw/timer/sh_timer.c b/hw/timer/sh_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/sh_timer.c
+++ b/hw/timer/sh_timer.c
@@ -XXX,XX +XXX,XX @@ static void *sh_timer_init(uint32_t freq, int feat, qemu_irq irq)
     s->irq = irq;
 
     bh = qemu_bh_new(sh_timer_tick, s);
-    s->timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
 
     sh_timer_write(s, OFFSET_TCOR >> 2, s->tcor);
     sh_timer_write(s, OFFSET_TCNT >> 2, s->tcnt);
diff --git a/hw/timer/slavio_timer.c b/hw/timer/slavio_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/slavio_timer.c
+++ b/hw/timer/slavio_timer.c
@@ -XXX,XX +XXX,XX @@ static void slavio_timer_init(Object *obj)
         tc->timer_index = i;
 
         bh = qemu_bh_new(slavio_timer_irq, tc);
-        s->cputimer[i].timer = ptimer_init(bh, PTIMER_POLICY_DEFAULT);
+        s->cputimer[i].timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
         ptimer_set_period(s->cputimer[i].timer, TIMER_PERIOD);
 
         size = i == 0 ? SYS_TIMER_SIZE : CPU_TIMER_SIZE;
diff --git a/hw/timer/xilinx_timer.c b/hw/timer/xilinx_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/xilinx_timer.c
+++ b/hw/timer/xilinx_timer.c
@@ -XXX,XX +XXX,XX @@ static void xilinx_timer_realize(DeviceState *dev, Error **errp)
         xt->parent = t;
         xt->nr = i;
         xt->bh = qemu_bh_new(timer_hit, xt);
-        xt->ptimer = ptimer_init(xt->bh, PTIMER_POLICY_DEFAULT);
+        xt->ptimer = ptimer_init_with_bh(xt->bh, PTIMER_POLICY_DEFAULT);
         ptimer_set_freq(xt->ptimer, t->freq_hz);
     }
 
diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/cmsdk-apb-watchdog.c
+++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
     }
 
     bh = qemu_bh_new(cmsdk_apb_watchdog_tick, s);
-    s->timer = ptimer_init(bh,
+    s->timer = ptimer_init_with_bh(bh,
                            PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
                            PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
                            PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
diff --git a/tests/ptimer-test.c b/tests/ptimer-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/ptimer-test.c
+++ b/tests/ptimer-test.c
@@ -XXX,XX +XXX,XX @@ static void check_set_count(gconstpointer arg)
 {
     const uint8_t *policy = arg;
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init(bh, *policy);
+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
 
     triggered = false;
 
@@ -XXX,XX +XXX,XX @@ static void check_set_limit(gconstpointer arg)
 {
     const uint8_t *policy = arg;
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init(bh, *policy);
+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
 
     triggered = false;
 
@@ -XXX,XX +XXX,XX @@ static void check_oneshot(gconstpointer arg)
 {
     const uint8_t *policy = arg;
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init(bh, *policy);
+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
     triggered = false;
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
 {
     const uint8_t *policy = arg;
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init(bh, *policy);
+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_mode_change(gconstpointer arg)
 {
     const uint8_t *policy = arg;
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init(bh, *policy);
+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_period_change(gconstpointer arg)
 {
     const uint8_t *policy = arg;
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init(bh, *policy);
+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
     triggered = false;
@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_freq_change(gconstpointer arg)
 {
     const uint8_t *policy = arg;
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init(bh, *policy);
+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
     triggered = false;
@@ -XXX,XX +XXX,XX @@ static void check_run_with_period_0(gconstpointer arg)
 {
     const uint8_t *policy = arg;
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init(bh, *policy);
+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
 
     triggered = false;
 
@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
 {
     const uint8_t *policy = arg;
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init(bh, *policy);
+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
@@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg)
 {
     const uint8_t *policy = arg;
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init(bh, *policy);
+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
     bool continuous_trigger = (*policy & PTIMER_POLICY_CONTINUOUS_TRIGGER);
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
     bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
@@ -XXX,XX +XXX,XX @@ static void check_oneshot_with_load_0(gconstpointer arg)
 {
     const uint8_t *policy = arg;
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init(bh, *policy);
+    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
     bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
 
-- 
2.20.1

Provide the new transaction-based API. If a ptimer is created
using ptimer_init() rather than ptimer_init_with_bh(), then
instead of providing a QEMUBH, it provides a pointer to the
callback function directly, and has opted into the transaction
API. All calls to functions which modify ptimer state:
 - ptimer_set_period()
 - ptimer_set_freq()
 - ptimer_set_limit()
 - ptimer_set_count()
 - ptimer_run()
 - ptimer_stop()
must be between matched calls to ptimer_transaction_begin()
and ptimer_transaction_commit(). When ptimer_transaction_commit()
is called it will evaluate the state of the timer after all the
changes in the transaction, and call the callback if necessary.

In the old API the individual update functions generally would
call ptimer_trigger() immediately, which would schedule the QEMUBH.
In the new API the update functions will instead defer the
"set s->next_event and call ptimer_reload()" work to
ptimer_transaction_commit().

Because ptimer_trigger() can now immediately call into the
device code which may then call other ptimer functions that
update ptimer_state fields, we must be more careful in
ptimer_reload() not to cache fields from ptimer_state across
the ptimer_trigger() call. (This was harmless with the QEMUBH
mechanism as the BH would not be invoked until much later.)

We use assertions to check that:
 * the functions modifying ptimer state are not called outside
   a transaction block
 * ptimer_transaction_begin() and _commit() calls are paired
 * the transaction API is not used with a QEMUBH ptimer

There is some slight repetition of code:
 * most of the set functions have similar looking "if s->bh
   call ptimer_reload, otherwise set s->need_reload" code
 * ptimer_init() and ptimer_init_with_bh() have similar code
We deliberately don't try to avoid this repetition, because
it will all be deleted when the QEMUBH version of the API
is removed.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-3-peter.maydell@linaro.org
---
 include/hw/ptimer.h |  72 +++++++++++++++++++++
 hw/core/ptimer.c    | 152 +++++++++++++++++++++++++++++++++++++++-----
 2 files changed, 209 insertions(+), 15 deletions(-)

diff --git a/include/hw/ptimer.h b/include/hw/ptimer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ptimer.h
+++ b/include/hw/ptimer.h
@@ -XXX,XX +XXX,XX @@ typedef void (*ptimer_cb)(void *opaque);
  */
 ptimer_state *ptimer_init_with_bh(QEMUBH *bh, uint8_t policy_mask);
 
+/**
+ * ptimer_init - Allocate and return a new ptimer
+ * @callback: function to call on ptimer expiry
+ * @callback_opaque: opaque pointer passed to @callback
+ * @policy: PTIMER_POLICY_* bits specifying behaviour
+ *
+ * The ptimer returned must be freed using ptimer_free().
+ *
+ * If a ptimer is created using this API then will use the
+ * transaction-based API for modifying ptimer state: all calls
+ * to functions which modify ptimer state:
+ *  - ptimer_set_period()
+ *  - ptimer_set_freq()
+ *  - ptimer_set_limit()
+ *  - ptimer_set_count()
+ *  - ptimer_run()
+ *  - ptimer_stop()
+ * must be between matched calls to ptimer_transaction_begin()
+ * and ptimer_transaction_commit(). When ptimer_transaction_commit()
+ * is called it will evaluate the state of the timer after all the
+ * changes in the transaction, and call the callback if necessary.
+ *
+ * The callback function is always called from within a transaction
+ * begin/commit block, so the callback should not call the
+ * ptimer_transaction_begin() function itself. If the callback changes
+ * the ptimer state such that another ptimer expiry is triggered, then
+ * the callback will be called a second time after the first call returns.
+ */
+ptimer_state *ptimer_init(ptimer_cb callback,
+                          void *callback_opaque,
+                          uint8_t policy_mask);
+
 /**
  * ptimer_free - Free a ptimer
  * @s: timer to free
@@ -XXX,XX +XXX,XX @@ ptimer_state *ptimer_init_with_bh(QEMUBH *bh, uint8_t policy_mask);
  */
 void ptimer_free(ptimer_state *s);
 
+/**
+ * ptimer_transaction_begin() - Start a ptimer modification transaction
+ *
+ * This function must be called before making any calls to functions
+ * which modify the ptimer's state (see the ptimer_init() documentation
+ * for a list of these), and must always have a matched call to
+ * ptimer_transaction_commit().
+ * It is an error to call this function for a BH-based ptimer;
+ * attempting to do this will trigger an assert.
+ */
+void ptimer_transaction_begin(ptimer_state *s);
+
+/**
+ * ptimer_transaction_commit() - Commit a ptimer modification transaction
+ *
+ * This function must be called after calls to functions which modify
+ * the ptimer's state, and completes the update of the ptimer. If the
+ * ptimer state now means that we should trigger the timer expiry
+ * callback, it will be called directly.
+ */
+void ptimer_transaction_commit(ptimer_state *s);
+
 /**
  * ptimer_set_period - Set counter increment interval in nanoseconds
  * @s: ptimer to configure
@@ -XXX,XX +XXX,XX @@ void ptimer_free(ptimer_state *s);
  * Note that if your counter behaviour is specified as having a
  * particular frequency rather than a period then ptimer_set_freq()
  * may be more appropriate.
+ *
+ * This function will assert if it is called outside a
+ * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
  */
 void ptimer_set_period(ptimer_state *s, int64_t period);
 
@@ -XXX,XX +XXX,XX @@ void ptimer_set_period(ptimer_state *s, int64_t period);
  * as setting the frequency then this function is more appropriate,
  * because it allows specifying an effective period which is
  * precise to fractions of a nanosecond, avoiding rounding errors.
+ *
+ * This function will assert if it is called outside a
+ * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
  */
 void ptimer_set_freq(ptimer_state *s, uint32_t freq);
 
@@ -XXX,XX +XXX,XX @@ uint64_t ptimer_get_limit(ptimer_state *s);
  * Set the limit value of the down-counter. The @reload flag can
  * be used to emulate the behaviour of timers which immediately
  * reload the counter when their reload register is written to.
+ *
+ * This function will assert if it is called outside a
+ * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
  */
 void ptimer_set_limit(ptimer_state *s, uint64_t limit, int reload);
 
@@ -XXX,XX +XXX,XX @@ uint64_t ptimer_get_count(ptimer_state *s);
  * Set the value of the down-counter. If the counter is currently
  * enabled this will arrange for a timer callback at the appropriate
  * point in the future.
+ *
+ * This function will assert if it is called outside a
+ * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
  */
 void ptimer_set_count(ptimer_state *s, uint64_t count);
 
@@ -XXX,XX +XXX,XX @@ void ptimer_set_count(ptimer_state *s, uint64_t count);
  * the counter value will then be reloaded from the limit and it will
  * start counting down again. If @oneshot is non-zero, then the counter
  * will disable itself when it reaches zero.
+ *
+ * This function will assert if it is called outside a
+ * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
  */
 void ptimer_run(ptimer_state *s, int oneshot);
 
@@ -XXX,XX +XXX,XX @@ void ptimer_run(ptimer_state *s, int oneshot);
  *
  * Note that this can cause it to "lose" time, even if it is immediately
  * restarted.
+ *
+ * This function will assert if it is called outside a
+ * ptimer_transaction_begin/commit block, unless this is a bottom-half ptimer.
  */
 void ptimer_stop(ptimer_state *s);
 
diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/ptimer.c
+++ b/hw/core/ptimer.c
@@ -XXX,XX +XXX,XX @@ struct ptimer_state
     uint8_t policy_mask;
     QEMUBH *bh;
     QEMUTimer *timer;
+    ptimer_cb callback;
+    void *callback_opaque;
+    /*
+     * These track whether we're in a transaction block, and if we
+     * need to do a timer reload when the block finishes. They don't
+     * need to be migrated because migration can never happen in the
+     * middle of a transaction block.
+     */
+    bool in_transaction;
+    bool need_reload;
 };
 
 /* Use a bottom-half routine to avoid reentrancy issues.  */
@@ -XXX,XX +XXX,XX @@ static void ptimer_trigger(ptimer_state *s)
     if (s->bh) {
         replay_bh_schedule_event(s->bh);
     }
+    if (s->callback) {
+        s->callback(s->callback_opaque);
+    }
 }
 
 static void ptimer_reload(ptimer_state *s, int delta_adjust)
 {
-    uint32_t period_frac = s->period_frac;
-    uint64_t period = s->period;
-    uint64_t delta = s->delta;
+    uint32_t period_frac;
+    uint64_t period;
+    uint64_t delta;
     bool suppress_trigger = false;
 
     /*
@@ -XXX,XX +XXX,XX @@ static void ptimer_reload(ptimer_state *s, int delta_adjust)
         (s->policy_mask & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT)) {
         suppress_trigger = true;
     }
-    if (delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)
+    if (s->delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)
         && !suppress_trigger) {
         ptimer_trigger(s);
     }
 
+    /*
+     * Note that ptimer_trigger() might call the device callback function,
+     * which can then modify timer state, so we must not cache any fields
+     * from ptimer_state until after we have called it.
+     */
+    delta = s->delta;
+    period = s->period;
+    period_frac = s->period_frac;
+
     if (delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_RELOAD)) {
         delta = s->delta = s->limit;
     }
@@ -XXX,XX +XXX,XX @@ static void ptimer_tick(void *opaque)
     ptimer_state *s = (ptimer_state *)opaque;
     bool trigger = true;
 
+    /*
+     * We perform all the tick actions within a begin/commit block
+     * because the callback function that ptimer_trigger() calls
+     * might make calls into the ptimer APIs that provoke another
+     * trigger, and we want that to cause the callback function
+     * to be called iteratively, not recursively.
+     */
+    ptimer_transaction_begin(s);
+
     if (s->enabled == 2) {
         s->delta = 0;
         s->enabled = 0;
@@ -XXX,XX +XXX,XX @@ static void ptimer_tick(void *opaque)
     if (trigger) {
         ptimer_trigger(s);
     }
+
+    ptimer_transaction_commit(s);
 }
 
 uint64_t ptimer_get_count(ptimer_state *s)
@@ -XXX,XX +XXX,XX @@ uint64_t ptimer_get_count(ptimer_state *s)
 
 void ptimer_set_count(ptimer_state *s, uint64_t count)
 {
+    assert(s->in_transaction || !s->callback);
     s->delta = count;
     if (s->enabled) {
-        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-        ptimer_reload(s, 0);
+        if (!s->callback) {
+            s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+            ptimer_reload(s, 0);
+        } else {
+            s->need_reload = true;
+        }
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void ptimer_run(ptimer_state *s, int oneshot)
 {
     bool was_disabled = !s->enabled;
 
+    assert(s->in_transaction || !s->callback);
+
     if (was_disabled && s->period == 0) {
         if (!qtest_enabled()) {
             fprintf(stderr, "Timer with period zero, disabling\n");
@@ -XXX,XX +XXX,XX @@ void ptimer_run(ptimer_state *s, int oneshot)
     }
     s->enabled = oneshot ? 2 : 1;
     if (was_disabled) {
-        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-        ptimer_reload(s, 0);
+        if (!s->callback) {
+            s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+            ptimer_reload(s, 0);
+        } else {
+            s->need_reload = true;
+        }
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void ptimer_run(ptimer_state *s, int oneshot)
    is immediately restarted.  */
 void ptimer_stop(ptimer_state *s)
 {
+    assert(s->in_transaction || !s->callback);
+
     if (!s->enabled)
         return;
 
     s->delta = ptimer_get_count(s);
     timer_del(s->timer);
     s->enabled = 0;
+    if (s->callback) {
+        s->need_reload = false;
+    }
 }
 
 /* Set counter increment interval in nanoseconds.  */
 void ptimer_set_period(ptimer_state *s, int64_t period)
 {
+    assert(s->in_transaction || !s->callback);
     s->delta = ptimer_get_count(s);
     s->period = period;
     s->period_frac = 0;
     if (s->enabled) {
-        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-        ptimer_reload(s, 0);
+        if (!s->callback) {
+            s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+            ptimer_reload(s, 0);
+        } else {
+            s->need_reload = true;
+        }
     }
 }
 
 /* Set counter frequency in Hz.  */
 void ptimer_set_freq(ptimer_state *s, uint32_t freq)
 {
+    assert(s->in_transaction || !s->callback);
     s->delta = ptimer_get_count(s);
     s->period = 1000000000ll / freq;
     s->period_frac = (1000000000ll << 32) / freq;
     if (s->enabled) {
-        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-        ptimer_reload(s, 0);
+        if (!s->callback) {
+            s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+            ptimer_reload(s, 0);
+        } else {
+            s->need_reload = true;
+        }
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void ptimer_set_freq(ptimer_state *s, uint32_t freq)
    count = limit.  */
 void ptimer_set_limit(ptimer_state *s, uint64_t limit, int reload)
 {
+    assert(s->in_transaction || !s->callback);
     s->limit = limit;
     if (reload)
         s->delta = limit;
     if (s->enabled && reload) {
-        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
-        ptimer_reload(s, 0);
+        if (!s->callback) {
+            s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+            ptimer_reload(s, 0);
+        } else {
+            s->need_reload = true;
+        }
     }
 }
 
@@ -XXX,XX +XXX,XX @@ uint64_t ptimer_get_limit(ptimer_state *s)
     return s->limit;
 }
 
+void ptimer_transaction_begin(ptimer_state *s)
+{
+    assert(!s->in_transaction || !s->callback);
+    s->in_transaction = true;
+    s->need_reload = false;
+}
+
+void ptimer_transaction_commit(ptimer_state *s)
+{
+    assert(s->in_transaction);
+    /*
+     * We must loop here because ptimer_reload() can call the callback
+     * function, which might then update ptimer state in a way that
+     * means we need to do another reload and possibly another callback.
+     * A disabled timer never needs reloading (and if we don't check
+     * this then we loop forever if ptimer_reload() disables the timer).
+     */
+    while (s->need_reload && s->enabled) {
+        s->need_reload = false;
+        s->next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        ptimer_reload(s, 0);
+    }
+    /* Now we've finished reload we can leave the transaction block. */
+    s->in_transaction = false;
+}
+
 const VMStateDescription vmstate_ptimer = {
     .name = "ptimer",
     .version_id = 1,
@@ -XXX,XX +XXX,XX @@ ptimer_state *ptimer_init_with_bh(QEMUBH *bh, uint8_t policy_mask)
     return s;
 }
 
+ptimer_state *ptimer_init(ptimer_cb callback, void *callback_opaque,
+                          uint8_t policy_mask)
+{
+    ptimer_state *s;
+
+    /*
+     * The callback function is mandatory; so we use it to distinguish
+     * old-style QEMUBH ptimers from new transaction API ptimers.
+     * (ptimer_init_with_bh() allows a NULL bh pointer and at least
+     * one device (digic-timer) passes NULL, so it's not the case
+     * that either s->bh != NULL or s->callback != NULL.)
+     */
+    assert(callback);
+
+    s = g_new0(ptimer_state, 1);
+    s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ptimer_tick, s);
+    s->policy_mask = policy_mask;
+    s->callback = callback;
+    s->callback_opaque = callback_opaque;
+
+    /*
+     * These two policies are incompatible -- trigger-on-decrement implies
+     * a timer trigger when the count becomes 0, but no-immediate-trigger
+     * implies a trigger when the count stops being 0.
+     */
+    assert(!((policy_mask & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT) &&
+             (policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)));
+    return s;
+}
+
 void ptimer_free(ptimer_state *s)
 {
-    qemu_bh_delete(s->bh);
+    if (s->bh) {
+        qemu_bh_delete(s->bh);
+    }
     timer_free(s->timer);
     g_free(s);
 }
-- 
2.20.1

Convert the ptimer test cases to the transaction-based ptimer API,
by changing to ptimer_init(), dropping the now-unused QEMUBH
variables, and surrounding each set of changes to the ptimer
state in ptimer_transaction_begin/commit calls.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-4-peter.maydell@linaro.org
---
 tests/ptimer-test.c | 106 +++++++++++++++++++++++++++++++++++---------
 1 file changed, 84 insertions(+), 22 deletions(-)

diff --git a/tests/ptimer-test.c b/tests/ptimer-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/ptimer-test.c
+++ b/tests/ptimer-test.c
@@ -XXX,XX +XXX,XX @@ static void qemu_clock_step(uint64_t ns)
 static void check_set_count(gconstpointer arg)
 {
     const uint8_t *policy = arg;
-    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_count(ptimer, 1000);
+    ptimer_transaction_commit(ptimer);
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 1000);
     g_assert_false(triggered);
     ptimer_free(ptimer);
@@ -XXX,XX +XXX,XX @@ static void check_set_count(gconstpointer arg)
 static void check_set_limit(gconstpointer arg)
 {
     const uint8_t *policy = arg;
-    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_limit(ptimer, 1000, 0);
+    ptimer_transaction_commit(ptimer);
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
     g_assert_cmpuint(ptimer_get_limit(ptimer), ==, 1000);
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_limit(ptimer, 2000, 1);
+    ptimer_transaction_commit(ptimer);
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 2000);
     g_assert_cmpuint(ptimer_get_limit(ptimer), ==, 2000);
     g_assert_false(triggered);
@@ -XXX,XX +XXX,XX @@ static void check_set_limit(gconstpointer arg)
 static void check_oneshot(gconstpointer arg)
 {
     const uint8_t *policy = arg;
-    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_period(ptimer, 2000000);
     ptimer_set_count(ptimer, 10);
     ptimer_run(ptimer, 1);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(2000000 * 2 + 1);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 8 : 7);
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_stop(ptimer);
+    ptimer_transaction_commit(ptimer);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 8 : 7);
     g_assert_false(triggered);
@@ -XXX,XX +XXX,XX @@ static void check_oneshot(gconstpointer arg)
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 8 : 7);
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_run(ptimer, 1);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(2000000 * 7 + 1);
 
@@ -XXX,XX +XXX,XX @@ static void check_oneshot(gconstpointer arg)
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_count(ptimer, 10);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(20000000 + 1);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 10);
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_limit(ptimer, 9, 1);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(20000000 + 1);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 9);
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_run(ptimer, 1);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(2000000 + 1);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 8 : 7);
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_count(ptimer, 20);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(2000000 * 19 + 1);
 
@@ -XXX,XX +XXX,XX @@ static void check_oneshot(gconstpointer arg)
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
     g_assert_true(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_stop(ptimer);
+    ptimer_transaction_commit(ptimer);
 
     triggered = false;
 
@@ -XXX,XX +XXX,XX @@ static void check_oneshot(gconstpointer arg)
 static void check_periodic(gconstpointer arg)
 {
     const uint8_t *policy = arg;
-    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_period(ptimer, 2000000);
     ptimer_set_limit(ptimer, 10, 1);
     ptimer_run(ptimer, 0);
+    ptimer_transaction_commit(ptimer);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 10);
     g_assert_false(triggered);
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
                     (no_round_down ? 9 : 8) + (wrap_policy ? 1 : 0));
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_count(ptimer, 20);
+    ptimer_transaction_commit(ptimer);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 20);
     g_assert_false(triggered);
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_count(ptimer, 3);
+    ptimer_transaction_commit(ptimer);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 3);
     g_assert_false(triggered);
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
                     (no_round_down ? 9 : 8) + (wrap_policy ? 1 : 0));
     g_assert_true(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_stop(ptimer);
+    ptimer_transaction_commit(ptimer);
     triggered = false;
 
     qemu_clock_step(2000000);
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
                     (no_round_down ? 9 : 8) + (wrap_policy ? 1 : 0));
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_count(ptimer, 3);
     ptimer_run(ptimer, 0);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(2000000 * 3 + 1);
 
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
                     (no_round_down ? 9 : 8) + (wrap_policy ? 1 : 0));
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_count(ptimer, 0);
+    ptimer_transaction_commit(ptimer);
     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
                      no_immediate_reload ? 0 : 10);
 
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
                     (no_round_down ? 8 : 7) + (wrap_policy ? 1 : 0));
     g_assert_true(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_stop(ptimer);
+    ptimer_transaction_commit(ptimer);
 
     triggered = false;
 
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
                     (no_round_down ? 8 : 7) + (wrap_policy ? 1 : 0));
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_run(ptimer, 0);
+    ptimer_transaction_commit(ptimer);
+
+    ptimer_transaction_begin(ptimer);
     ptimer_set_period(ptimer, 0);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(2000000 + 1);
 
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
 static void check_on_the_fly_mode_change(gconstpointer arg)
 {
     const uint8_t *policy = arg;
-    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_period(ptimer, 2000000);
     ptimer_set_limit(ptimer, 10, 1);
     ptimer_run(ptimer, 1);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(2000000 * 9 + 1);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 1 : 0);
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_run(ptimer, 0);
+    ptimer_transaction_commit(ptimer);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 1 : 0);
     g_assert_false(triggered);
@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_mode_change(gconstpointer arg)
 
     qemu_clock_step(2000000 * 9);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_run(ptimer, 1);
+    ptimer_transaction_commit(ptimer);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
                      (no_round_down ? 1 : 0) + (wrap_policy ? 1 : 0));
@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_mode_change(gconstpointer arg)
 static void check_on_the_fly_period_change(gconstpointer arg)
 {
     const uint8_t *policy = arg;
-    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_period(ptimer, 2000000);
     ptimer_set_limit(ptimer, 8, 1);
     ptimer_run(ptimer, 1);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(2000000 * 4 + 1);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 4 : 3);
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_period(ptimer, 4000000);
+    ptimer_transaction_commit(ptimer);
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 4 : 3);
 
     qemu_clock_step(4000000 * 2 + 1);
@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_period_change(gconstpointer arg)
 static void check_on_the_fly_freq_change(gconstpointer arg)
 {
     const uint8_t *policy = arg;
-    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_freq(ptimer, 500);
     ptimer_set_limit(ptimer, 8, 1);
     ptimer_run(ptimer, 1);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(2000000 * 4 + 1);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 4 : 3);
     g_assert_false(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_freq(ptimer, 250);
+    ptimer_transaction_commit(ptimer);
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, no_round_down ? 4 : 3);
 
     qemu_clock_step(2000000 * 4 + 1);
@@ -XXX,XX +XXX,XX @@ static void check_on_the_fly_freq_change(gconstpointer arg)
 static void check_run_with_period_0(gconstpointer arg)
 {
     const uint8_t *policy = arg;
-    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_count(ptimer, 99);
     ptimer_run(ptimer, 1);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(10 * NANOSECONDS_PER_SECOND);
 
@@ -XXX,XX +XXX,XX @@ static void check_run_with_period_0(gconstpointer arg)
 static void check_run_with_delta_0(gconstpointer arg)
 {
     const uint8_t *policy = arg;
-    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
     bool wrap_policy = (*policy & PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD);
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_period(ptimer, 2000000);
     ptimer_set_limit(ptimer, 99, 0);
     ptimer_run(ptimer, 1);
+    ptimer_transaction_commit(ptimer);
     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
                      no_immediate_reload ? 0 : 99);
 
@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
             g_assert_false(triggered);
         }
 
+        ptimer_transaction_begin(ptimer);
         ptimer_set_count(ptimer, 99);
         ptimer_run(ptimer, 1);
+        ptimer_transaction_commit(ptimer);
     }
 
     qemu_clock_step(2000000 + 1);
@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_count(ptimer, 0);
     ptimer_run(ptimer, 0);
+    ptimer_transaction_commit(ptimer);
     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
                      no_immediate_reload ? 0 : 99);
 
@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
                     wrap_policy ? 0 : (no_round_down ? 99 : 98));
     g_assert_true(triggered);
 
+    ptimer_transaction_begin(ptimer);
     ptimer_stop(ptimer);
+    ptimer_transaction_commit(ptimer);
     ptimer_free(ptimer);
 }
 
 static void check_periodic_with_load_0(gconstpointer arg)
 {
     const uint8_t *policy = arg;
-    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
     bool continuous_trigger = (*policy & PTIMER_POLICY_CONTINUOUS_TRIGGER);
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
     bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_period(ptimer, 2000000);
     ptimer_run(ptimer, 0);
+    ptimer_transaction_commit(ptimer);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
 
@@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg)
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_count(ptimer, 10);
     ptimer_run(ptimer, 0);
+    ptimer_transaction_commit(ptimer);
 
     qemu_clock_step(2000000 * 10 + 1);
 
@@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg)
         g_assert_false(triggered);
     }
 
+    ptimer_transaction_begin(ptimer);
     ptimer_stop(ptimer);
+    ptimer_transaction_commit(ptimer);
     ptimer_free(ptimer);
 }
 
 static void check_oneshot_with_load_0(gconstpointer arg)
 {
     const uint8_t *policy = arg;
-    QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-    ptimer_state *ptimer = ptimer_init_with_bh(bh, *policy);
+    ptimer_state *ptimer = ptimer_init(ptimer_trigger, NULL, *policy);
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
     bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
 
     triggered = false;
 
+    ptimer_transaction_begin(ptimer);
     ptimer_set_period(ptimer, 2000000);
     ptimer_run(ptimer, 1);
+    ptimer_transaction_commit(ptimer);
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
 
-- 
2.20.1

Switch the arm_timer.c code away from bottom-half based ptimers
to the new transaction-based ptimer API. This just requires
adding begin/commit calls around the various arms of
arm_timer_write() that modify the ptimer state, and using the
new ptimer_init() function to create the timer.

Fixes: https://bugs.launchpad.net/qemu/+bug/1777777
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-5-peter.maydell@linaro.org
---
 hw/timer/arm_timer.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/hw/timer/arm_timer.c b/hw/timer/arm_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/arm_timer.c
+++ b/hw/timer/arm_timer.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/ptimer.h"
 #include "hw/qdev-properties.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qemu/log.h"
 
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_timer_read(void *opaque, hwaddr offset)
     }
 }
 
-/* Reset the timer limit after settings have changed.  */
+/*
+ * Reset the timer limit after settings have changed.
+ * May only be called from inside a ptimer transaction block.
+ */
 static void arm_timer_recalibrate(arm_timer_state *s, int reload)
 {
     uint32_t limit;
@@ -XXX,XX +XXX,XX @@ static void arm_timer_write(void *opaque, hwaddr offset,
     switch (offset >> 2) {
     case 0: /* TimerLoad */
         s->limit = value;
+        ptimer_transaction_begin(s->timer);
         arm_timer_recalibrate(s, 1);
+        ptimer_transaction_commit(s->timer);
         break;
     case 1: /* TimerValue */
         /* ??? Linux seems to want to write to this readonly register.
            Ignore it.  */
         break;
     case 2: /* TimerControl */
+        ptimer_transaction_begin(s->timer);
         if (s->control & TIMER_CTRL_ENABLE) {
             /* Pause the timer if it is running.  This may cause some
                inaccuracy dure to rounding, but avoids a whole lot of other
@@ -XXX,XX +XXX,XX @@ static void arm_timer_write(void *opaque, hwaddr offset,
             /* Restart the timer if still enabled.  */
             ptimer_run(s->timer, (s->control & TIMER_CTRL_ONESHOT) != 0);
         }
+        ptimer_transaction_commit(s->timer);
         break;
     case 3: /* TimerIntClr */
         s->int_level = 0;
         break;
     case 6: /* TimerBGLoad */
         s->limit = value;
+        ptimer_transaction_begin(s->timer);
         arm_timer_recalibrate(s, 0);
+        ptimer_transaction_commit(s->timer);
         break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_arm_timer = {
 static arm_timer_state *arm_timer_init(uint32_t freq)
 {
     arm_timer_state *s;
-    QEMUBH *bh;
 
     s = (arm_timer_state *)g_malloc0(sizeof(arm_timer_state));
     s->freq = freq;
     s->control = TIMER_CTRL_IE;
 
-    bh = qemu_bh_new(arm_timer_tick, s);
-    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+    s->timer = ptimer_init(arm_timer_tick, s, PTIMER_POLICY_DEFAULT);
     vmstate_register(NULL, -1, &vmstate_arm_timer, s);
     return s;
 }
-- 
2.20.1

Switch the musicpal code away from bottom-half based ptimers to
the new transaction-based ptimer API.  This just requires adding
begin/commit calls around the various places that modify the ptimer
state, and using the new ptimer_init() function to create the timer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-6-peter.maydell@linaro.org
---
 hw/arm/musicpal.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static void mv88w8618_timer_tick(void *opaque)
 static void mv88w8618_timer_init(SysBusDevice *dev, mv88w8618_timer_state *s,
                                  uint32_t freq)
 {
-    QEMUBH *bh;
-
     sysbus_init_irq(dev, &s->irq);
     s->freq = freq;
 
-    bh = qemu_bh_new(mv88w8618_timer_tick, s);
-    s->ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+    s->ptimer = ptimer_init(mv88w8618_timer_tick, s, PTIMER_POLICY_DEFAULT);
 }
 
 static uint64_t mv88w8618_pit_read(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void mv88w8618_pit_write(void *opaque, hwaddr offset,
     case MP_PIT_TIMER1_LENGTH ... MP_PIT_TIMER4_LENGTH:
         t = &s->timer[offset >> 2];
         t->limit = value;
+        ptimer_transaction_begin(t->ptimer);
         if (t->limit > 0) {
             ptimer_set_limit(t->ptimer, t->limit, 1);
         } else {
             ptimer_stop(t->ptimer);
         }
+        ptimer_transaction_commit(t->ptimer);
         break;
 
     case MP_PIT_CONTROL:
         for (i = 0; i < 4; i++) {
             t = &s->timer[i];
+            ptimer_transaction_begin(t->ptimer);
             if (value & 0xf && t->limit > 0) {
                 ptimer_set_limit(t->ptimer, t->limit, 0);
                 ptimer_set_freq(t->ptimer, t->freq);
@@ -XXX,XX +XXX,XX @@ static void mv88w8618_pit_write(void *opaque, hwaddr offset,
             } else {
                 ptimer_stop(t->ptimer);
             }
+            ptimer_transaction_commit(t->ptimer);
             value >>= 4;
         }
         break;
@@ -XXX,XX +XXX,XX @@ static void mv88w8618_pit_reset(DeviceState *d)
     int i;
 
     for (i = 0; i < 4; i++) {
-        ptimer_stop(s->timer[i].ptimer);
-        s->timer[i].limit = 0;
+        mv88w8618_timer_state *t = &s->timer[i];
+        ptimer_transaction_begin(t->ptimer);
+        ptimer_stop(t->ptimer);
+        ptimer_transaction_commit(t->ptimer);
+        t->limit = 0;
     }
 }
 
-- 
2.20.1

Switch the allwinner-a10-pit code away from bottom-half based ptimers to
the new transaction-based ptimer API.  This just requires adding
begin/commit calls around the various places that modify the ptimer
state, and using the new ptimer_init() function to create the timer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-7-peter.maydell@linaro.org
---
 hw/timer/allwinner-a10-pit.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/hw/timer/allwinner-a10-pit.c b/hw/timer/allwinner-a10-pit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/allwinner-a10-pit.c
+++ b/hw/timer/allwinner-a10-pit.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/timer/allwinner-a10-pit.h"
 #include "migration/vmstate.h"
 #include "qemu/log.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 
 static void a10_pit_update_irq(AwA10PITState *s)
@@ -XXX,XX +XXX,XX @@ static uint64_t a10_pit_read(void *opaque, hwaddr offset, unsigned size)
     return 0;
 }
 
+/* Must be called inside a ptimer transaction block for s->timer[index] */
 static void a10_pit_set_freq(AwA10PITState *s, int index)
 {
     uint32_t prescaler, source, source_freq;
@@ -XXX,XX +XXX,XX @@ static void a10_pit_write(void *opaque, hwaddr offset, uint64_t value,
         switch (offset & 0x0f) {
         case AW_A10_PIT_TIMER_CONTROL:
             s->control[index] = value;
+            ptimer_transaction_begin(s->timer[index]);
             a10_pit_set_freq(s, index);
             if (s->control[index] & AW_A10_PIT_TIMER_RELOAD) {
                 ptimer_set_count(s->timer[index], s->interval[index]);
@@ -XXX,XX +XXX,XX @@ static void a10_pit_write(void *opaque, hwaddr offset, uint64_t value,
             } else {
                 ptimer_stop(s->timer[index]);
             }
+            ptimer_transaction_commit(s->timer[index]);
             break;
         case AW_A10_PIT_TIMER_INTERVAL:
             s->interval[index] = value;
+            ptimer_transaction_begin(s->timer[index]);
             ptimer_set_limit(s->timer[index], s->interval[index], 1);
+            ptimer_transaction_commit(s->timer[index]);
             break;
         case AW_A10_PIT_TIMER_COUNT:
             s->count[index] = value;
@@ -XXX,XX +XXX,XX @@ static void a10_pit_reset(DeviceState *dev)
         s->control[i] = AW_A10_PIT_DEFAULT_CLOCK;
         s->interval[i] = 0;
         s->count[i] = 0;
+        ptimer_transaction_begin(s->timer[i]);
         ptimer_stop(s->timer[i]);
         a10_pit_set_freq(s, i);
+        ptimer_transaction_commit(s->timer[i]);
     }
     s->watch_dog_mode = 0;
     s->watch_dog_control = 0;
@@ -XXX,XX +XXX,XX @@ static void a10_pit_init(Object *obj)
 {
     AwA10PITState *s = AW_A10_PIT(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    QEMUBH * bh[AW_A10_PIT_TIMER_NR];
     uint8_t i;
 
     for (i = 0; i < AW_A10_PIT_TIMER_NR; i++) {
@@ -XXX,XX +XXX,XX @@ static void a10_pit_init(Object *obj)
 
         tc->container = s;
         tc->index = i;
-        bh[i] = qemu_bh_new(a10_pit_timer_cb, tc);
-        s->timer[i] = ptimer_init_with_bh(bh[i], PTIMER_POLICY_DEFAULT);
+        s->timer[i] = ptimer_init(a10_pit_timer_cb, tc, PTIMER_POLICY_DEFAULT);
     }
 }
 
-- 
2.20.1

Switch the arm_mptimer.c code away from bottom-half based ptimers to
the new transaction-based ptimer API.  This just requires adding
begin/commit calls around the various places that modify the ptimer
state, and using the new ptimer_init() function to create the timer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-8-peter.maydell@linaro.org
---
 hw/timer/arm_mptimer.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/timer/arm_mptimer.h"
 #include "migration/vmstate.h"
 #include "qapi/error.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "hw/core/cpu.h"
 
@@ -XXX,XX +XXX,XX @@ static inline uint32_t timerblock_scale(uint32_t control)
     return (((control >> 8) & 0xff) + 1) * 10;
 }
 
+/* Must be called within a ptimer transaction block */
 static inline void timerblock_set_count(struct ptimer_state *timer,
                                         uint32_t control, uint64_t *count)
 {
@@ -XXX,XX +XXX,XX @@ static inline void timerblock_set_count(struct ptimer_state *timer,
     ptimer_set_count(timer, *count);
 }
 
+/* Must be called within a ptimer transaction block */
 static inline void timerblock_run(struct ptimer_state *timer,
                                   uint32_t control, uint32_t load)
 {
@@ -XXX,XX +XXX,XX @@ static void timerblock_write(void *opaque, hwaddr addr,
     uint32_t control = tb->control;
     switch (addr) {
     case 0: /* Load */
+        ptimer_transaction_begin(tb->timer);
         /* Setting load to 0 stops the timer without doing the tick if
          * prescaler = 0.
          */
@@ -XXX,XX +XXX,XX @@ static void timerblock_write(void *opaque, hwaddr addr,
         }
         ptimer_set_limit(tb->timer, value, 1);
         timerblock_run(tb->timer, control, value);
+        ptimer_transaction_commit(tb->timer);
         break;
     case 4: /* Counter.  */
+        ptimer_transaction_begin(tb->timer);
         /* Setting counter to 0 stops the one-shot timer, or periodic with
          * load = 0, without doing the tick if prescaler = 0.
          */
@@ -XXX,XX +XXX,XX @@ static void timerblock_write(void *opaque, hwaddr addr,
         }
         timerblock_set_count(tb->timer, control, &value);
         timerblock_run(tb->timer, control, value);
+        ptimer_transaction_commit(tb->timer);
         break;
     case 8: /* Control.  */
+        ptimer_transaction_begin(tb->timer);
         if ((control & 3) != (value & 3)) {
             ptimer_stop(tb->timer);
         }
@@ -XXX,XX +XXX,XX @@ static void timerblock_write(void *opaque, hwaddr addr,
             timerblock_run(tb->timer, value, count);
         }
         tb->control = value;
+        ptimer_transaction_commit(tb->timer);
         break;
     case 12: /* Interrupt status.  */
         tb->status &= ~value;
@@ -XXX,XX +XXX,XX @@ static void timerblock_reset(TimerBlock *tb)
     tb->control = 0;
     tb->status = 0;
     if (tb->timer) {
+        ptimer_transaction_begin(tb->timer);
         ptimer_stop(tb->timer);
         ptimer_set_limit(tb->timer, 0, 1);
         ptimer_set_period(tb->timer, timerblock_scale(0));
+        ptimer_transaction_commit(tb->timer);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void arm_mptimer_realize(DeviceState *dev, Error **errp)
      */
     for (i = 0; i < s->num_cpu; i++) {
         TimerBlock *tb = &s->timerblock[i];
-        QEMUBH *bh = qemu_bh_new(timerblock_tick, tb);
-        tb->timer = ptimer_init_with_bh(bh, PTIMER_POLICY);
+        tb->timer = ptimer_init(timerblock_tick, tb, PTIMER_POLICY);
         sysbus_init_irq(sbd, &tb->irq);
         memory_region_init_io(&tb->iomem, OBJECT(s), &timerblock_ops, tb,
                               "arm_mptimer_timerblock", 0x20);
-- 
2.20.1

Switch the cmsdk-apb-dualtimer code away from bottom-half based
ptimers to the new transaction-based ptimer API.  This just requires
adding begin/commit calls around the various places that modify the
ptimer state, and using the new ptimer_init() function to create the
timer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-9-peter.maydell@linaro.org
---
 hw/timer/cmsdk-apb-dualtimer.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-dualtimer.c
+++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "trace.h"
 #include "qapi/error.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "hw/sysbus.h"
 #include "hw/irq.h"
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
     /* Handle a write to the CONTROL register */
     uint32_t changed;
 
+    ptimer_transaction_begin(m->timer);
+
     newctrl &= R_CONTROL_VALID_MASK;
 
     changed = m->control ^ newctrl;
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
     }
 
     m->control = newctrl;
+
+    ptimer_transaction_commit(m->timer);
 }
 
 static uint64_t cmsdk_apb_dualtimer_read(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_write(void *opaque, hwaddr offset,
             if (!(m->control & R_CONTROL_SIZE_MASK)) {
                 value &= 0xffff;
             }
+            ptimer_transaction_begin(m->timer);
             if (!(m->control & R_CONTROL_MODE_MASK)) {
                 /*
                  * In free-running mode this won't set the limit but will
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_write(void *opaque, hwaddr offset,
                     ptimer_run(m->timer, 1);
                 }
             }
+            ptimer_transaction_commit(m->timer);
             break;
         case A_TIMER1BGLOAD:
             /* Set the limit, but not the current count */
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_write(void *opaque, hwaddr offset,
             if (!(m->control & R_CONTROL_SIZE_MASK)) {
                 value &= 0xffff;
             }
+            ptimer_transaction_begin(m->timer);
             ptimer_set_limit(m->timer, value, 0);
+            ptimer_transaction_commit(m->timer);
             break;
         case A_TIMER1CONTROL:
             cmsdk_dualtimermod_write_control(m, value);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_reset(CMSDKAPBDualTimerModule *m)
     m->intstatus = 0;
     m->load = 0;
     m->value = 0xffffffff;
+    ptimer_transaction_begin(m->timer);
     ptimer_stop(m->timer);
     /*
      * We start in free-running mode, with VALUE at 0xffffffff, and
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_reset(CMSDKAPBDualTimerModule *m)
      */
     ptimer_set_limit(m->timer, 0xffff, 1);
     ptimer_set_freq(m->timer, m->parent->pclk_frq);
+    ptimer_transaction_commit(m->timer);
 }
 
 static void cmsdk_apb_dualtimer_reset(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
 
     for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
         CMSDKAPBDualTimerModule *m = &s->timermod[i];
-        QEMUBH *bh = qemu_bh_new(cmsdk_dualtimermod_tick, m);
 
         m->parent = s;
-        m->timer = ptimer_init_with_bh(bh,
+        m->timer = ptimer_init(cmsdk_dualtimermod_tick, m,
                                PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
                                PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
                                PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
-- 
2.20.1

Switch the cmsdk-apb-timer code away from bottom-half based ptimers
to the new transaction-based ptimer API.  This just requires adding
begin/commit calls around the various places that modify the ptimer
state, and using the new ptimer_init() function to create the timer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-10-peter.maydell@linaro.org
---
 hw/timer/cmsdk-apb-timer.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qemu/log.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
 #include "trace.h"
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
                           "CMSDK APB timer: EXTIN input not supported\n");
         }
         s->ctrl = value & 0xf;
+        ptimer_transaction_begin(s->timer);
         if (s->ctrl & R_CTRL_EN_MASK) {
             ptimer_run(s->timer, ptimer_get_limit(s->timer) == 0);
         } else {
             ptimer_stop(s->timer);
         }
+        ptimer_transaction_commit(s->timer);
         break;
     case A_RELOAD:
         /* Writing to reload also sets the current timer value */
+        ptimer_transaction_begin(s->timer);
         if (!value) {
             ptimer_stop(s->timer);
         }
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
              */
             ptimer_run(s->timer, 0);
         }
+        ptimer_transaction_commit(s->timer);
         break;
     case A_VALUE:
+        ptimer_transaction_begin(s->timer);
         if (!value && !ptimer_get_limit(s->timer)) {
             ptimer_stop(s->timer);
         }
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
         if (value && (s->ctrl & R_CTRL_EN_MASK)) {
             ptimer_run(s->timer, ptimer_get_limit(s->timer) == 0);
         }
+        ptimer_transaction_commit(s->timer);
         break;
     case A_INTSTATUS:
         /* Just one bit, which is W1C. */
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_reset(DeviceState *dev)
     trace_cmsdk_apb_timer_reset();
     s->ctrl = 0;
     s->intstatus = 0;
+    ptimer_transaction_begin(s->timer);
     ptimer_stop(s->timer);
     /* Set the limit and the count */
     ptimer_set_limit(s->timer, 0, 1);
+    ptimer_transaction_commit(s->timer);
 }
 
 static void cmsdk_apb_timer_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
 static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
 {
     CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
-    QEMUBH *bh;
 
     if (s->pclk_frq == 0) {
         error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
         return;
     }
 
-    bh = qemu_bh_new(cmsdk_apb_timer_tick, s);
-    s->timer = ptimer_init_with_bh(bh,
+    s->timer = ptimer_init(cmsdk_apb_timer_tick, s,
                            PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
                            PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
                            PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
+    ptimer_transaction_begin(s->timer);
     ptimer_set_freq(s->timer, s->pclk_frq);
+    ptimer_transaction_commit(s->timer);
 }
 
 static const VMStateDescription cmsdk_apb_timer_vmstate = {
-- 
2.20.1

Switch the digic-timer.c code away from bottom-half based ptimers to
the new transaction-based ptimer API.  This just requires adding
begin/commit calls around the various places that modify the ptimer
state, and using the new ptimer_init() function to create the timer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-11-peter.maydell@linaro.org
---
 hw/timer/digic-timer.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/hw/timer/digic-timer.c b/hw/timer/digic-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/digic-timer.c
+++ b/hw/timer/digic-timer.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/sysbus.h"
 #include "hw/ptimer.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qemu/log.h"
 
@@ -XXX,XX +XXX,XX @@ static void digic_timer_reset(DeviceState *dev)
 {
     DigicTimerState *s = DIGIC_TIMER(dev);
 
+    ptimer_transaction_begin(s->ptimer);
     ptimer_stop(s->ptimer);
+    ptimer_transaction_commit(s->ptimer);
     s->control = 0;
     s->relvalue = 0;
 }
@@ -XXX,XX +XXX,XX @@ static void digic_timer_write(void *opaque, hwaddr offset,
             break;
         }
 
+        ptimer_transaction_begin(s->ptimer);
         if (value & DIGIC_TIMER_CONTROL_EN) {
             ptimer_run(s->ptimer, 0);
         }
 
         s->control = (uint32_t)value;
+        ptimer_transaction_commit(s->ptimer);
         break;
 
     case DIGIC_TIMER_RELVALUE:
         s->relvalue = extract32(value, 0, 16);
+        ptimer_transaction_begin(s->ptimer);
         ptimer_set_limit(s->ptimer, s->relvalue, 1);
+        ptimer_transaction_commit(s->ptimer);
         break;
 
     case DIGIC_TIMER_VALUE:
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps digic_timer_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
+static void digic_timer_tick(void *opaque)
+{
+    /* Nothing to do on timer rollover */
+}
+
 static void digic_timer_init(Object *obj)
 {
     DigicTimerState *s = DIGIC_TIMER(obj);
 
-    s->ptimer = ptimer_init_with_bh(NULL, PTIMER_POLICY_DEFAULT);
+    s->ptimer = ptimer_init(digic_timer_tick, NULL, PTIMER_POLICY_DEFAULT);
 
     /*
      * FIXME: there is no documentation on Digic timer
      * frequency setup so let it always run at 1 MHz
      */
+    ptimer_transaction_begin(s->ptimer);
     ptimer_set_freq(s->ptimer, 1 * 1000 * 1000);
+    ptimer_transaction_commit(s->ptimer);
 
     memory_region_init_io(&s->iomem, OBJECT(s), &digic_timer_ops, s,
                           TYPE_DIGIC_TIMER, 0x100);
-- 
2.20.1

We want to switch the exynos MCT code away from bottom-half based ptimers to
the new transaction-based ptimer API. The MCT is complicated
and uses multiple different ptimers, so it's clearer to switch
it a piece at a time. Here we change over only the GFRC.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-12-peter.maydell@linaro.org
---
 hw/timer/exynos4210_mct.c | 48 ++++++++++++++++++++++++++++++++++++---
 1 file changed, 45 insertions(+), 3 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s);
 
 /*
  * Set counter of FRC global timer.
+ * Must be called within exynos4210_gfrc_tx_begin/commit block.
  */
 static void exynos4210_gfrc_set_count(Exynos4210MCTGT *s, uint64_t count)
 {
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_gfrc_get_count(Exynos4210MCTGT *s)
 
 /*
  * Stop global FRC timer
+ * Must be called within exynos4210_gfrc_tx_begin/commit block.
  */
 static void exynos4210_gfrc_stop(Exynos4210MCTGT *s)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gfrc_stop(Exynos4210MCTGT *s)
 
 /*
  * Start global FRC timer
+ * Must be called within exynos4210_gfrc_tx_begin/commit block.
  */
 static void exynos4210_gfrc_start(Exynos4210MCTGT *s)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gfrc_start(Exynos4210MCTGT *s)
     ptimer_run(s->ptimer_frc, 1);
 }
 
+/*
+ * Start ptimer transaction for global FRC timer; this is just for
+ * consistency with the way we wrap operations like stop and run.
+ */
+static void exynos4210_gfrc_tx_begin(Exynos4210MCTGT *s)
+{
+    ptimer_transaction_begin(s->ptimer_frc);
+}
+
+/* Commit ptimer transaction for global FRC timer. */
+static void exynos4210_gfrc_tx_commit(Exynos4210MCTGT *s)
+{
+    ptimer_transaction_commit(s->ptimer_frc);
+}
+
 /*
  * Find next nearest Comparator. If current Comparator value equals to other
  * Comparator value, skip them both
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_gcomp_get_distance(Exynos4210MCTState *s, int32_t id)
 
 /*
  * Restart global FRC timer
+ * Must be called within exynos4210_gfrc_tx_begin/commit block.
  */
 static void exynos4210_gfrc_restart(Exynos4210MCTState *s)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_ltick_event(void *opaque)
     exynos4210_ltick_int_start(&s->tick_timer);
 }
 
+static void tx_ptimer_set_freq(ptimer_state *s, uint32_t freq)
+{
+    /*
+     * callers of exynos4210_mct_update_freq() never do anything
+     * else that needs to be in the same ptimer transaction, so
+     * to avoid a lot of repetition we have a convenience function
+     * for begin/set_freq/commit.
+     */
+    ptimer_transaction_begin(s);
+    ptimer_set_freq(s, freq);
+    ptimer_transaction_commit(s);
+}
+
 /* update timer frequency */
 static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
         DPRINTF("freq=%dHz\n", s->freq);
 
         /* global timer */
-        ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
+        tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
 
         /* local timer */
         ptimer_set_freq(s->l_timer[0].tick_timer.ptimer_tick, s->freq);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_reset(DeviceState *d)
 
     /* global timer */
     memset(&s->g_timer.reg, 0, sizeof(s->g_timer.reg));
+    exynos4210_gfrc_tx_begin(&s->g_timer);
     exynos4210_gfrc_stop(&s->g_timer);
+    exynos4210_gfrc_tx_commit(&s->g_timer);
 
     /* local timer */
     memset(s->l_timer[0].reg.cnt, 0, sizeof(s->l_timer[0].reg.cnt));
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         }
 
         s->g_timer.reg.cnt = new_frc;
+        exynos4210_gfrc_tx_begin(&s->g_timer);
         exynos4210_gfrc_restart(s);
+        exynos4210_gfrc_tx_commit(&s->g_timer);
         break;
 
     case G_CNT_WSTAT:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
             s->g_timer.reg.wstat |= G_WSTAT_COMP_L(index);
         }
 
+        exynos4210_gfrc_tx_begin(&s->g_timer);
         exynos4210_gfrc_restart(s);
+        exynos4210_gfrc_tx_commit(&s->g_timer);
         break;
 
     case G_TCON:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
 
         DPRINTF("global timer write to reg.g_tcon %llx\n", value);
 
+        exynos4210_gfrc_tx_begin(&s->g_timer);
+
         /* Start FRC if transition from disabled to enabled */
         if ((value & G_TCON_TIMER_ENABLE) > (old_val &
                 G_TCON_TIMER_ENABLE)) {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
                 exynos4210_gfrc_restart(s);
             }
         }
+
+        exynos4210_gfrc_tx_commit(&s->g_timer);
         break;
 
     case G_INT_CSTAT:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
     QEMUBH *bh[2];
 
     /* Global timer */
-    bh[0] = qemu_bh_new(exynos4210_gfrc_event, s);
-    s->g_timer.ptimer_frc = ptimer_init_with_bh(bh[0], PTIMER_POLICY_DEFAULT);
+    s->g_timer.ptimer_frc = ptimer_init(exynos4210_gfrc_event, s,
+                                        PTIMER_POLICY_DEFAULT);
     memset(&s->g_timer.reg, 0, sizeof(struct gregs));
 
     /* Local timers */
-- 
2.20.1

Switch the exynos MCT LFRC timers over to the ptimer transaction API.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-13-peter.maydell@linaro.org
---
 hw/timer/exynos4210_mct.c | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_lfrc_get_count(Exynos4210MCTLT *s)
 
 /*
  * Set counter of FRC local timer.
+ * Must be called from within exynos4210_lfrc_tx_begin/commit block.
  */
 static void exynos4210_lfrc_update_count(Exynos4210MCTLT *s)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_lfrc_update_count(Exynos4210MCTLT *s)
 
 /*
  * Start local FRC timer
+ * Must be called from within exynos4210_lfrc_tx_begin/commit block.
  */
 static void exynos4210_lfrc_start(Exynos4210MCTLT *s)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_lfrc_start(Exynos4210MCTLT *s)
 
 /*
  * Stop local FRC timer
+ * Must be called from within exynos4210_lfrc_tx_begin/commit block.
  */
 static void exynos4210_lfrc_stop(Exynos4210MCTLT *s)
 {
     ptimer_stop(s->ptimer_frc);
 }
 
+/* Start ptimer transaction for local FRC timer */
+static void exynos4210_lfrc_tx_begin(Exynos4210MCTLT *s)
+{
+    ptimer_transaction_begin(s->ptimer_frc);
+}
+
+/* Commit ptimer transaction for local FRC timer */
+static void exynos4210_lfrc_tx_commit(Exynos4210MCTLT *s)
+{
+    ptimer_transaction_commit(s->ptimer_frc);
+}
+
 /*
  * Local timer free running counter tick handler
  */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
 
         /* local timer */
         ptimer_set_freq(s->l_timer[0].tick_timer.ptimer_tick, s->freq);
-        ptimer_set_freq(s->l_timer[0].ptimer_frc, s->freq);
+        tx_ptimer_set_freq(s->l_timer[0].ptimer_frc, s->freq);
         ptimer_set_freq(s->l_timer[1].tick_timer.ptimer_tick, s->freq);
-        ptimer_set_freq(s->l_timer[1].ptimer_frc, s->freq);
+        tx_ptimer_set_freq(s->l_timer[1].ptimer_frc, s->freq);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_reset(DeviceState *d)
         s->l_timer[i].tick_timer.count = 0;
         s->l_timer[i].tick_timer.distance = 0;
         s->l_timer[i].tick_timer.progress = 0;
+        exynos4210_lfrc_tx_begin(&s->l_timer[i]);
         ptimer_stop(s->l_timer[i].ptimer_frc);
+        exynos4210_lfrc_tx_commit(&s->l_timer[i]);
 
         exynos4210_ltick_timer_init(&s->l_timer[i].tick_timer);
     }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         }
 
         /* Start or Stop local FRC if TCON changed */
+        exynos4210_lfrc_tx_begin(&s->l_timer[lt_i]);
         if ((value & L_TCON_FRC_START) >
         (s->l_timer[lt_i].reg.tcon & L_TCON_FRC_START)) {
             DPRINTF("local timer[%d] start frc\n", lt_i);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
             DPRINTF("local timer[%d] stop frc\n", lt_i);
             exynos4210_lfrc_stop(&s->l_timer[lt_i]);
         }
+        exynos4210_lfrc_tx_commit(&s->l_timer[lt_i]);
         break;
 
     case L0_TCNTB: case L1_TCNTB:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
     /* Local timers */
     for (i = 0; i < 2; i++) {
         bh[0] = qemu_bh_new(exynos4210_ltick_event, &s->l_timer[i]);
-        bh[1] = qemu_bh_new(exynos4210_lfrc_event, &s->l_timer[i]);
         s->l_timer[i].tick_timer.ptimer_tick =
             ptimer_init_with_bh(bh[0], PTIMER_POLICY_DEFAULT);
         s->l_timer[i].ptimer_frc =
-            ptimer_init_with_bh(bh[1], PTIMER_POLICY_DEFAULT);
+            ptimer_init(exynos4210_lfrc_event, &s->l_timer[i],
+                        PTIMER_POLICY_DEFAULT);
         s->l_timer[i].id = i;
     }
 
-- 
2.20.1

Switch the ltick ptimer over to the ptimer transaction API.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-14-peter.maydell@linaro.org
---
 hw/timer/exynos4210_mct.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "qemu/timer.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "hw/ptimer.h"
 
@@ -XXX,XX +XXX,XX @@ static uint32_t exynos4210_ltick_int_get_cnto(struct tick_timer *s)
 
 /*
  * Start local tick cnt timer.
+ * Must be called within exynos4210_ltick_tx_begin/commit block.
  */
 static void exynos4210_ltick_cnt_start(struct tick_timer *s)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_ltick_cnt_start(struct tick_timer *s)
 
 /*
  * Stop local tick cnt timer.
+ * Must be called within exynos4210_ltick_tx_begin/commit block.
  */
 static void exynos4210_ltick_cnt_stop(struct tick_timer *s)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_ltick_cnt_stop(struct tick_timer *s)
     }
 }
 
+/* Start ptimer transaction for local tick timer */
+static void exynos4210_ltick_tx_begin(struct tick_timer *s)
+{
+    ptimer_transaction_begin(s->ptimer_tick);
+}
+
+/* Commit ptimer transaction for local tick timer */
+static void exynos4210_ltick_tx_commit(struct tick_timer *s)
+{
+    ptimer_transaction_commit(s->ptimer_tick);
+}
+
 /*
  * Get counter for CNT timer
  */
@@ -XXX,XX +XXX,XX @@ static uint32_t exynos4210_ltick_cnt_get_cnto(struct tick_timer *s)
 
 /*
  * Set new values of counters for CNT and INT timers
+ * Must be called within exynos4210_ltick_tx_begin/commit block.
  */
 static void exynos4210_ltick_set_cntb(struct tick_timer *s, uint32_t new_cnt,
         uint32_t new_int)
@@ -XXX,XX +XXX,XX @@ static void exynos4210_ltick_recalc_count(struct tick_timer *s)
 static void exynos4210_ltick_timer_init(struct tick_timer *s)
 {
     exynos4210_ltick_int_stop(s);
+    exynos4210_ltick_tx_begin(s);
     exynos4210_ltick_cnt_stop(s);
+    exynos4210_ltick_tx_commit(s);
 
     s->count = 0;
     s->distance = 0;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
         tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
 
         /* local timer */
-        ptimer_set_freq(s->l_timer[0].tick_timer.ptimer_tick, s->freq);
+        tx_ptimer_set_freq(s->l_timer[0].tick_timer.ptimer_tick, s->freq);
         tx_ptimer_set_freq(s->l_timer[0].ptimer_frc, s->freq);
-        ptimer_set_freq(s->l_timer[1].tick_timer.ptimer_tick, s->freq);
+        tx_ptimer_set_freq(s->l_timer[1].tick_timer.ptimer_tick, s->freq);
         tx_ptimer_set_freq(s->l_timer[1].ptimer_frc, s->freq);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
         s->l_timer[lt_i].reg.wstat |= L_WSTAT_TCON_WRITE;
         s->l_timer[lt_i].reg.tcon = value;
 
+        exynos4210_ltick_tx_begin(&s->l_timer[lt_i].tick_timer);
         /* Stop local CNT */
         if ((value & L_TCON_TICK_START) <
                 (old_val & L_TCON_TICK_START)) {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
             DPRINTF("local timer[%d] start int\n", lt_i);
             exynos4210_ltick_int_start(&s->l_timer[lt_i].tick_timer);
         }
+        exynos4210_ltick_tx_commit(&s->l_timer[lt_i].tick_timer);
 
         /* Start or Stop local FRC if TCON changed */
         exynos4210_lfrc_tx_begin(&s->l_timer[lt_i]);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_write(void *opaque, hwaddr offset,
          * Due to this we should reload timer to nearest moment when CNT is
          * expired and then in event handler update tcntb to new TCNTB value.
          */
+        exynos4210_ltick_tx_begin(&s->l_timer[lt_i].tick_timer);
         exynos4210_ltick_set_cntb(&s->l_timer[lt_i].tick_timer, value,
                 s->l_timer[lt_i].tick_timer.icntb);
+        exynos4210_ltick_tx_commit(&s->l_timer[lt_i].tick_timer);
 
         s->l_timer[lt_i].reg.wstat |= L_WSTAT_TCNTB_WRITE;
         s->l_timer[lt_i].reg.cnt[L_REG_CNT_TCNTB] = value;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
     int i;
     Exynos4210MCTState *s = EXYNOS4210_MCT(obj);
     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
-    QEMUBH *bh[2];
 
     /* Global timer */
     s->g_timer.ptimer_frc = ptimer_init(exynos4210_gfrc_event, s,
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_init(Object *obj)
 
     /* Local timers */
     for (i = 0; i < 2; i++) {
-        bh[0] = qemu_bh_new(exynos4210_ltick_event, &s->l_timer[i]);
         s->l_timer[i].tick_timer.ptimer_tick =
-            ptimer_init_with_bh(bh[0], PTIMER_POLICY_DEFAULT);
+            ptimer_init(exynos4210_ltick_event, &s->l_timer[i],
+                        PTIMER_POLICY_DEFAULT);
         s->l_timer[i].ptimer_frc =
             ptimer_init(exynos4210_lfrc_event, &s->l_timer[i],
                         PTIMER_POLICY_DEFAULT);
-- 
2.20.1

Switch the exynos4210_pwm code away from bottom-half based ptimers to
the new transaction-based ptimer API.  This just requires adding
begin/commit calls around the various places that modify the ptimer
state, and using the new ptimer_init() function to create the timer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-15-peter.maydell@linaro.org
---
 hw/timer/exynos4210_pwm.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "qemu/timer.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "hw/ptimer.h"
 
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_exynos4210_pwm_state = {
 };
 
 /*
- * PWM update frequency
+ * PWM update frequency.
+ * Must be called within a ptimer_transaction_begin/commit block
+ * for s->timer[id].ptimer.
  */
 static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
 {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_write(void *opaque, hwaddr offset,
 
         /* update timers frequencies */
         for (i = 0; i < EXYNOS4210_PWM_TIMERS_NUM; i++) {
+            ptimer_transaction_begin(s->timer[i].ptimer);
             exynos4210_pwm_update_freq(s, s->timer[i].id);
+            ptimer_transaction_commit(s->timer[i].ptimer);
         }
         break;
 
     case TCON:
         for (i = 0; i < EXYNOS4210_PWM_TIMERS_NUM; i++) {
+            ptimer_transaction_begin(s->timer[i].ptimer);
             if ((value & TCON_TIMER_MANUAL_UPD(i)) >
             (s->reg_tcon & TCON_TIMER_MANUAL_UPD(i))) {
                 /*
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_write(void *opaque, hwaddr offset,
                 ptimer_stop(s->timer[i].ptimer);
                 DPRINTF("stop timer %d\n", i);
             }
+            ptimer_transaction_commit(s->timer[i].ptimer);
         }
         s->reg_tcon = value;
         break;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_reset(DeviceState *d)
         s->timer[i].reg_tcmpb = 0;
         s->timer[i].reg_tcntb = 0;
 
+        ptimer_transaction_begin(s->timer[i].ptimer);
         exynos4210_pwm_update_freq(s, s->timer[i].id);
         ptimer_stop(s->timer[i].ptimer);
+        ptimer_transaction_commit(s->timer[i].ptimer);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_init(Object *obj)
     Exynos4210PWMState *s = EXYNOS4210_PWM(obj);
     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
     int i;
-    QEMUBH *bh;
 
     for (i = 0; i < EXYNOS4210_PWM_TIMERS_NUM; i++) {
-        bh = qemu_bh_new(exynos4210_pwm_tick, &s->timer[i]);
         sysbus_init_irq(dev, &s->timer[i].irq);
-        s->timer[i].ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+        s->timer[i].ptimer = ptimer_init(exynos4210_pwm_tick,
+                                         &s->timer[i],
+                                         PTIMER_POLICY_DEFAULT);
         s->timer[i].id = i;
         s->timer[i].parent = s;
     }
-- 
2.20.1

Switch the exynos41210_rtc 1Hz ptimer over to the transaction-based
API. (We will switch the other ptimer used by this device in a
separate commit.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-16-peter.maydell@linaro.org
---
 hw/timer/exynos4210_rtc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_rtc.c
+++ b/hw/timer/exynos4210_rtc.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_write(void *opaque, hwaddr offset,
         }
         break;
     case RTCCON:
+        ptimer_transaction_begin(s->ptimer_1Hz);
         if (value & RTC_ENABLE) {
             exynos4210_rtc_update_freq(s, value);
         }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_write(void *opaque, hwaddr offset,
                 ptimer_stop(s->ptimer);
             }
         }
+        ptimer_transaction_commit(s->ptimer_1Hz);
         s->reg_rtccon = value;
         break;
     case TICCNT:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_reset(DeviceState *d)
 
     exynos4210_rtc_update_freq(s, s->reg_rtccon);
     ptimer_stop(s->ptimer);
+    ptimer_transaction_begin(s->ptimer_1Hz);
     ptimer_stop(s->ptimer_1Hz);
+    ptimer_transaction_commit(s->ptimer_1Hz);
 }
 
 static const MemoryRegionOps exynos4210_rtc_ops = {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_init(Object *obj)
     ptimer_set_freq(s->ptimer, RTC_BASE_FREQ);
     exynos4210_rtc_update_freq(s, 0);
 
-    bh = qemu_bh_new(exynos4210_rtc_1Hz_tick, s);
-    s->ptimer_1Hz = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+    s->ptimer_1Hz = ptimer_init(exynos4210_rtc_1Hz_tick,
+                                s, PTIMER_POLICY_DEFAULT);
+    ptimer_transaction_begin(s->ptimer_1Hz);
     ptimer_set_freq(s->ptimer_1Hz, RTC_BASE_FREQ);
+    ptimer_transaction_commit(s->ptimer_1Hz);
 
     sysbus_init_irq(dev, &s->alm_irq);
     sysbus_init_irq(dev, &s->tick_irq);
-- 
2.20.1

Switch the exynos41210_rtc main ptimer over to the transaction-based
API, completing the transition for this device.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-17-peter.maydell@linaro.org
---
 hw/timer/exynos4210_rtc.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/hw/timer/exynos4210_rtc.c b/hw/timer/exynos4210_rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_rtc.c
+++ b/hw/timer/exynos4210_rtc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu-common.h"
 #include "qemu/log.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@ static void check_alarm_raise(Exynos4210RTCState *s)
  * RTC update frequency
  * Parameters:
  *     reg_value - current RTCCON register or his new value
+ * Must be called within a ptimer_transaction_begin/commit block for s->ptimer.
  */
 static void exynos4210_rtc_update_freq(Exynos4210RTCState *s,
                                        uint32_t reg_value)
@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_write(void *opaque, hwaddr offset,
         break;
     case RTCCON:
         ptimer_transaction_begin(s->ptimer_1Hz);
+        ptimer_transaction_begin(s->ptimer);
         if (value & RTC_ENABLE) {
             exynos4210_rtc_update_freq(s, value);
         }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_write(void *opaque, hwaddr offset,
             }
         }
         ptimer_transaction_commit(s->ptimer_1Hz);
+        ptimer_transaction_commit(s->ptimer);
         s->reg_rtccon = value;
         break;
     case TICCNT:
@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_reset(DeviceState *d)
 
     s->reg_curticcnt = 0;
 
+    ptimer_transaction_begin(s->ptimer);
     exynos4210_rtc_update_freq(s, s->reg_rtccon);
     ptimer_stop(s->ptimer);
+    ptimer_transaction_commit(s->ptimer);
     ptimer_transaction_begin(s->ptimer_1Hz);
     ptimer_stop(s->ptimer_1Hz);
     ptimer_transaction_commit(s->ptimer_1Hz);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_rtc_init(Object *obj)
 {
     Exynos4210RTCState *s = EXYNOS4210_RTC(obj);
     SysBusDevice *dev = SYS_BUS_DEVICE(obj);
-    QEMUBH *bh;
 
-    bh = qemu_bh_new(exynos4210_rtc_tick, s);
-    s->ptimer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+    s->ptimer = ptimer_init(exynos4210_rtc_tick, s, PTIMER_POLICY_DEFAULT);
+    ptimer_transaction_begin(s->ptimer);
     ptimer_set_freq(s->ptimer, RTC_BASE_FREQ);
     exynos4210_rtc_update_freq(s, 0);
+    ptimer_transaction_commit(s->ptimer);
 
     s->ptimer_1Hz = ptimer_init(exynos4210_rtc_1Hz_tick,
                                 s, PTIMER_POLICY_DEFAULT);
-- 
2.20.1

Switch the imx_epit.c code away from bottom-half based ptimers to
the new transaction-based ptimer API.  This just requires adding
begin/commit calls around the various places that modify the ptimer
state, and using the new ptimer_init() function to create the timer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-18-peter.maydell@linaro.org
---
 hw/timer/imx_epit.c | 32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/imx_epit.c
+++ b/hw/timer/imx_epit.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "hw/irq.h"
 #include "hw/misc/imx_ccm.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qemu/log.h"
 
@@ -XXX,XX +XXX,XX @@ static void imx_epit_update_int(IMXEPITState *s)
     }
 }
 
+/*
+ * Must be called from within a ptimer_transaction_begin/commit block
+ * for both s->timer_cmp and s->timer_reload.
+ */
 static void imx_epit_set_freq(IMXEPITState *s)
 {
     uint32_t clksrc;
@@ -XXX,XX +XXX,XX @@ static void imx_epit_reset(DeviceState *dev)
     s->lr = EPIT_TIMER_MAX;
     s->cmp = 0;
     s->cnt = 0;
+    ptimer_transaction_begin(s->timer_cmp);
+    ptimer_transaction_begin(s->timer_reload);
     /* stop both timers */
     ptimer_stop(s->timer_cmp);
     ptimer_stop(s->timer_reload);
@@ -XXX,XX +XXX,XX @@ static void imx_epit_reset(DeviceState *dev)
         /* if the timer is still enabled, restart it */
         ptimer_run(s->timer_reload, 0);
     }
+    ptimer_transaction_commit(s->timer_cmp);
+    ptimer_transaction_commit(s->timer_reload);
 }
 
 static uint32_t imx_epit_update_count(IMXEPITState *s)
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_epit_read(void *opaque, hwaddr offset, unsigned size)
     return reg_value;
 }
 
+/* Must be called from ptimer_transaction_begin/commit block for s->timer_cmp */
 static void imx_epit_reload_compare_timer(IMXEPITState *s)
 {
     if ((s->cr & (CR_EN | CR_OCIEN)) == (CR_EN | CR_OCIEN))  {
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
 
     switch (offset >> 2) {
     case 0: /* CR */
+        ptimer_transaction_begin(s->timer_cmp);
+        ptimer_transaction_begin(s->timer_reload);
 
         oldcr = s->cr;
         s->cr = value & 0x03ffffff;
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
         } else {
             ptimer_stop(s->timer_cmp);
         }
+
+        ptimer_transaction_commit(s->timer_cmp);
+        ptimer_transaction_commit(s->timer_reload);
         break;
 
     case 1: /* SR - ACK*/
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
     case 2: /* LR - set ticks */
         s->lr = value;
 
+        ptimer_transaction_begin(s->timer_cmp);
+        ptimer_transaction_begin(s->timer_reload);
         if (s->cr & CR_RLD) {
             /* Also set the limit if the LRD bit is set */
             /* If IOVW bit is set then set the timer value */
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
         }
 
         imx_epit_reload_compare_timer(s);
+        ptimer_transaction_commit(s->timer_cmp);
+        ptimer_transaction_commit(s->timer_reload);
         break;
 
     case 3: /* CMP */
         s->cmp = value;
 
+        ptimer_transaction_begin(s->timer_cmp);
         imx_epit_reload_compare_timer(s);
+        ptimer_transaction_commit(s->timer_cmp);
 
         break;
 
@@ -XXX,XX +XXX,XX @@ static void imx_epit_cmp(void *opaque)
     imx_epit_update_int(s);
 }
 
+static void imx_epit_reload(void *opaque)
+{
+    /* No action required on rollover of timer_reload */
+}
+
 static const MemoryRegionOps imx_epit_ops = {
     .read = imx_epit_read,
     .write = imx_epit_write,
@@ -XXX,XX +XXX,XX @@ static void imx_epit_realize(DeviceState *dev, Error **errp)
 {
     IMXEPITState *s = IMX_EPIT(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-    QEMUBH *bh;
 
     DPRINTF("\n");
 
@@ -XXX,XX +XXX,XX @@ static void imx_epit_realize(DeviceState *dev, Error **errp)
                           0x00001000);
     sysbus_init_mmio(sbd, &s->iomem);
 
-    s->timer_reload = ptimer_init_with_bh(NULL, PTIMER_POLICY_DEFAULT);
+    s->timer_reload = ptimer_init(imx_epit_reload, s, PTIMER_POLICY_DEFAULT);
 
-    bh = qemu_bh_new(imx_epit_cmp, s);
-    s->timer_cmp = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+    s->timer_cmp = ptimer_init(imx_epit_cmp, s, PTIMER_POLICY_DEFAULT);
 }
 
 static void imx_epit_class_init(ObjectClass *klass, void *data)
-- 
2.20.1

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-19-peter.maydell@linaro.org
---
 hw/timer/imx_gpt.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/hw/timer/imx_gpt.c b/hw/timer/imx_gpt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/imx_gpt.c
+++ b/hw/timer/imx_gpt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/timer/imx_gpt.h"
 #include "migration/vmstate.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qemu/log.h"
 
@@ -XXX,XX +XXX,XX @@ static const IMXClk imx7_gpt_clocks[] = {
     CLK_NONE,      /* 111 not defined */
 };
 
+/* Must be called from within ptimer_transaction_begin/commit block */
 static void imx_gpt_set_freq(IMXGPTState *s)
 {
     uint32_t clksrc = extract32(s->cr, GPT_CR_CLKSRC_SHIFT, 3);
@@ -XXX,XX +XXX,XX @@ static inline uint32_t imx_gpt_find_limit(uint32_t count, uint32_t reg,
     return timeout;
 }
 
+/* Must be called from within ptimer_transaction_begin/commit block */
 static void imx_gpt_compute_next_timeout(IMXGPTState *s, bool event)
 {
     uint32_t timeout = GPT_TIMER_MAX;
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_gpt_read(void *opaque, hwaddr offset, unsigned size)
 
 static void imx_gpt_reset_common(IMXGPTState *s, bool is_soft_reset)
 {
+    ptimer_transaction_begin(s->timer);
     /* stop timer */
     ptimer_stop(s->timer);
 
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_reset_common(IMXGPTState *s, bool is_soft_reset)
     if (s->freq && (s->cr & GPT_CR_EN)) {
         ptimer_run(s->timer, 1);
     }
+    ptimer_transaction_commit(s->timer);
 }
 
 static void imx_gpt_soft_reset(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
             imx_gpt_soft_reset(DEVICE(s));
         } else {
             /* set our freq, as the source might have changed */
+            ptimer_transaction_begin(s->timer);
             imx_gpt_set_freq(s);
 
             if ((oldreg ^ s->cr) & GPT_CR_EN) {
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
                     ptimer_stop(s->timer);
                 }
             }
+            ptimer_transaction_commit(s->timer);
         }
         break;
 
     case 1: /* Prescaler */
         s->pr = value & 0xfff;
+        ptimer_transaction_begin(s->timer);
         imx_gpt_set_freq(s);
+        ptimer_transaction_commit(s->timer);
         break;
 
     case 2: /* SR */
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
         s->ir = value & 0x3f;
         imx_gpt_update_int(s);
 
+        ptimer_transaction_begin(s->timer);
         imx_gpt_compute_next_timeout(s, false);
+        ptimer_transaction_commit(s->timer);
 
         break;
 
     case 4: /* OCR1 -- output compare register */
         s->ocr1 = value;
 
+        ptimer_transaction_begin(s->timer);
         /* In non-freerun mode, reset count when this register is written */
         if (!(s->cr & GPT_CR_FRR)) {
             s->next_timeout = GPT_TIMER_MAX;
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
 
         /* compute the new timeout */
         imx_gpt_compute_next_timeout(s, false);
+        ptimer_transaction_commit(s->timer);
 
         break;
 
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
         s->ocr2 = value;
 
         /* compute the new timeout */
+        ptimer_transaction_begin(s->timer);
         imx_gpt_compute_next_timeout(s, false);
+        ptimer_transaction_commit(s->timer);
 
         break;
 
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_write(void *opaque, hwaddr offset, uint64_t value,
         s->ocr3 = value;
 
         /* compute the new timeout */
+        ptimer_transaction_begin(s->timer);
         imx_gpt_compute_next_timeout(s, false);
+        ptimer_transaction_commit(s->timer);
 
         break;
 
@@ -XXX,XX +XXX,XX @@ static void imx_gpt_realize(DeviceState *dev, Error **errp)
 {
     IMXGPTState *s = IMX_GPT(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-    QEMUBH *bh;
 
     sysbus_init_irq(sbd, &s->irq);
     memory_region_init_io(&s->iomem, OBJECT(s), &imx_gpt_ops, s, TYPE_IMX_GPT,
                           0x00001000);
     sysbus_init_mmio(sbd, &s->iomem);
 
-    bh = qemu_bh_new(imx_gpt_timeout, s);
-    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+    s->timer = ptimer_init(imx_gpt_timeout, s, PTIMER_POLICY_DEFAULT);
 }
 
 static void imx_gpt_class_init(ObjectClass *klass, void *data)
-- 
2.20.1

Switch the mss-timer code away from bottom-half based ptimers to
the new transaction-based ptimer API.  This just requires adding
begin/commit calls around the various places that modify the ptimer
state, and using the new ptimer_init() function to create the timer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-20-peter.maydell@linaro.org
---
 include/hw/timer/mss-timer.h |  1 -
 hw/timer/mss-timer.c         | 11 ++++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/include/hw/timer/mss-timer.h b/include/hw/timer/mss-timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/mss-timer.h
+++ b/include/hw/timer/mss-timer.h
@@ -XXX,XX +XXX,XX @@
 #define R_TIM1_MAX        6
 
 struct Msf2Timer {
-    QEMUBH *bh;
     ptimer_state *ptimer;
 
     uint32_t regs[R_TIM1_MAX];
diff --git a/hw/timer/mss-timer.c b/hw/timer/mss-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/mss-timer.c
+++ b/hw/timer/mss-timer.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qemu/log.h"
 #include "hw/irq.h"
@@ -XXX,XX +XXX,XX @@ static void timer_update_irq(struct Msf2Timer *st)
     qemu_set_irq(st->irq, (ier && isr));
 }
 
+/* Must be called from within a ptimer_transaction_begin/commit block */
 static void timer_update(struct Msf2Timer *st)
 {
     uint64_t count;
@@ -XXX,XX +XXX,XX @@ timer_write(void *opaque, hwaddr offset,
     switch (addr) {
     case R_TIM_CTRL:
         st->regs[R_TIM_CTRL] = value;
+        ptimer_transaction_begin(st->ptimer);
         timer_update(st);
+        ptimer_transaction_commit(st->ptimer);
         break;
 
     case R_TIM_RIS:
@@ -XXX,XX +XXX,XX @@ timer_write(void *opaque, hwaddr offset,
     case R_TIM_LOADVAL:
         st->regs[R_TIM_LOADVAL] = value;
         if (st->regs[R_TIM_CTRL] & TIMER_CTRL_ENBL) {
+            ptimer_transaction_begin(st->ptimer);
             timer_update(st);
+            ptimer_transaction_commit(st->ptimer);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static void mss_timer_init(Object *obj)
     for (i = 0; i < NUM_TIMERS; i++) {
         struct Msf2Timer *st = &t->timers[i];
 
-        st->bh = qemu_bh_new(timer_hit, st);
-        st->ptimer = ptimer_init_with_bh(st->bh, PTIMER_POLICY_DEFAULT);
+        st->ptimer = ptimer_init(timer_hit, st, PTIMER_POLICY_DEFAULT);
+        ptimer_transaction_begin(st->ptimer);
         ptimer_set_freq(st->ptimer, t->freq_hz);
+        ptimer_transaction_commit(st->ptimer);
         sysbus_init_irq(SYS_BUS_DEVICE(obj), &st->irq);
     }
 
-- 
2.20.1

Switch the cmsdk-apb-watchdog code away from bottom-half based
ptimers to the new transaction-based ptimer API.  This just requires
adding begin/commit calls around the various places that modify the
ptimer state, and using the new ptimer_init() function to create the
timer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-21-peter.maydell@linaro.org
---
 hw/watchdog/cmsdk-apb-watchdog.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/cmsdk-apb-watchdog.c
+++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "trace.h"
 #include "qapi/error.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "sysemu/watchdog.h"
 #include "hw/sysbus.h"
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_write(void *opaque, hwaddr offset,
          * Reset the load value and the current count, and make sure
          * we're counting.
          */
+        ptimer_transaction_begin(s->timer);
         ptimer_set_limit(s->timer, value, 1);
         ptimer_run(s->timer, 0);
+        ptimer_transaction_commit(s->timer);
         break;
     case A_WDOGCONTROL:
         if (s->is_luminary && 0 != (R_WDOGCONTROL_INTEN_MASK & s->control)) {
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_write(void *opaque, hwaddr offset,
         break;
     case A_WDOGINTCLR:
         s->intstatus = 0;
+        ptimer_transaction_begin(s->timer);
         ptimer_set_count(s->timer, ptimer_get_limit(s->timer));
+        ptimer_transaction_commit(s->timer);
         cmsdk_apb_watchdog_update(s);
         break;
     case A_WDOGLOCK:
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_reset(DeviceState *dev)
     s->itop = 0;
     s->resetstatus = 0;
     /* Set the limit and the count */
+    ptimer_transaction_begin(s->timer);
     ptimer_set_limit(s->timer, 0xffffffff, 1);
     ptimer_run(s->timer, 0);
+    ptimer_transaction_commit(s->timer);
 }
 
 static void cmsdk_apb_watchdog_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_init(Object *obj)
 static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
 {
     CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
-    QEMUBH *bh;
 
     if (s->wdogclk_frq == 0) {
         error_setg(errp,
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    bh = qemu_bh_new(cmsdk_apb_watchdog_tick, s);
-    s->timer = ptimer_init_with_bh(bh,
+    s->timer = ptimer_init(cmsdk_apb_watchdog_tick, s,
                            PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
                            PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
                            PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
+    ptimer_transaction_begin(s->timer);
     ptimer_set_freq(s->timer, s->wdogclk_frq);
+    ptimer_transaction_commit(s->timer);
 }
 
 static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
-- 
2.20.1

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20191008171740.9679-22-peter.maydell@linaro.org
---
 hw/net/lan9118.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/ptimer.h"
 #include "hw/qdev-properties.h"
 #include "qemu/log.h"
-#include "qemu/main-loop.h"
 #include "qemu/module.h"
 /* For crc32 */
 #include <zlib.h>
@@ -XXX,XX +XXX,XX @@ static void lan9118_reset(DeviceState *d)
     s->e2p_data = 0;
     s->free_timer_start = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) / 40;
 
+    ptimer_transaction_begin(s->timer);
     ptimer_stop(s->timer);
     ptimer_set_count(s->timer, 0xffff);
+    ptimer_transaction_commit(s->timer);
     s->gpt_cfg = 0xffff;
 
     s->mac_cr = MAC_CR_PRMS;
@@ -XXX,XX +XXX,XX @@ static void lan9118_writel(void *opaque, hwaddr offset,
         break;
     case CSR_GPT_CFG:
         if ((s->gpt_cfg ^ val) & GPT_TIMER_EN) {
+            ptimer_transaction_begin(s->timer);
             if (val & GPT_TIMER_EN) {
                 ptimer_set_count(s->timer, val & 0xffff);
                 ptimer_run(s->timer, 0);
@@ -XXX,XX +XXX,XX @@ static void lan9118_writel(void *opaque, hwaddr offset,
                 ptimer_stop(s->timer);
                 ptimer_set_count(s->timer, 0xffff);
             }
+            ptimer_transaction_commit(s->timer);
         }
         s->gpt_cfg = val & (GPT_TIMER_EN | 0xffff);
         break;
@@ -XXX,XX +XXX,XX @@ static void lan9118_realize(DeviceState *dev, Error **errp)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     lan9118_state *s = LAN9118(dev);
-    QEMUBH *bh;
     int i;
     const MemoryRegionOps *mem_ops =
             s->mode_16bit ? &lan9118_16bit_mem_ops : &lan9118_mem_ops;
@@ -XXX,XX +XXX,XX @@ static void lan9118_realize(DeviceState *dev, Error **errp)
     s->pmt_ctrl = 1;
     s->txp = &s->tx_packet;
 
-    bh = qemu_bh_new(lan9118_tick, s);
-    s->timer = ptimer_init_with_bh(bh, PTIMER_POLICY_DEFAULT);
+    s->timer = ptimer_init(lan9118_tick, s, PTIMER_POLICY_DEFAULT);
+    ptimer_transaction_begin(s->timer);
     ptimer_set_freq(s->timer, 10000);
     ptimer_set_limit(s->timer, 0xffff, 1);
+    ptimer_transaction_commit(s->timer);
 }
 
 static Property lan9118_properties[] = {
-- 
2.20.1

The set_swi_errno() function is called to capture the errno
from a host system call, so that we can return -1 from the
semihosting function and later allow the guest to get a more
specific error code with the SYS_ERRNO function. It comes in
two versions, one for user-only and one for softmmu. We forgot
to capture the errno in the softmmu version; fix the error.

(Semihosting calls directed to gdb are unaffected because
they go through a different code path that captures the
error return from the gdbstub call in arm_semi_cb() or
arm_semi_flen_cb().)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190916141544.17540-2-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
     return code;
 }
 #else
+static target_ulong syscall_err;
+
 static inline uint32_t set_swi_errno(CPUARMState *env, uint32_t code)
 {
+    if (code == (uint32_t)-1) {
+        syscall_err = errno;
+    }
     return code;
 }
 
@@ -XXX,XX +XXX,XX @@ static inline uint32_t set_swi_errno(CPUARMState *env, uint32_t code)
 
 static target_ulong arm_semi_syscall_len;
 
-#if !defined(CONFIG_USER_ONLY)
-static target_ulong syscall_err;
-#endif
-
 static void arm_semi_cb(CPUState *cs, target_ulong ret, target_ulong err)
 {
     ARMCPU *cpu = ARM_CPU(cs);
-- 
2.20.1

If we fail a semihosting call we should always set the
semihosting errno to something; we were failing to do
this for some of the "check inputs for sanity" cases.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190916141544.17540-3-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 45 ++++++++++++++++++++++++++-----------------
 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
 #define GET_ARG(n) do {                                 \
     if (is_a64(env)) {                                  \
         if (get_user_u64(arg ## n, args + (n) * 8)) {   \
-            return -1;                                  \
+            errno = EFAULT;                             \
+            return set_swi_errno(ts, -1);               \
         }                                               \
     } else {                                            \
         if (get_user_u32(arg ## n, args + (n) * 4)) {   \
-            return -1;                                  \
+            errno = EFAULT;                             \
+            return set_swi_errno(ts, -1);               \
         }                                               \
     }                                                   \
 } while (0)
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(2);
         s = lock_user_string(arg0);
         if (!s) {
-            /* FIXME - should this error code be -TARGET_EFAULT ? */
-            return (uint32_t)-1;
+            errno = EFAULT;
+            return set_swi_errno(ts, -1);
         }
         if (arg1 >= 12) {
             unlock_user(s, arg0, 0);
-            return (uint32_t)-1;
+            errno = EINVAL;
+            return set_swi_errno(ts, -1);
         }
         if (strcmp(s, ":tt") == 0) {
             int result_fileno = arg1 < 4 ? STDIN_FILENO : STDOUT_FILENO;
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         } else {
             s = lock_user_string(arg0);
             if (!s) {
-                /* FIXME - should this error code be -TARGET_EFAULT ? */
-                return (uint32_t)-1;
+                errno = EFAULT;
+                return set_swi_errno(ts, -1);
             }
             ret =  set_swi_errno(ts, remove(s));
             unlock_user(s, arg0, 0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             char *s2;
             s = lock_user_string(arg0);
             s2 = lock_user_string(arg2);
-            if (!s || !s2)
-                /* FIXME - should this error code be -TARGET_EFAULT ? */
-                ret = (uint32_t)-1;
-            else
+            if (!s || !s2) {
+                errno = EFAULT;
+                ret = set_swi_errno(ts, -1);
+            } else {
                 ret = set_swi_errno(ts, rename(s, s2));
+            }
             if (s2)
                 unlock_user(s2, arg2, 0);
             if (s)
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         } else {
             s = lock_user_string(arg0);
             if (!s) {
-                /* FIXME - should this error code be -TARGET_EFAULT ? */
-                return (uint32_t)-1;
+                errno = EFAULT;
+                return set_swi_errno(ts, -1);
             }
             ret = set_swi_errno(ts, system(s));
             unlock_user(s, arg0, 0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
 
             if (output_size > input_size) {
                 /* Not enough space to store command-line arguments.  */
-                return -1;
+                errno = E2BIG;
+                return set_swi_errno(ts, -1);
             }
 
             /* Adjust the command-line length.  */
             if (SET_ARG(1, output_size - 1)) {
                 /* Couldn't write back to argument block */
-                return -1;
+                errno = EFAULT;
+                return set_swi_errno(ts, -1);
             }
 
             /* Lock the buffer on the ARM side.  */
             output_buffer = lock_user(VERIFY_WRITE, arg0, output_size, 0);
             if (!output_buffer) {
-                return -1;
+                errno = EFAULT;
+                return set_swi_errno(ts, -1);
             }
 
             /* Copy the command-line arguments.  */
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
 
             if (copy_from_user(output_buffer, ts->info->arg_start,
                                output_size)) {
-                status = -1;
+                errno = EFAULT;
+                status = set_swi_errno(ts, -1);
                 goto out;
             }
 
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
 
                 if (fail) {
                     /* Couldn't write back to argument block */
-                    return -1;
+                    errno = EFAULT;
+                    return set_swi_errno(ts, -1);
                 }
             }
             return 0;
-- 
2.20.1

In arm_gdb_syscall() we have a comment suggesting a race
because the syscall completion callback might not happen
before the gdb_do_syscallv() call returns. The comment is
correct that the callback may not happen but incorrect about
the effects. Correct it and note the important caveat that
callers must never do any work of any kind after return from
arm_gdb_syscall() that depends on its return value.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190916141544.17540-4-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
     gdb_do_syscallv(cb, fmt, va);
     va_end(va);
 
-    /* FIXME: we are implicitly relying on the syscall completing
-     * before this point, which is not guaranteed. We should
-     * put in an explicit synchronization between this and
-     * the callback function.
+    /*
+     * FIXME: in softmmu mode, the gdbstub will schedule our callback
+     * to occur, but will not actually call it to complete the syscall
+     * until after this function has returned and we are back in the
+     * CPU main loop. Therefore callers to this function must not
+     * do anything with its return value, because it is not necessarily
+     * the result of the syscall, but could just be the old value of X0.
+     * The only thing safe to do with this is that the callers of
+     * do_arm_semihosting() will write it straight back into X0.
+     * (In linux-user mode, the callback will have happened before
+     * gdb_do_syscallv() returns.)
+     *
+     * We should tidy this up so neither this function nor
+     * do_arm_semihosting() return a value, so the mistake of
+     * doing something with the return value is not possible to make.
      */
 
     return is_a64(env) ? env->xregs[0] : env->regs[0];
-- 
2.20.1

Currently the Arm semihosting code returns the guest file descriptors
(handles) which are simply the fd values from the host OS or the
remote gdbstub. Part of the semihosting 2.0 specification requires
that we implement special handling of opening a ":semihosting-features"
filename. Guest fds which result from opening the special file
won't correspond to host fds, so to ensure that we don't end up
with duplicate fds we need to have QEMU code control the allocation
of the fd values we give the guest.

Add in an abstraction layer which lets us allocate new guest FD
values, and translate from a guest FD value back to the host one.
This also fixes an odd hole where a semihosting guest could
use the semihosting API to read, write or close file descriptors
that it had never allocated but which were being used by QEMU itself.
(This isn't a security hole, because enabling semihosting permits
the guest to do arbitrary file access to the whole host filesystem,
and so should only be done if the guest is completely trusted.)

Currently the only kind of guest fd is one which maps to a
host fd, but in a following commit we will add one which maps
to the :semihosting-features magic data.

If the guest is migrated with an open semihosting file descriptor
then subsequent attempts to use the fd will all fail; this is
not a change from the previous situation (where the host fd
being used on the source end would not be re-opened on the
destination end).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190916141544.17540-5-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 232 +++++++++++++++++++++++++++++++++++++++---
 1 file changed, 216 insertions(+), 16 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static int open_modeflags[12] = {
     O_RDWR | O_CREAT | O_APPEND | O_BINARY
 };
 
+typedef enum GuestFDType {
+    GuestFDUnused = 0,
+    GuestFDHost = 1,
+} GuestFDType;
+
+/*
+ * Guest file descriptors are integer indexes into an array of
+ * these structures (we will dynamically resize as necessary).
+ */
+typedef struct GuestFD {
+    GuestFDType type;
+    int hostfd;
+} GuestFD;
+
+static GArray *guestfd_array;
+
+/*
+ * Allocate a new guest file descriptor and return it; if we
+ * couldn't allocate a new fd then return -1.
+ * This is a fairly simplistic implementation because we don't
+ * expect that most semihosting guest programs will make very
+ * heavy use of opening and closing fds.
+ */
+static int alloc_guestfd(void)
+{
+    guint i;
+
+    if (!guestfd_array) {
+        /* New entries zero-initialized, i.e. type GuestFDUnused */
+        guestfd_array = g_array_new(FALSE, TRUE, sizeof(GuestFD));
+    }
+
+    for (i = 0; i < guestfd_array->len; i++) {
+        GuestFD *gf = &g_array_index(guestfd_array, GuestFD, i);
+
+        if (gf->type == GuestFDUnused) {
+            return i;
+        }
+    }
+
+    /* All elements already in use: expand the array */
+    g_array_set_size(guestfd_array, i + 1);
+    return i;
+}
+
+/*
+ * Look up the guestfd in the data structure; return NULL
+ * for out of bounds, but don't check whether the slot is unused.
+ * This is used internally by the other guestfd functions.
+ */
+static GuestFD *do_get_guestfd(int guestfd)
+{
+    if (!guestfd_array) {
+        return NULL;
+    }
+
+    if (guestfd < 0 || guestfd >= guestfd_array->len) {
+        return NULL;
+    }
+
+    return &g_array_index(guestfd_array, GuestFD, guestfd);
+}
+
+/*
+ * Associate the specified guest fd (which must have been
+ * allocated via alloc_fd() and not previously used) with
+ * the specified host fd.
+ */
+static void associate_guestfd(int guestfd, int hostfd)
+{
+    GuestFD *gf = do_get_guestfd(guestfd);
+
+    assert(gf);
+    gf->type = GuestFDHost;
+    gf->hostfd = hostfd;
+}
+
+/*
+ * Deallocate the specified guest file descriptor. This doesn't
+ * close the host fd, it merely undoes the work of alloc_fd().
+ */
+static void dealloc_guestfd(int guestfd)
+{
+    GuestFD *gf = do_get_guestfd(guestfd);
+
+    assert(gf);
+    gf->type = GuestFDUnused;
+}
+
+/*
+ * Given a guest file descriptor, get the associated struct.
+ * If the fd is not valid, return NULL. This is the function
+ * used by the various semihosting calls to validate a handle
+ * from the guest.
+ * Note: calling alloc_guestfd() or dealloc_guestfd() will
+ * invalidate any GuestFD* obtained by calling this function.
+ */
+static GuestFD *get_guestfd(int guestfd)
+{
+    GuestFD *gf = do_get_guestfd(guestfd);
+
+    if (!gf || gf->type == GuestFDUnused) {
+        return NULL;
+    }
+    return gf;
+}
+
 #ifdef CONFIG_USER_ONLY
 static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_semi_flen_cb(CPUState *cs, target_ulong ret, target_ulong err)
 #endif
 }
 
+static int arm_semi_open_guestfd;
+
+static void arm_semi_open_cb(CPUState *cs, target_ulong ret, target_ulong err)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+#ifdef CONFIG_USER_ONLY
+    TaskState *ts = cs->opaque;
+#endif
+    if (ret == (target_ulong)-1) {
+#ifdef CONFIG_USER_ONLY
+        ts->swi_errno = err;
+#else
+        syscall_err = err;
+#endif
+        dealloc_guestfd(arm_semi_open_guestfd);
+    } else {
+        associate_guestfd(arm_semi_open_guestfd, ret);
+        ret = arm_semi_open_guestfd;
+    }
+
+    if (is_a64(env)) {
+        env->xregs[0] = ret;
+    } else {
+        env->regs[0] = ret;
+    }
+}
+
 static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
                                     const char *fmt, ...)
 {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
 #else
     CPUARMState *ts = env;
 #endif
+    GuestFD *gf;
 
     if (is_a64(env)) {
         /* Note that the syscall number is in W0, not X0 */
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
 
     switch (nr) {
     case TARGET_SYS_OPEN:
+    {
+        int guestfd;
+
         GET_ARG(0);
         GET_ARG(1);
         GET_ARG(2);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             errno = EINVAL;
             return set_swi_errno(ts, -1);
         }
+
+        guestfd = alloc_guestfd();
+        if (guestfd < 0) {
+            unlock_user(s, arg0, 0);
+            errno = EMFILE;
+            return set_swi_errno(ts, -1);
+        }
+
         if (strcmp(s, ":tt") == 0) {
             int result_fileno = arg1 < 4 ? STDIN_FILENO : STDOUT_FILENO;
+            associate_guestfd(guestfd, result_fileno);
             unlock_user(s, arg0, 0);
-            return result_fileno;
+            return guestfd;
         }
         if (use_gdb_syscalls()) {
-            ret = arm_gdb_syscall(cpu, arm_semi_cb, "open,%s,%x,1a4", arg0,
+            arm_semi_open_guestfd = guestfd;
+            ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
                                   (int)arg2+1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(ts, open(s, open_modeflags[arg1], 0644));
+            if (ret == (uint32_t)-1) {
+                dealloc_guestfd(guestfd);
+            } else {
+                associate_guestfd(guestfd, ret);
+                ret = guestfd;
+            }
         }
         unlock_user(s, arg0, 0);
         return ret;
+    }
     case TARGET_SYS_CLOSE:
         GET_ARG(0);
-        if (use_gdb_syscalls()) {
-            return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", arg0);
-        } else {
-            return set_swi_errno(ts, close(arg0));
+
+        gf = get_guestfd(arg0);
+        if (!gf) {
+            errno = EBADF;
+            return set_swi_errno(ts, -1);
         }
+
+        if (use_gdb_syscalls()) {
+            ret = arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
+        } else {
+            ret = set_swi_errno(ts, close(gf->hostfd));
+        }
+        dealloc_guestfd(arg0);
+        return ret;
     case TARGET_SYS_WRITEC:
         qemu_semihosting_console_outc(env, args);
         return 0xdeadbeef;
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         GET_ARG(2);
         len = arg2;
+
+        gf = get_guestfd(arg0);
+        if (!gf) {
+            errno = EBADF;
+            return set_swi_errno(ts, -1);
+        }
+
         if (use_gdb_syscalls()) {
             arm_semi_syscall_len = len;
             return arm_gdb_syscall(cpu, arm_semi_cb, "write,%x,%x,%x",
-                                   arg0, arg1, len);
+                                   gf->hostfd, arg1, len);
         } else {
             s = lock_user(VERIFY_READ, arg1, len, 1);
             if (!s) {
                 /* Return bytes not written on error */
                 return len;
             }
-            ret = set_swi_errno(ts, write(arg0, s, len));
+            ret = set_swi_errno(ts, write(gf->hostfd, s, len));
             unlock_user(s, arg1, 0);
             if (ret == (uint32_t)-1) {
                 ret = 0;
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         GET_ARG(2);
         len = arg2;
+
+        gf = get_guestfd(arg0);
+        if (!gf) {
+            errno = EBADF;
+            return set_swi_errno(ts, -1);
+        }
+
         if (use_gdb_syscalls()) {
             arm_semi_syscall_len = len;
             return arm_gdb_syscall(cpu, arm_semi_cb, "read,%x,%x,%x",
-                                   arg0, arg1, len);
+                                   gf->hostfd, arg1, len);
         } else {
             s = lock_user(VERIFY_WRITE, arg1, len, 0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
                 return len;
             }
             do {
-                ret = set_swi_errno(ts, read(arg0, s, len));
+                ret = set_swi_errno(ts, read(gf->hostfd, s, len));
             } while (ret == -1 && errno == EINTR);
             unlock_user(s, arg1, len);
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         return 0;
     case TARGET_SYS_ISTTY:
         GET_ARG(0);
+
+        gf = get_guestfd(arg0);
+        if (!gf) {
+            errno = EBADF;
+            return set_swi_errno(ts, -1);
+        }
+
         if (use_gdb_syscalls()) {
-            return arm_gdb_syscall(cpu, arm_semi_cb, "isatty,%x", arg0);
+            return arm_gdb_syscall(cpu, arm_semi_cb, "isatty,%x", gf->hostfd);
         } else {
-            return isatty(arg0);
+            return isatty(gf->hostfd);
         }
     case TARGET_SYS_SEEK:
         GET_ARG(0);
         GET_ARG(1);
+
+        gf = get_guestfd(arg0);
+        if (!gf) {
+            errno = EBADF;
+            return set_swi_errno(ts, -1);
+        }
+
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "lseek,%x,%x,0",
-                                   arg0, arg1);
+                                   gf->hostfd, arg1);
         } else {
-            ret = set_swi_errno(ts, lseek(arg0, arg1, SEEK_SET));
+            ret = set_swi_errno(ts, lseek(gf->hostfd, arg1, SEEK_SET));
             if (ret == (uint32_t)-1)
               return -1;
             return 0;
         }
     case TARGET_SYS_FLEN:
         GET_ARG(0);
+
+        gf = get_guestfd(arg0);
+        if (!gf) {
+            errno = EBADF;
+            return set_swi_errno(ts, -1);
+        }
+
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_flen_cb, "fstat,%x,%x",
-                                   arg0, arm_flen_buf(cpu));
+                                   gf->hostfd, arm_flen_buf(cpu));
         } else {
             struct stat buf;
-            ret = set_swi_errno(ts, fstat(arg0, &buf));
+            ret = set_swi_errno(ts, fstat(gf->hostfd, &buf));
             if (ret == (uint32_t)-1)
                 return -1;
             return buf.st_size;
-- 
2.20.1

The semihosting code needs accuss to the linux-user only
TaskState pointer so it can set the semihosting errno per-thread
for linux-user mode. At the moment we do this by having some
ifdefs so that we define a 'ts' local in do_arm_semihosting()
which is either a real TaskState * or just a CPUARMState *,
depending on which mode we're compiling for.

This is awkward if we want to refactor do_arm_semihosting()
into other functions which might need to be passed the TaskState.
Restrict usage of the TaskState local by:
 * making set_swi_errno() always take the CPUARMState pointer
   and (for the linux-user version) get TaskState from that
 * creating a new get_swi_errno() which reads the errno
 * having the two semihosting calls which need the TaskState
   for other purposes (SYS_GET_CMDLINE and SYS_HEAPINFO)
   define a variable with scope restricted to just that code

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190916141544.17540-6-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 111 ++++++++++++++++++++++++------------------
 1 file changed, 63 insertions(+), 48 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static GuestFD *get_guestfd(int guestfd)
     return gf;
 }
 
-#ifdef CONFIG_USER_ONLY
-static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
-{
-    if (code == (uint32_t)-1)
-        ts->swi_errno = errno;
-    return code;
-}
-#else
+/*
+ * The semihosting API has no concept of its errno being thread-safe,
+ * as the API design predates SMP CPUs and was intended as a simple
+ * real-hardware set of debug functionality. For QEMU, we make the
+ * errno be per-thread in linux-user mode; in softmmu it is a simple
+ * global, and we assume that the guest takes care of avoiding any races.
+ */
+#ifndef CONFIG_USER_ONLY
 static target_ulong syscall_err;
 
+#include "exec/softmmu-semi.h"
+#endif
+
 static inline uint32_t set_swi_errno(CPUARMState *env, uint32_t code)
 {
     if (code == (uint32_t)-1) {
+#ifdef CONFIG_USER_ONLY
+        CPUState *cs = env_cpu(env);
+        TaskState *ts = cs->opaque;
+
+        ts->swi_errno = errno;
+#else
         syscall_err = errno;
+#endif
     }
     return code;
 }
 
-#include "exec/softmmu-semi.h"
+static inline uint32_t get_swi_errno(CPUARMState *env)
+{
+#ifdef CONFIG_USER_ONLY
+    CPUState *cs = env_cpu(env);
+    TaskState *ts = cs->opaque;
+
+    return ts->swi_errno;
+#else
+    return syscall_err;
 #endif
+}
 
 static target_ulong arm_semi_syscall_len;
 
@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
     if (is_a64(env)) {                                  \
         if (get_user_u64(arg ## n, args + (n) * 8)) {   \
             errno = EFAULT;                             \
-            return set_swi_errno(ts, -1);               \
+            return set_swi_errno(env, -1);              \
         }                                               \
     } else {                                            \
         if (get_user_u32(arg ## n, args + (n) * 4)) {   \
             errno = EFAULT;                             \
-            return set_swi_errno(ts, -1);               \
+            return set_swi_errno(env, -1);              \
         }                                               \
     }                                                   \
 } while (0)
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
     int nr;
     uint32_t ret;
     uint32_t len;
-#ifdef CONFIG_USER_ONLY
-    TaskState *ts = cs->opaque;
-#else
-    CPUARMState *ts = env;
-#endif
     GuestFD *gf;
 
     if (is_a64(env)) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         s = lock_user_string(arg0);
         if (!s) {
             errno = EFAULT;
-            return set_swi_errno(ts, -1);
+            return set_swi_errno(env, -1);
         }
         if (arg1 >= 12) {
             unlock_user(s, arg0, 0);
             errno = EINVAL;
-            return set_swi_errno(ts, -1);
+            return set_swi_errno(env, -1);
         }
 
         guestfd = alloc_guestfd();
         if (guestfd < 0) {
             unlock_user(s, arg0, 0);
             errno = EMFILE;
-            return set_swi_errno(ts, -1);
+            return set_swi_errno(env, -1);
         }
 
         if (strcmp(s, ":tt") == 0) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
                                   (int)arg2+1, gdb_open_modeflags[arg1]);
         } else {
-            ret = set_swi_errno(ts, open(s, open_modeflags[arg1], 0644));
+            ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
                 dealloc_guestfd(guestfd);
             } else {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         gf = get_guestfd(arg0);
         if (!gf) {
             errno = EBADF;
-            return set_swi_errno(ts, -1);
+            return set_swi_errno(env, -1);
         }
 
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
         } else {
-            ret = set_swi_errno(ts, close(gf->hostfd));
+            ret = set_swi_errno(env, close(gf->hostfd));
         }
         dealloc_guestfd(arg0);
         return ret;
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         gf = get_guestfd(arg0);
         if (!gf) {
             errno = EBADF;
-            return set_swi_errno(ts, -1);
+            return set_swi_errno(env, -1);
         }
 
         if (use_gdb_syscalls()) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
                 /* Return bytes not written on error */
                 return len;
             }
-            ret = set_swi_errno(ts, write(gf->hostfd, s, len));
+            ret = set_swi_errno(env, write(gf->hostfd, s, len));
             unlock_user(s, arg1, 0);
             if (ret == (uint32_t)-1) {
                 ret = 0;
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         gf = get_guestfd(arg0);
         if (!gf) {
             errno = EBADF;
-            return set_swi_errno(ts, -1);
+            return set_swi_errno(env, -1);
         }
 
         if (use_gdb_syscalls()) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
                 return len;
             }
             do {
-                ret = set_swi_errno(ts, read(gf->hostfd, s, len));
+                ret = set_swi_errno(env, read(gf->hostfd, s, len));
             } while (ret == -1 && errno == EINTR);
             unlock_user(s, arg1, len);
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         gf = get_guestfd(arg0);
         if (!gf) {
             errno = EBADF;
-            return set_swi_errno(ts, -1);
+            return set_swi_errno(env, -1);
         }
 
         if (use_gdb_syscalls()) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         gf = get_guestfd(arg0);
         if (!gf) {
             errno = EBADF;
-            return set_swi_errno(ts, -1);
+            return set_swi_errno(env, -1);
         }
 
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "lseek,%x,%x,0",
                                    gf->hostfd, arg1);
         } else {
-            ret = set_swi_errno(ts, lseek(gf->hostfd, arg1, SEEK_SET));
+            ret = set_swi_errno(env, lseek(gf->hostfd, arg1, SEEK_SET));
             if (ret == (uint32_t)-1)
               return -1;
             return 0;
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         gf = get_guestfd(arg0);
         if (!gf) {
             errno = EBADF;
-            return set_swi_errno(ts, -1);
+            return set_swi_errno(env, -1);
         }
 
         if (use_gdb_syscalls()) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
                                    gf->hostfd, arm_flen_buf(cpu));
         } else {
             struct stat buf;
-            ret = set_swi_errno(ts, fstat(gf->hostfd, &buf));
+            ret = set_swi_errno(env, fstat(gf->hostfd, &buf));
             if (ret == (uint32_t)-1)
                 return -1;
             return buf.st_size;
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             s = lock_user_string(arg0);
             if (!s) {
                 errno = EFAULT;
-                return set_swi_errno(ts, -1);
+                return set_swi_errno(env, -1);
             }
-            ret =  set_swi_errno(ts, remove(s));
+            ret =  set_swi_errno(env, remove(s));
             unlock_user(s, arg0, 0);
         }
         return ret;
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             s2 = lock_user_string(arg2);
             if (!s || !s2) {
                 errno = EFAULT;
-                ret = set_swi_errno(ts, -1);
+                ret = set_swi_errno(env, -1);
             } else {
-                ret = set_swi_errno(ts, rename(s, s2));
+                ret = set_swi_errno(env, rename(s, s2));
             }
             if (s2)
                 unlock_user(s2, arg2, 0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
     case TARGET_SYS_CLOCK:
         return clock() / (CLOCKS_PER_SEC / 100);
     case TARGET_SYS_TIME:
-        return set_swi_errno(ts, time(NULL));
+        return set_swi_errno(env, time(NULL));
     case TARGET_SYS_SYSTEM:
         GET_ARG(0);
         GET_ARG(1);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             s = lock_user_string(arg0);
             if (!s) {
                 errno = EFAULT;
-                return set_swi_errno(ts, -1);
+                return set_swi_errno(env, -1);
             }
-            ret = set_swi_errno(ts, system(s));
+            ret = set_swi_errno(env, system(s));
             unlock_user(s, arg0, 0);
             return ret;
         }
     case TARGET_SYS_ERRNO:
-#ifdef CONFIG_USER_ONLY
-        return ts->swi_errno;
-#else
-        return syscall_err;
-#endif
+        return get_swi_errno(env);
     case TARGET_SYS_GET_CMDLINE:
         {
             /* Build a command-line from the original argv.
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             int status = 0;
 #if !defined(CONFIG_USER_ONLY)
             const char *cmdline;
+#else
+            TaskState *ts = cs->opaque;
 #endif
             GET_ARG(0);
             GET_ARG(1);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             if (output_size > input_size) {
                 /* Not enough space to store command-line arguments.  */
                 errno = E2BIG;
-                return set_swi_errno(ts, -1);
+                return set_swi_errno(env, -1);
             }
 
             /* Adjust the command-line length.  */
             if (SET_ARG(1, output_size - 1)) {
                 /* Couldn't write back to argument block */
                 errno = EFAULT;
-                return set_swi_errno(ts, -1);
+                return set_swi_errno(env, -1);
             }
 
             /* Lock the buffer on the ARM side.  */
             output_buffer = lock_user(VERIFY_WRITE, arg0, output_size, 0);
             if (!output_buffer) {
                 errno = EFAULT;
-                return set_swi_errno(ts, -1);
+                return set_swi_errno(env, -1);
             }
 
             /* Copy the command-line arguments.  */
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             if (copy_from_user(output_buffer, ts->info->arg_start,
                                output_size)) {
                 errno = EFAULT;
-                status = set_swi_errno(ts, -1);
+                status = set_swi_errno(env, -1);
                 goto out;
             }
 
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             target_ulong retvals[4];
             target_ulong limit;
             int i;
+#ifdef CONFIG_USER_ONLY
+            TaskState *ts = cs->opaque;
+#endif
 
             GET_ARG(0);
 
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
                 if (fail) {
                     /* Couldn't write back to argument block */
                     errno = EFAULT;
-                    return set_swi_errno(ts, -1);
+                    return set_swi_errno(env, -1);
                 }
             }
             return 0;
-- 
2.20.1

When we are routing semihosting operations through the gdbstub, the
work of sorting out the return value and setting errno if necessary
is done by callback functions which are invoked by the gdbstub code.
Clean up some ifdeffery in those functions by having them call
set_swi_errno() to set the semihosting errno.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190916141544.17540-7-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 27 ++++++---------------------
 1 file changed, 6 insertions(+), 21 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static void arm_semi_cb(CPUState *cs, target_ulong ret, target_ulong err)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
-#ifdef CONFIG_USER_ONLY
-    TaskState *ts = cs->opaque;
-#endif
     target_ulong reg0 = is_a64(env) ? env->xregs[0] : env->regs[0];
 
     if (ret == (target_ulong)-1) {
-#ifdef CONFIG_USER_ONLY
-        ts->swi_errno = err;
-#else
-        syscall_err = err;
-#endif
+        errno = err;
+        set_swi_errno(env, -1);
         reg0 = ret;
     } else {
         /* Fixup syscalls that use nonstardard return conventions.  */
@@ -XXX,XX +XXX,XX @@ static void arm_semi_flen_cb(CPUState *cs, target_ulong ret, target_ulong err)
     } else {
         env->regs[0] = size;
     }
-#ifdef CONFIG_USER_ONLY
-    ((TaskState *)cs->opaque)->swi_errno = err;
-#else
-    syscall_err = err;
-#endif
+    errno = err;
+    set_swi_errno(env, -1);
 }
 
 static int arm_semi_open_guestfd;
@@ -XXX,XX +XXX,XX @@ static void arm_semi_open_cb(CPUState *cs, target_ulong ret, target_ulong err)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
-#ifdef CONFIG_USER_ONLY
-    TaskState *ts = cs->opaque;
-#endif
     if (ret == (target_ulong)-1) {
-#ifdef CONFIG_USER_ONLY
-        ts->swi_errno = err;
-#else
-        syscall_err = err;
-#endif
+        errno = err;
+        set_swi_errno(env, -1);
         dealloc_guestfd(arm_semi_open_guestfd);
     } else {
         associate_guestfd(arm_semi_open_guestfd, ret);
-- 
2.20.1

Currently for the semihosting calls which take a file descriptor
(SYS_CLOSE, SYS_WRITE, SYS_READ, SYS_ISTTY, SYS_SEEK, SYS_FLEN)
we have effectively two implementations, one for real host files
and one for when we indirect via the gdbstub. We want to add a
third one to deal with the magic :semihosting-features file.

Instead of having a three-way if statement in each of these
cases, factor out the implementation of the calls to separate
functions which we dispatch to via function pointers selected
via the GuestFDType for the guest fd.

In this commit, we set up the framework for the dispatch,
and convert the SYS_CLOSE call to use it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190916141544.17540-8-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 44 ++++++++++++++++++++++++++++++++++++-------
 1 file changed, 37 insertions(+), 7 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static int open_modeflags[12] = {
 typedef enum GuestFDType {
     GuestFDUnused = 0,
     GuestFDHost = 1,
+    GuestFDGDB = 2,
 } GuestFDType;
 
 /*
@@ -XXX,XX +XXX,XX @@ static GuestFD *do_get_guestfd(int guestfd)
 /*
  * Associate the specified guest fd (which must have been
  * allocated via alloc_fd() and not previously used) with
- * the specified host fd.
+ * the specified host/gdb fd.
  */
 static void associate_guestfd(int guestfd, int hostfd)
 {
     GuestFD *gf = do_get_guestfd(guestfd);
 
     assert(gf);
-    gf->type = GuestFDHost;
+    gf->type = use_gdb_syscalls() ? GuestFDGDB : GuestFDHost;
     gf->hostfd = hostfd;
 }
 
@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
     return is_a64(env) ? env->xregs[0] : env->regs[0];
 }
 
+/*
+ * Types for functions implementing various semihosting calls
+ * for specific types of guest file descriptor. These must all
+ * do the work and return the required return value for the guest,
+ * setting the guest errno if appropriate.
+ */
+typedef uint32_t sys_closefn(ARMCPU *cpu, GuestFD *gf);
+
+static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
+{
+    CPUARMState *env = &cpu->env;
+
+    return set_swi_errno(env, close(gf->hostfd));
+}
+
+static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
+{
+    return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
+}
+
+typedef struct GuestFDFunctions {
+    sys_closefn *closefn;
+} GuestFDFunctions;
+
+static const GuestFDFunctions guestfd_fns[] = {
+    [GuestFDHost] = {
+        .closefn = host_closefn,
+    },
+    [GuestFDGDB] = {
+        .closefn = gdb_closefn,
+    },
+};
+
 /* Read the input value from the argument block; fail the semihosting
  * call if the memory read fails.
  */
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             return set_swi_errno(env, -1);
         }
 
-        if (use_gdb_syscalls()) {
-            ret = arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
-        } else {
-            ret = set_swi_errno(env, close(gf->hostfd));
-        }
+        ret = guestfd_fns[gf->type].closefn(cpu, gf);
         dealloc_guestfd(arg0);
         return ret;
     case TARGET_SYS_WRITEC:
-- 
2.20.1

Factor out the implementation of SYS_WRITE via the
new function tables.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190916141544.17540-9-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 51 ++++++++++++++++++++++++++++---------------
 1 file changed, 33 insertions(+), 18 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
  * setting the guest errno if appropriate.
  */
 typedef uint32_t sys_closefn(ARMCPU *cpu, GuestFD *gf);
+typedef uint32_t sys_writefn(ARMCPU *cpu, GuestFD *gf,
+                             target_ulong buf, uint32_t len);
 
 static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
     return set_swi_errno(env, close(gf->hostfd));
 }
 
+static uint32_t host_writefn(ARMCPU *cpu, GuestFD *gf,
+                             target_ulong buf, uint32_t len)
+{
+    uint32_t ret;
+    CPUARMState *env = &cpu->env;
+    char *s = lock_user(VERIFY_READ, buf, len, 1);
+    if (!s) {
+        /* Return bytes not written on error */
+        return len;
+    }
+    ret = set_swi_errno(env, write(gf->hostfd, s, len));
+    unlock_user(s, buf, 0);
+    if (ret == (uint32_t)-1) {
+        ret = 0;
+    }
+    /* Return bytes not written */
+    return len - ret;
+}
+
 static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
 {
     return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
 }
 
+static uint32_t gdb_writefn(ARMCPU *cpu, GuestFD *gf,
+                            target_ulong buf, uint32_t len)
+{
+    arm_semi_syscall_len = len;
+    return arm_gdb_syscall(cpu, arm_semi_cb, "write,%x,%x,%x",
+                           gf->hostfd, buf, len);
+}
+
 typedef struct GuestFDFunctions {
     sys_closefn *closefn;
+    sys_writefn *writefn;
 } GuestFDFunctions;
 
 static const GuestFDFunctions guestfd_fns[] = {
     [GuestFDHost] = {
         .closefn = host_closefn,
+        .writefn = host_writefn,
     },
     [GuestFDGDB] = {
         .closefn = gdb_closefn,
+        .writefn = gdb_writefn,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             return set_swi_errno(env, -1);
         }
 
-        if (use_gdb_syscalls()) {
-            arm_semi_syscall_len = len;
-            return arm_gdb_syscall(cpu, arm_semi_cb, "write,%x,%x,%x",
-                                   gf->hostfd, arg1, len);
-        } else {
-            s = lock_user(VERIFY_READ, arg1, len, 1);
-            if (!s) {
-                /* Return bytes not written on error */
-                return len;
-            }
-            ret = set_swi_errno(env, write(gf->hostfd, s, len));
-            unlock_user(s, arg1, 0);
-            if (ret == (uint32_t)-1) {
-                ret = 0;
-            }
-            /* Return bytes not written */
-            return len - ret;
-        }
+        return guestfd_fns[gf->type].writefn(cpu, gf, arg1, len);
     case TARGET_SYS_READ:
         GET_ARG(0);
         GET_ARG(1);
-- 
2.20.1

Factor out the implementation of SYS_READ via the
new function tables.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190916141544.17540-10-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 55 +++++++++++++++++++++++++++----------------
 1 file changed, 35 insertions(+), 20 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static target_ulong arm_gdb_syscall(ARMCPU *cpu, gdb_syscall_complete_cb cb,
 typedef uint32_t sys_closefn(ARMCPU *cpu, GuestFD *gf);
 typedef uint32_t sys_writefn(ARMCPU *cpu, GuestFD *gf,
                              target_ulong buf, uint32_t len);
+typedef uint32_t sys_readfn(ARMCPU *cpu, GuestFD *gf,
+                            target_ulong buf, uint32_t len);
 
 static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t host_writefn(ARMCPU *cpu, GuestFD *gf,
     return len - ret;
 }
 
+static uint32_t host_readfn(ARMCPU *cpu, GuestFD *gf,
+                            target_ulong buf, uint32_t len)
+{
+    uint32_t ret;
+    CPUARMState *env = &cpu->env;
+    char *s = lock_user(VERIFY_WRITE, buf, len, 0);
+    if (!s) {
+        /* return bytes not read */
+        return len;
+    }
+    do {
+        ret = set_swi_errno(env, read(gf->hostfd, s, len));
+    } while (ret == -1 && errno == EINTR);
+    unlock_user(s, buf, len);
+    if (ret == (uint32_t)-1) {
+        ret = 0;
+    }
+    /* Return bytes not read */
+    return len - ret;
+}
+
 static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
 {
     return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_writefn(ARMCPU *cpu, GuestFD *gf,
                            gf->hostfd, buf, len);
 }
 
+static uint32_t gdb_readfn(ARMCPU *cpu, GuestFD *gf,
+                           target_ulong buf, uint32_t len)
+{
+    arm_semi_syscall_len = len;
+    return arm_gdb_syscall(cpu, arm_semi_cb, "read,%x,%x,%x",
+                           gf->hostfd, buf, len);
+}
+
 typedef struct GuestFDFunctions {
     sys_closefn *closefn;
     sys_writefn *writefn;
+    sys_readfn *readfn;
 } GuestFDFunctions;
 
 static const GuestFDFunctions guestfd_fns[] = {
     [GuestFDHost] = {
         .closefn = host_closefn,
         .writefn = host_writefn,
+        .readfn = host_readfn,
     },
     [GuestFDGDB] = {
         .closefn = gdb_closefn,
         .writefn = gdb_writefn,
+        .readfn = gdb_readfn,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             return set_swi_errno(env, -1);
         }
 
-        if (use_gdb_syscalls()) {
-            arm_semi_syscall_len = len;
-            return arm_gdb_syscall(cpu, arm_semi_cb, "read,%x,%x,%x",
-                                   gf->hostfd, arg1, len);
-        } else {
-            s = lock_user(VERIFY_WRITE, arg1, len, 0);
-            if (!s) {
-                /* return bytes not read */
-                return len;
-            }
-            do {
-                ret = set_swi_errno(env, read(gf->hostfd, s, len));
-            } while (ret == -1 && errno == EINTR);
-            unlock_user(s, arg1, len);
-            if (ret == (uint32_t)-1) {
-                ret = 0;
-            }
-            /* Return bytes not read */
-            return len - ret;
-        }
+        return guestfd_fns[gf->type].readfn(cpu, gf, arg1, len);
     case TARGET_SYS_READC:
         qemu_log_mask(LOG_UNIMP, "%s: SYS_READC not implemented", __func__);
         return 0;
-- 
2.20.1

Factor out the implementation of SYS_ISTTY via the new function
tables.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190916141544.17540-11-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ typedef uint32_t sys_writefn(ARMCPU *cpu, GuestFD *gf,
                              target_ulong buf, uint32_t len);
 typedef uint32_t sys_readfn(ARMCPU *cpu, GuestFD *gf,
                             target_ulong buf, uint32_t len);
+typedef uint32_t sys_isattyfn(ARMCPU *cpu, GuestFD *gf);
 
 static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t host_readfn(ARMCPU *cpu, GuestFD *gf,
     return len - ret;
 }
 
+static uint32_t host_isattyfn(ARMCPU *cpu, GuestFD *gf)
+{
+    return isatty(gf->hostfd);
+}
+
 static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
 {
     return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_readfn(ARMCPU *cpu, GuestFD *gf,
                            gf->hostfd, buf, len);
 }
 
+static uint32_t gdb_isattyfn(ARMCPU *cpu, GuestFD *gf)
+{
+    return arm_gdb_syscall(cpu, arm_semi_cb, "isatty,%x", gf->hostfd);
+}
+
 typedef struct GuestFDFunctions {
     sys_closefn *closefn;
     sys_writefn *writefn;
     sys_readfn *readfn;
+    sys_isattyfn *isattyfn;
 } GuestFDFunctions;
 
 static const GuestFDFunctions guestfd_fns[] = {
@@ -XXX,XX +XXX,XX @@ static const GuestFDFunctions guestfd_fns[] = {
         .closefn = host_closefn,
         .writefn = host_writefn,
         .readfn = host_readfn,
+        .isattyfn = host_isattyfn,
     },
     [GuestFDGDB] = {
         .closefn = gdb_closefn,
         .writefn = gdb_writefn,
         .readfn = gdb_readfn,
+        .isattyfn = gdb_isattyfn,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             return set_swi_errno(env, -1);
         }
 
-        if (use_gdb_syscalls()) {
-            return arm_gdb_syscall(cpu, arm_semi_cb, "isatty,%x", gf->hostfd);
-        } else {
-            return isatty(gf->hostfd);
-        }
+        return guestfd_fns[gf->type].isattyfn(cpu, gf);
     case TARGET_SYS_SEEK:
         GET_ARG(0);
         GET_ARG(1);
-- 
2.20.1

Factor out the implementation of SYS_SEEK via the new function
tables.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190916141544.17540-12-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ typedef uint32_t sys_writefn(ARMCPU *cpu, GuestFD *gf,
 typedef uint32_t sys_readfn(ARMCPU *cpu, GuestFD *gf,
                             target_ulong buf, uint32_t len);
 typedef uint32_t sys_isattyfn(ARMCPU *cpu, GuestFD *gf);
+typedef uint32_t sys_seekfn(ARMCPU *cpu, GuestFD *gf,
+                            target_ulong offset);
 
 static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t host_isattyfn(ARMCPU *cpu, GuestFD *gf)
     return isatty(gf->hostfd);
 }
 
+static uint32_t host_seekfn(ARMCPU *cpu, GuestFD *gf, target_ulong offset)
+{
+    CPUARMState *env = &cpu->env;
+    uint32_t ret = set_swi_errno(env, lseek(gf->hostfd, offset, SEEK_SET));
+    if (ret == (uint32_t)-1) {
+        return -1;
+    }
+    return 0;
+}
+
 static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
 {
     return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_isattyfn(ARMCPU *cpu, GuestFD *gf)
     return arm_gdb_syscall(cpu, arm_semi_cb, "isatty,%x", gf->hostfd);
 }
 
+static uint32_t gdb_seekfn(ARMCPU *cpu, GuestFD *gf, target_ulong offset)
+{
+    return arm_gdb_syscall(cpu, arm_semi_cb, "lseek,%x,%x,0",
+                           gf->hostfd, offset);
+}
+
 typedef struct GuestFDFunctions {
     sys_closefn *closefn;
     sys_writefn *writefn;
     sys_readfn *readfn;
     sys_isattyfn *isattyfn;
+    sys_seekfn *seekfn;
 } GuestFDFunctions;
 
 static const GuestFDFunctions guestfd_fns[] = {
@@ -XXX,XX +XXX,XX @@ static const GuestFDFunctions guestfd_fns[] = {
         .writefn = host_writefn,
         .readfn = host_readfn,
         .isattyfn = host_isattyfn,
+        .seekfn = host_seekfn,
     },
     [GuestFDGDB] = {
         .closefn = gdb_closefn,
         .writefn = gdb_writefn,
         .readfn = gdb_readfn,
         .isattyfn = gdb_isattyfn,
+        .seekfn = gdb_seekfn,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             return set_swi_errno(env, -1);
         }
 
-        if (use_gdb_syscalls()) {
-            return arm_gdb_syscall(cpu, arm_semi_cb, "lseek,%x,%x,0",
-                                   gf->hostfd, arg1);
-        } else {
-            ret = set_swi_errno(env, lseek(gf->hostfd, arg1, SEEK_SET));
-            if (ret == (uint32_t)-1)
-              return -1;
-            return 0;
-        }
+        return guestfd_fns[gf->type].seekfn(cpu, gf, arg1);
     case TARGET_SYS_FLEN:
         GET_ARG(0);
 
-- 
2.20.1

Factor out the implementation of SYS_FLEN via the new
function tables.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190916141544.17540-13-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ typedef uint32_t sys_readfn(ARMCPU *cpu, GuestFD *gf,
 typedef uint32_t sys_isattyfn(ARMCPU *cpu, GuestFD *gf);
 typedef uint32_t sys_seekfn(ARMCPU *cpu, GuestFD *gf,
                             target_ulong offset);
+typedef uint32_t sys_flenfn(ARMCPU *cpu, GuestFD *gf);
 
 static uint32_t host_closefn(ARMCPU *cpu, GuestFD *gf)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t host_seekfn(ARMCPU *cpu, GuestFD *gf, target_ulong offset)
     return 0;
 }
 
+static uint32_t host_flenfn(ARMCPU *cpu, GuestFD *gf)
+{
+    CPUARMState *env = &cpu->env;
+    struct stat buf;
+    uint32_t ret = set_swi_errno(env, fstat(gf->hostfd, &buf));
+    if (ret == (uint32_t)-1) {
+        return -1;
+    }
+    return buf.st_size;
+}
+
 static uint32_t gdb_closefn(ARMCPU *cpu, GuestFD *gf)
 {
     return arm_gdb_syscall(cpu, arm_semi_cb, "close,%x", gf->hostfd);
@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_seekfn(ARMCPU *cpu, GuestFD *gf, target_ulong offset)
                            gf->hostfd, offset);
 }
 
+static uint32_t gdb_flenfn(ARMCPU *cpu, GuestFD *gf)
+{
+    return arm_gdb_syscall(cpu, arm_semi_flen_cb, "fstat,%x,%x",
+                           gf->hostfd, arm_flen_buf(cpu));
+}
+
 typedef struct GuestFDFunctions {
     sys_closefn *closefn;
     sys_writefn *writefn;
     sys_readfn *readfn;
     sys_isattyfn *isattyfn;
     sys_seekfn *seekfn;
+    sys_flenfn *flenfn;
 } GuestFDFunctions;
 
 static const GuestFDFunctions guestfd_fns[] = {
@@ -XXX,XX +XXX,XX @@ static const GuestFDFunctions guestfd_fns[] = {
         .readfn = host_readfn,
         .isattyfn = host_isattyfn,
         .seekfn = host_seekfn,
+        .flenfn = host_flenfn,
     },
     [GuestFDGDB] = {
         .closefn = gdb_closefn,
@@ -XXX,XX +XXX,XX @@ static const GuestFDFunctions guestfd_fns[] = {
         .readfn = gdb_readfn,
         .isattyfn = gdb_isattyfn,
         .seekfn = gdb_seekfn,
+        .flenfn = gdb_flenfn,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             return set_swi_errno(env, -1);
         }
 
-        if (use_gdb_syscalls()) {
-            return arm_gdb_syscall(cpu, arm_semi_flen_cb, "fstat,%x,%x",
-                                   gf->hostfd, arm_flen_buf(cpu));
-        } else {
-            struct stat buf;
-            ret = set_swi_errno(env, fstat(gf->hostfd, &buf));
-            if (ret == (uint32_t)-1)
-                return -1;
-            return buf.st_size;
-        }
+        return guestfd_fns[gf->type].flenfn(cpu, gf);
     case TARGET_SYS_TMPNAM:
         qemu_log_mask(LOG_UNIMP, "%s: SYS_TMPNAM not implemented", __func__);
         return -1;
-- 
2.20.1

Version 2.0 of the semihosting specification added support for
allowing a guest to detect whether the implementation supported
particular features. This works by the guest opening a magic
file ":semihosting-features", which contains a fixed set of
data with some magic numbers followed by a sequence of bytes
with feature flags. The file is expected to behave sensibly
for the various semihosting calls which operate on files
(SYS_FLEN, SYS_SEEK, etc).

Implement this as another kind of guest FD using our function
table dispatch mechanism. Initially we report no extended
features, so we have just one feature flag byte which is zero.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190916141544.17540-14-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 109 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 108 insertions(+), 1 deletion(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ typedef enum GuestFDType {
     GuestFDUnused = 0,
     GuestFDHost = 1,
     GuestFDGDB = 2,
+    GuestFDFeatureFile = 3,
 } GuestFDType;
 
 /*
@@ -XXX,XX +XXX,XX @@ typedef enum GuestFDType {
  */
 typedef struct GuestFD {
     GuestFDType type;
-    int hostfd;
+    union {
+        int hostfd;
+        target_ulong featurefile_offset;
+    };
 } GuestFD;
 
 static GArray *guestfd_array;
@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_flenfn(ARMCPU *cpu, GuestFD *gf)
                            gf->hostfd, arm_flen_buf(cpu));
 }
 
+#define SHFB_MAGIC_0 0x53
+#define SHFB_MAGIC_1 0x48
+#define SHFB_MAGIC_2 0x46
+#define SHFB_MAGIC_3 0x42
+
+static const uint8_t featurefile_data[] = {
+    SHFB_MAGIC_0,
+    SHFB_MAGIC_1,
+    SHFB_MAGIC_2,
+    SHFB_MAGIC_3,
+    0, /* Feature byte 0 */
+};
+
+static void init_featurefile_guestfd(int guestfd)
+{
+    GuestFD *gf = do_get_guestfd(guestfd);
+
+    assert(gf);
+    gf->type = GuestFDFeatureFile;
+    gf->featurefile_offset = 0;
+}
+
+static uint32_t featurefile_closefn(ARMCPU *cpu, GuestFD *gf)
+{
+    /* Nothing to do */
+    return 0;
+}
+
+static uint32_t featurefile_writefn(ARMCPU *cpu, GuestFD *gf,
+                                    target_ulong buf, uint32_t len)
+{
+    /* This fd can never be open for writing */
+    CPUARMState *env = &cpu->env;
+
+    errno = EBADF;
+    return set_swi_errno(env, -1);
+}
+
+static uint32_t featurefile_readfn(ARMCPU *cpu, GuestFD *gf,
+                                   target_ulong buf, uint32_t len)
+{
+    uint32_t i;
+#ifndef CONFIG_USER_ONLY
+    CPUARMState *env = &cpu->env;
+#endif
+    char *s;
+
+    s = lock_user(VERIFY_WRITE, buf, len, 0);
+    if (!s) {
+        return len;
+    }
+
+    for (i = 0; i < len; i++) {
+        if (gf->featurefile_offset >= sizeof(featurefile_data)) {
+            break;
+        }
+        s[i] = featurefile_data[gf->featurefile_offset];
+        gf->featurefile_offset++;
+    }
+
+    unlock_user(s, buf, len);
+
+    /* Return number of bytes not read */
+    return len - i;
+}
+
+static uint32_t featurefile_isattyfn(ARMCPU *cpu, GuestFD *gf)
+{
+    return 0;
+}
+
+static uint32_t featurefile_seekfn(ARMCPU *cpu, GuestFD *gf,
+                                   target_ulong offset)
+{
+    gf->featurefile_offset = offset;
+    return 0;
+}
+
+static uint32_t featurefile_flenfn(ARMCPU *cpu, GuestFD *gf)
+{
+    return sizeof(featurefile_data);
+}
+
 typedef struct GuestFDFunctions {
     sys_closefn *closefn;
     sys_writefn *writefn;
@@ -XXX,XX +XXX,XX @@ static const GuestFDFunctions guestfd_fns[] = {
         .seekfn = gdb_seekfn,
         .flenfn = gdb_flenfn,
     },
+    [GuestFDFeatureFile] = {
+        .closefn = featurefile_closefn,
+        .writefn = featurefile_writefn,
+        .readfn = featurefile_readfn,
+        .isattyfn = featurefile_isattyfn,
+        .seekfn = featurefile_seekfn,
+        .flenfn = featurefile_flenfn,
+    },
 };
 
 /* Read the input value from the argument block; fail the semihosting
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             unlock_user(s, arg0, 0);
             return guestfd;
         }
+        if (strcmp(s, ":semihosting-features") == 0) {
+            unlock_user(s, arg0, 0);
+            /* We must fail opens for modes other than 0 ('r') or 1 ('rb') */
+            if (arg1 != 0 && arg1 != 1) {
+                dealloc_guestfd(guestfd);
+                errno = EACCES;
+                return set_swi_errno(env, -1);
+            }
+            init_featurefile_guestfd(guestfd);
+            return guestfd;
+        }
+
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-- 
2.20.1

SH_EXT_EXIT_EXTENDED is a v2.0 semihosting extension: it
indicates that the implementation supports the SYS_EXIT_EXTENDED
function. This function allows both A64 and A32/T32 guests to
exit with a specified exit status, unlike the older SYS_EXIT
function which only allowed this for A64 guests. Implement
this extension.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190916141544.17540-15-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@
 #define TARGET_SYS_HEAPINFO    0x16
 #define TARGET_SYS_EXIT        0x18
 #define TARGET_SYS_SYNCCACHE   0x19
+#define TARGET_SYS_EXIT_EXTENDED 0x20
 
 /* ADP_Stopped_ApplicationExit is used for exit(0),
  * anything else is implemented as exit(1) */
@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_flenfn(ARMCPU *cpu, GuestFD *gf)
 #define SHFB_MAGIC_2 0x46
 #define SHFB_MAGIC_3 0x42
 
+/* Feature bits reportable in feature byte 0 */
+#define SH_EXT_EXIT_EXTENDED (1 << 0)
+
 static const uint8_t featurefile_data[] = {
     SHFB_MAGIC_0,
     SHFB_MAGIC_1,
     SHFB_MAGIC_2,
     SHFB_MAGIC_3,
-    0, /* Feature byte 0 */
+    SH_EXT_EXIT_EXTENDED, /* Feature byte 0 */
 };
 
 static void init_featurefile_guestfd(int guestfd)
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             return 0;
         }
     case TARGET_SYS_EXIT:
-        if (is_a64(env)) {
+    case TARGET_SYS_EXIT_EXTENDED:
+        if (nr == TARGET_SYS_EXIT_EXTENDED || is_a64(env)) {
             /*
-             * The A64 version of this call takes a parameter block,
+             * The A64 version of SYS_EXIT takes a parameter block,
              * so the application-exit type can return a subcode which
              * is the exit status code from the application.
+             * SYS_EXIT_EXTENDED is an a new-in-v2.0 optional function
+             * which allows A32/T32 guests to also provide a status code.
              */
             GET_ARG(0);
             GET_ARG(1);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
             }
         } else {
             /*
-             * ARM specifies only Stopped_ApplicationExit as normal
-             * exit, everything else is considered an error
+             * The A32/T32 version of SYS_EXIT specifies only
+             * Stopped_ApplicationExit as normal exit, but does not
+             * allow the guest to specify the exit status code.
+             * Everything else is considered an error.
              */
             ret = (args == ADP_Stopped_ApplicationExit) ? 0 : 1;
         }
-- 
2.20.1

SH_EXT_STDOUT_STDERR is a v2.0 semihosting extension: the guest
can open ":tt" with a file mode requesting append access in
order to open stderr, in addition to the existing "open for
read for stdin or write for stdout". Implement this and
report it via the :semihosting-features data.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190916141544.17540-16-peter.maydell@linaro.org
---
 target/arm/arm-semi.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static uint32_t gdb_flenfn(ARMCPU *cpu, GuestFD *gf)
 
 /* Feature bits reportable in feature byte 0 */
 #define SH_EXT_EXIT_EXTENDED (1 << 0)
+#define SH_EXT_STDOUT_STDERR (1 << 1)
 
 static const uint8_t featurefile_data[] = {
     SHFB_MAGIC_0,
     SHFB_MAGIC_1,
     SHFB_MAGIC_2,
     SHFB_MAGIC_3,
-    SH_EXT_EXIT_EXTENDED, /* Feature byte 0 */
+    SH_EXT_EXIT_EXTENDED | SH_EXT_STDOUT_STDERR, /* Feature byte 0 */
 };
 
 static void init_featurefile_guestfd(int guestfd)
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         }
 
         if (strcmp(s, ":tt") == 0) {
-            int result_fileno = arg1 < 4 ? STDIN_FILENO : STDOUT_FILENO;
+            int result_fileno;
+
+            /*
+             * We implement SH_EXT_STDOUT_STDERR, so:
+             *  open for read == stdin
+             *  open for write == stdout
+             *  open for append == stderr
+             */
+            if (arg1 < 4) {
+                result_fileno = STDIN_FILENO;
+            } else if (arg1 < 8) {
+                result_fileno = STDOUT_FILENO;
+            } else {
+                result_fileno = STDERR_FILENO;
+            }
             associate_guestfd(guestfd, result_fileno);
             unlock_user(s, arg0, 0);
             return guestfd;
-- 
2.20.1

From: Amithash Prasad <amithash@fb.com>

When WDT_RESTART is written, the data is not the contents
of the WDT_CTRL register. Hence ensure we are looking at
WDT_CTRL to check if bit WDT_CTRL_1MHZ_CLK is set or not.

Signed-off-by: Amithash Prasad <amithash@fb.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190925143248.10000-2-clg@kaod.org
[clg: improved Suject prefix ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/watchdog/wdt_aspeed.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/wdt_aspeed.c
+++ b/hw/watchdog/wdt_aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
     case WDT_RESTART:
         if ((data & 0xFFFF) == WDT_RESTART_MAGIC) {
             s->regs[WDT_STATUS] = s->regs[WDT_RELOAD_VALUE];
-            aspeed_wdt_reload(s, !(data & WDT_CTRL_1MHZ_CLK));
+            aspeed_wdt_reload(s, !(s->regs[WDT_CTRL] & WDT_CTRL_1MHZ_CLK));
         }
         break;
     case WDT_CTRL:
-- 
2.20.1

From: Eddie James <eajames@linux.ibm.com>

The Aspeed SOCs have two SD/MMC controllers. Add a device that
encapsulates both of these controllers and models the Aspeed-specific
registers and behavior.

Tested by reading from mmcblk0 in Linux:
qemu-system-arm -machine romulus-bmc -nographic \
 -drive file=flash-romulus,format=raw,if=mtd \
 -device sd-card,drive=sd0 -drive file=_tmp/kernel,format=raw,if=sd,id=sd0

Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190925143248.10000-3-clg@kaod.org
[clg: - changed the controller MMIO window size to 0x1000
      - moved the MMIO mapping of the SDHCI slots at the SoC level
      - merged code to add SD drives on the SD buses at the machine level ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/Makefile.objs          |   1 +
 include/hw/arm/aspeed_soc.h  |   3 +
 include/hw/sd/aspeed_sdhci.h |  34 ++++++
 hw/arm/aspeed.c              |  15 ++-
 hw/arm/aspeed_soc.c          |  23 ++++
 hw/sd/aspeed_sdhci.c         | 198 +++++++++++++++++++++++++++++++++++
 6 files changed, 273 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/sd/aspeed_sdhci.h
 create mode 100644 hw/sd/aspeed_sdhci.c

diff --git a/hw/sd/Makefile.objs b/hw/sd/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/Makefile.objs
+++ b/hw/sd/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MILKYMIST) += milkymist-memcard.o
 obj-$(CONFIG_OMAP) += omap_mmc.o
 obj-$(CONFIG_PXA2XX) += pxa2xx_mmci.o
 obj-$(CONFIG_RASPI) += bcm2835_sdhost.o
+obj-$(CONFIG_ASPEED_SOC) += aspeed_sdhci.o
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/ftgmac100.h"
 #include "target/arm/cpu.h"
 #include "hw/gpio/aspeed_gpio.h"
+#include "hw/sd/aspeed_sdhci.h"
 
 #define ASPEED_SPIS_NUM  2
 #define ASPEED_WDTS_NUM  3
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
     AspeedWDTState wdt[ASPEED_WDTS_NUM];
     FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
     AspeedGPIOState gpio;
+    AspeedSDHCIState sdhci;
 } AspeedSoCState;
 
 #define TYPE_ASPEED_SOC "aspeed-soc"
@@ -XXX,XX +XXX,XX @@ enum {
     ASPEED_SCU,
     ASPEED_ADC,
     ASPEED_SRAM,
+    ASPEED_SDHCI,
     ASPEED_GPIO,
     ASPEED_RTC,
     ASPEED_TIMER1,
diff --git a/include/hw/sd/aspeed_sdhci.h b/include/hw/sd/aspeed_sdhci.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/sd/aspeed_sdhci.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Aspeed SD Host Controller
+ * Eddie James <eajames@linux.ibm.com>
+ *
+ * Copyright (C) 2019 IBM Corp
+ * SPDX-License-Identifer: GPL-2.0-or-later
+ */
+
+#ifndef ASPEED_SDHCI_H
+#define ASPEED_SDHCI_H
+
+#include "hw/sd/sdhci.h"
+
+#define TYPE_ASPEED_SDHCI "aspeed.sdhci"
+#define ASPEED_SDHCI(obj) OBJECT_CHECK(AspeedSDHCIState, (obj), \
+                                       TYPE_ASPEED_SDHCI)
+
+#define ASPEED_SDHCI_CAPABILITIES 0x01E80080
+#define ASPEED_SDHCI_NUM_SLOTS    2
+#define ASPEED_SDHCI_NUM_REGS     (ASPEED_SDHCI_REG_SIZE / sizeof(uint32_t))
+#define ASPEED_SDHCI_REG_SIZE     0x100
+
+typedef struct AspeedSDHCIState {
+    SysBusDevice parent;
+
+    SDHCIState slots[ASPEED_SDHCI_NUM_SLOTS];
+
+    MemoryRegion iomem;
+    qemu_irq irq;
+
+    uint32_t regs[ASPEED_SDHCI_NUM_REGS];
+} AspeedSDHCIState;
+
+#endif /* ASPEED_SDHCI_H */
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
     AspeedSoCClass *sc;
     DriveInfo *drive0 = drive_get(IF_MTD, 0, 0);
     ram_addr_t max_ram_size;
+    int i;
 
     bmc = g_new0(AspeedBoardState, 1);
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
         cfg->i2c_init(bmc);
     }
 
+    for (i = 0; i < ARRAY_SIZE(bmc->soc.sdhci.slots); i++) {
+        SDHCIState *sdhci = &bmc->soc.sdhci.slots[i];
+        DriveInfo *dinfo = drive_get_next(IF_SD);
+        BlockBackend *blk;
+        DeviceState *card;
+
+        blk = dinfo ? blk_by_legacy_dinfo(dinfo) : NULL;
+        card = qdev_create(qdev_get_child_bus(DEVICE(sdhci), "sd-bus"),
+                           TYPE_SD_CARD);
+        qdev_prop_set_drive(card, "drive", blk, &error_fatal);
+        object_property_set_bool(OBJECT(card), true, "realized", &error_fatal);
+    }
+
     arm_load_kernel(ARM_CPU(first_cpu), machine, &aspeed_board_binfo);
 }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_class_init(ObjectClass *oc, void *data)
     mc->desc = board->desc;
     mc->init = aspeed_machine_init;
     mc->max_cpus = ASPEED_CPUS_NUM;
-    mc->no_sdcard = 1;
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->no_parallel = 1;
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2400_memmap[] = {
     [ASPEED_XDMA]   = 0x1E6E7000,
     [ASPEED_ADC]    = 0x1E6E9000,
     [ASPEED_SRAM]   = 0x1E720000,
+    [ASPEED_SDHCI]  = 0x1E740000,
     [ASPEED_GPIO]   = 0x1E780000,
     [ASPEED_RTC]    = 0x1E781000,
     [ASPEED_TIMER1] = 0x1E782000,
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2500_memmap[] = {
     [ASPEED_XDMA]   = 0x1E6E7000,
     [ASPEED_ADC]    = 0x1E6E9000,
     [ASPEED_SRAM]   = 0x1E720000,
+    [ASPEED_SDHCI]  = 0x1E740000,
     [ASPEED_GPIO]   = 0x1E780000,
     [ASPEED_RTC]    = 0x1E781000,
     [ASPEED_TIMER1] = 0x1E782000,
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2400_irqmap[] = {
     [ASPEED_ETH1]   = 2,
     [ASPEED_ETH2]   = 3,
     [ASPEED_XDMA]   = 6,
+    [ASPEED_SDHCI]  = 26,
 };
 
 #define aspeed_soc_ast2500_irqmap aspeed_soc_ast2400_irqmap
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
     sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
                           typename);
+
+    sysbus_init_child_obj(obj, "sdc", OBJECT(&s->sdhci), sizeof(s->sdhci),
+                          TYPE_ASPEED_SDHCI);
+
+    /* Init sd card slot class here so that they're under the correct parent */
+    for (i = 0; i < ASPEED_SDHCI_NUM_SLOTS; ++i) {
+        sysbus_init_child_obj(obj, "sdhci[*]", OBJECT(&s->sdhci.slots[i]),
+                              sizeof(s->sdhci.slots[i]), TYPE_SYSBUS_SDHCI);
+    }
 }
 
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->info->memmap[ASPEED_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                        aspeed_soc_get_irq(s, ASPEED_GPIO));
+
+    /* SDHCI */
+    object_property_set_bool(OBJECT(&s->sdhci), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
+                    sc->info->memmap[ASPEED_SDHCI]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
+                       aspeed_soc_get_irq(s, ASPEED_SDHCI));
 }
 static Property aspeed_soc_properties[] = {
     DEFINE_PROP_UINT32("num-cpus", AspeedSoCState, num_cpus, 0),
diff --git a/hw/sd/aspeed_sdhci.c b/hw/sd/aspeed_sdhci.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/sd/aspeed_sdhci.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Aspeed SD Host Controller
+ * Eddie James <eajames@linux.ibm.com>
+ *
+ * Copyright (C) 2019 IBM Corp
+ * SPDX-License-Identifer: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/error-report.h"
+#include "hw/sd/aspeed_sdhci.h"
+#include "qapi/error.h"
+#include "hw/irq.h"
+#include "migration/vmstate.h"
+
+#define ASPEED_SDHCI_INFO            0x00
+#define  ASPEED_SDHCI_INFO_RESET     0x00030000
+#define ASPEED_SDHCI_DEBOUNCE        0x04
+#define  ASPEED_SDHCI_DEBOUNCE_RESET 0x00000005
+#define ASPEED_SDHCI_BUS             0x08
+#define ASPEED_SDHCI_SDIO_140        0x10
+#define ASPEED_SDHCI_SDIO_148        0x18
+#define ASPEED_SDHCI_SDIO_240        0x20
+#define ASPEED_SDHCI_SDIO_248        0x28
+#define ASPEED_SDHCI_WP_POL          0xec
+#define ASPEED_SDHCI_CARD_DET        0xf0
+#define ASPEED_SDHCI_IRQ_STAT        0xfc
+
+#define TO_REG(addr) ((addr) / sizeof(uint32_t))
+
+static uint64_t aspeed_sdhci_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    uint32_t val = 0;
+    AspeedSDHCIState *sdhci = opaque;
+
+    switch (addr) {
+    case ASPEED_SDHCI_SDIO_140:
+        val = (uint32_t)sdhci->slots[0].capareg;
+        break;
+    case ASPEED_SDHCI_SDIO_148:
+        val = (uint32_t)sdhci->slots[0].maxcurr;
+        break;
+    case ASPEED_SDHCI_SDIO_240:
+        val = (uint32_t)sdhci->slots[1].capareg;
+        break;
+    case ASPEED_SDHCI_SDIO_248:
+        val = (uint32_t)sdhci->slots[1].maxcurr;
+        break;
+    default:
+        if (addr < ASPEED_SDHCI_REG_SIZE) {
+            val = sdhci->regs[TO_REG(addr)];
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Out-of-bounds read at 0x%" HWADDR_PRIx "\n",
+                          __func__, addr);
+        }
+    }
+
+    return (uint64_t)val;
+}
+
+static void aspeed_sdhci_write(void *opaque, hwaddr addr, uint64_t val,
+                               unsigned int size)
+{
+    AspeedSDHCIState *sdhci = opaque;
+
+    switch (addr) {
+    case ASPEED_SDHCI_SDIO_140:
+        sdhci->slots[0].capareg = (uint64_t)(uint32_t)val;
+        break;
+    case ASPEED_SDHCI_SDIO_148:
+        sdhci->slots[0].maxcurr = (uint64_t)(uint32_t)val;
+        break;
+    case ASPEED_SDHCI_SDIO_240:
+        sdhci->slots[1].capareg = (uint64_t)(uint32_t)val;
+        break;
+    case ASPEED_SDHCI_SDIO_248:
+        sdhci->slots[1].maxcurr = (uint64_t)(uint32_t)val;
+        break;
+    default:
+        if (addr < ASPEED_SDHCI_REG_SIZE) {
+            sdhci->regs[TO_REG(addr)] = (uint32_t)val;
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Out-of-bounds write at 0x%" HWADDR_PRIx "\n",
+                          __func__, addr);
+        }
+    }
+}
+
+static const MemoryRegionOps aspeed_sdhci_ops = {
+    .read = aspeed_sdhci_read,
+    .write = aspeed_sdhci_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+};
+
+static void aspeed_sdhci_set_irq(void *opaque, int n, int level)
+{
+    AspeedSDHCIState *sdhci = opaque;
+
+    if (level) {
+        sdhci->regs[TO_REG(ASPEED_SDHCI_IRQ_STAT)] |= BIT(n);
+
+        qemu_irq_raise(sdhci->irq);
+    } else {
+        sdhci->regs[TO_REG(ASPEED_SDHCI_IRQ_STAT)] &= ~BIT(n);
+
+        qemu_irq_lower(sdhci->irq);
+    }
+}
+
+static void aspeed_sdhci_realize(DeviceState *dev, Error **errp)
+{
+    Error *err = NULL;
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    AspeedSDHCIState *sdhci = ASPEED_SDHCI(dev);
+
+    /* Create input irqs for the slots */
+    qdev_init_gpio_in_named_with_opaque(DEVICE(sbd), aspeed_sdhci_set_irq,
+                                        sdhci, NULL, ASPEED_SDHCI_NUM_SLOTS);
+
+    sysbus_init_irq(sbd, &sdhci->irq);
+    memory_region_init_io(&sdhci->iomem, OBJECT(sdhci), &aspeed_sdhci_ops,
+                          sdhci, TYPE_ASPEED_SDHCI, 0x1000);
+    sysbus_init_mmio(sbd, &sdhci->iomem);
+
+    for (int i = 0; i < ASPEED_SDHCI_NUM_SLOTS; ++i) {
+        Object *sdhci_slot = OBJECT(&sdhci->slots[i]);
+        SysBusDevice *sbd_slot = SYS_BUS_DEVICE(&sdhci->slots[i]);
+
+        object_property_set_int(sdhci_slot, 2, "sd-spec-version", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+
+        object_property_set_uint(sdhci_slot, ASPEED_SDHCI_CAPABILITIES,
+                                 "capareg", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+
+        object_property_set_bool(sdhci_slot, true, "realized", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+
+        sysbus_connect_irq(sbd_slot, 0, qdev_get_gpio_in(DEVICE(sbd), i));
+        memory_region_add_subregion(&sdhci->iomem, (i + 1) * 0x100,
+                                    &sdhci->slots[i].iomem);
+    }
+}
+
+static void aspeed_sdhci_reset(DeviceState *dev)
+{
+    AspeedSDHCIState *sdhci = ASPEED_SDHCI(dev);
+
+    memset(sdhci->regs, 0, ASPEED_SDHCI_REG_SIZE);
+    sdhci->regs[TO_REG(ASPEED_SDHCI_INFO)] = ASPEED_SDHCI_INFO_RESET;
+    sdhci->regs[TO_REG(ASPEED_SDHCI_DEBOUNCE)] = ASPEED_SDHCI_DEBOUNCE_RESET;
+}
+
+static const VMStateDescription vmstate_aspeed_sdhci = {
+    .name = TYPE_ASPEED_SDHCI,
+    .version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, AspeedSDHCIState, ASPEED_SDHCI_NUM_REGS),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static void aspeed_sdhci_class_init(ObjectClass *classp, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(classp);
+
+    dc->realize = aspeed_sdhci_realize;
+    dc->reset = aspeed_sdhci_reset;
+    dc->vmsd = &vmstate_aspeed_sdhci;
+}
+
+static TypeInfo aspeed_sdhci_info = {
+    .name          = TYPE_ASPEED_SDHCI,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(AspeedSDHCIState),
+    .class_init    = aspeed_sdhci_class_init,
+};
+
+static void aspeed_sdhci_register_types(void)
+{
+    type_register_static(&aspeed_sdhci_info);
+}
+
+type_init(aspeed_sdhci_register_types)
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

The SCU controller on the AST2600 SoC has extra registers. Increase
the number of regs of the model and introduce a new field in the class
to customize the MemoryRegion operations depending on the SoC model.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190925143248.10000-4-clg@kaod.org
[clg: - improved commit log
      - changed vmstate version
      - reworked model integration into new object class
      - included AST2600_HPLL_PARAM value ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/aspeed_scu.h |   7 +-
 hw/misc/aspeed_scu.c         | 192 +++++++++++++++++++++++++++++++++--
 2 files changed, 191 insertions(+), 8 deletions(-)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_SCU(obj) OBJECT_CHECK(AspeedSCUState, (obj), TYPE_ASPEED_SCU)
 #define TYPE_ASPEED_2400_SCU TYPE_ASPEED_SCU "-ast2400"
 #define TYPE_ASPEED_2500_SCU TYPE_ASPEED_SCU "-ast2500"
+#define TYPE_ASPEED_2600_SCU TYPE_ASPEED_SCU "-ast2600"
 
 #define ASPEED_SCU_NR_REGS (0x1A8 >> 2)
+#define ASPEED_AST2600_SCU_NR_REGS (0xE20 >> 2)
 
 typedef struct AspeedSCUState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
     /*< public >*/
     MemoryRegion iomem;
 
-    uint32_t regs[ASPEED_SCU_NR_REGS];
+    uint32_t regs[ASPEED_AST2600_SCU_NR_REGS];
     uint32_t silicon_rev;
     uint32_t hw_strap1;
     uint32_t hw_strap2;
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
 #define AST2400_A1_SILICON_REV   0x02010303U
 #define AST2500_A0_SILICON_REV   0x04000303U
 #define AST2500_A1_SILICON_REV   0x04010303U
+#define AST2600_A0_SILICON_REV   0x05000303U
 
 #define ASPEED_IS_AST2500(si_rev)     ((((si_rev) >> 24) & 0xff) == 0x04)
 
@@ -XXX,XX +XXX,XX @@ typedef struct  AspeedSCUClass {
     const uint32_t *resets;
     uint32_t (*calc_hpll)(AspeedSCUState *s, uint32_t hpll_reg);
     uint32_t apb_divider;
+    uint32_t nr_regs;
+    const MemoryRegionOps *ops;
 }  AspeedSCUClass;
 
 #define ASPEED_SCU_PROT_KEY      0x1688A8A8
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -XXX,XX +XXX,XX @@
 #define BMC_REV              TO_REG(0x19C)
 #define BMC_DEV_ID           TO_REG(0x1A4)
 
+#define AST2600_PROT_KEY          TO_REG(0x00)
+#define AST2600_SILICON_REV       TO_REG(0x04)
+#define AST2600_SILICON_REV2      TO_REG(0x14)
+#define AST2600_SYS_RST_CTRL      TO_REG(0x40)
+#define AST2600_SYS_RST_CTRL_CLR  TO_REG(0x44)
+#define AST2600_SYS_RST_CTRL2     TO_REG(0x50)
+#define AST2600_SYS_RST_CTRL2_CLR TO_REG(0x54)
+#define AST2600_CLK_STOP_CTRL     TO_REG(0x80)
+#define AST2600_CLK_STOP_CTRL_CLR TO_REG(0x84)
+#define AST2600_CLK_STOP_CTRL2     TO_REG(0x90)
+#define AST2600_CLK_STOP_CTR2L_CLR TO_REG(0x94)
+#define AST2600_HPLL_PARAM        TO_REG(0x200)
+#define AST2600_HPLL_EXT          TO_REG(0x204)
+#define AST2600_MPLL_EXT          TO_REG(0x224)
+#define AST2600_EPLL_EXT          TO_REG(0x244)
+#define AST2600_CLK_SEL           TO_REG(0x300)
+#define AST2600_CLK_SEL2          TO_REG(0x304)
+#define AST2600_CLK_SEL3          TO_REG(0x310)
+#define AST2600_HW_STRAP1         TO_REG(0x500)
+#define AST2600_HW_STRAP1_CLR     TO_REG(0x504)
+#define AST2600_HW_STRAP1_PROT    TO_REG(0x508)
+#define AST2600_HW_STRAP2         TO_REG(0x510)
+#define AST2600_HW_STRAP2_CLR     TO_REG(0x514)
+#define AST2600_HW_STRAP2_PROT    TO_REG(0x518)
+#define AST2600_RNG_CTRL          TO_REG(0x524)
+#define AST2600_RNG_DATA          TO_REG(0x540)
+
+#define AST2600_CLK TO_REG(0x40)
+
 #define SCU_IO_REGION_SIZE 0x1000
 
 static const uint32_t ast2400_a0_resets[ASPEED_SCU_NR_REGS] = {
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_scu_read(void *opaque, hwaddr offset, unsigned size)
     AspeedSCUState *s = ASPEED_SCU(opaque);
     int reg = TO_REG(offset);
 
-    if (reg >= ARRAY_SIZE(s->regs)) {
+    if (reg >= ASPEED_SCU_NR_REGS) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
                       __func__, offset);
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
     AspeedSCUState *s = ASPEED_SCU(opaque);
     int reg = TO_REG(offset);
 
-    if (reg >= ARRAY_SIZE(s->regs)) {
+    if (reg >= ASPEED_SCU_NR_REGS) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
                       __func__, offset);
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_reset(DeviceState *dev)
     AspeedSCUState *s = ASPEED_SCU(dev);
     AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
 
-    memcpy(s->regs, asc->resets, sizeof(s->regs));
+    memcpy(s->regs, asc->resets, asc->nr_regs * 4);
     s->regs[SILICON_REV] = s->silicon_rev;
     s->regs[HW_STRAP1] = s->hw_strap1;
     s->regs[HW_STRAP2] = s->hw_strap2;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_silicon_revs[] = {
     AST2400_A1_SILICON_REV,
     AST2500_A0_SILICON_REV,
     AST2500_A1_SILICON_REV,
+    AST2600_A0_SILICON_REV,
 };
 
 bool is_supported_silicon_rev(uint32_t silicon_rev)
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_realize(DeviceState *dev, Error **errp)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     AspeedSCUState *s = ASPEED_SCU(dev);
+    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
 
     if (!is_supported_silicon_rev(s->silicon_rev)) {
         error_setg(errp, "Unknown silicon revision: 0x%" PRIx32,
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_scu_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(s), asc->ops, s,
                           TYPE_ASPEED_SCU, SCU_IO_REGION_SIZE);
 
     sysbus_init_mmio(sbd, &s->iomem);
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_realize(DeviceState *dev, Error **errp)
 
 static const VMStateDescription vmstate_aspeed_scu = {
     .name = "aspeed.scu",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
-        VMSTATE_UINT32_ARRAY(regs, AspeedSCUState, ASPEED_SCU_NR_REGS),
+        VMSTATE_UINT32_ARRAY(regs, AspeedSCUState, ASPEED_AST2600_SCU_NR_REGS),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -XXX,XX +XXX,XX @@ static void aspeed_2400_scu_class_init(ObjectClass *klass, void *data)
     asc->resets = ast2400_a0_resets;
     asc->calc_hpll = aspeed_2400_scu_calc_hpll;
     asc->apb_divider = 2;
+    asc->nr_regs = ASPEED_SCU_NR_REGS;
+    asc->ops = &aspeed_scu_ops;
 }
 
 static const TypeInfo aspeed_2400_scu_info = {
@@ -XXX,XX +XXX,XX @@ static void aspeed_2500_scu_class_init(ObjectClass *klass, void *data)
     asc->resets = ast2500_a1_resets;
     asc->calc_hpll = aspeed_2500_scu_calc_hpll;
     asc->apb_divider = 4;
+    asc->nr_regs = ASPEED_SCU_NR_REGS;
+    asc->ops = &aspeed_scu_ops;
 }
 
 static const TypeInfo aspeed_2500_scu_info = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_2500_scu_info = {
     .class_init = aspeed_2500_scu_class_init,
 };
 
+static uint64_t aspeed_ast2600_scu_read(void *opaque, hwaddr offset,
+                                        unsigned size)
+{
+    AspeedSCUState *s = ASPEED_SCU(opaque);
+    int reg = TO_REG(offset);
+
+    if (reg >= ASPEED_AST2600_SCU_NR_REGS) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+        return 0;
+    }
+
+    switch (reg) {
+    case AST2600_HPLL_EXT:
+    case AST2600_EPLL_EXT:
+    case AST2600_MPLL_EXT:
+        /* PLLs are always "locked" */
+        return s->regs[reg] | BIT(31);
+    case AST2600_RNG_DATA:
+        /*
+         * On hardware, RNG_DATA works regardless of the state of the
+         * enable bit in RNG_CTRL
+         *
+         * TODO: Check this is true for ast2600
+         */
+        s->regs[AST2600_RNG_DATA] = aspeed_scu_get_random();
+        break;
+    }
+
+    return s->regs[reg];
+}
+
+static void aspeed_ast2600_scu_write(void *opaque, hwaddr offset, uint64_t data,
+                                     unsigned size)
+{
+    AspeedSCUState *s = ASPEED_SCU(opaque);
+    int reg = TO_REG(offset);
+
+    if (reg >= ASPEED_AST2600_SCU_NR_REGS) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+        return;
+    }
+
+    if (reg > PROT_KEY && !s->regs[PROT_KEY]) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: SCU is locked!\n", __func__);
+    }
+
+    trace_aspeed_scu_write(offset, size, data);
+
+    switch (reg) {
+    case AST2600_PROT_KEY:
+        s->regs[reg] = (data == ASPEED_SCU_PROT_KEY) ? 1 : 0;
+        return;
+    case AST2600_HW_STRAP1:
+    case AST2600_HW_STRAP2:
+        if (s->regs[reg + 2]) {
+            return;
+        }
+        /* fall through */
+    case AST2600_SYS_RST_CTRL:
+    case AST2600_SYS_RST_CTRL2:
+        /* W1S (Write 1 to set) registers */
+        s->regs[reg] |= data;
+        return;
+    case AST2600_SYS_RST_CTRL_CLR:
+    case AST2600_SYS_RST_CTRL2_CLR:
+    case AST2600_HW_STRAP1_CLR:
+    case AST2600_HW_STRAP2_CLR:
+        /* W1C (Write 1 to clear) registers */
+        s->regs[reg] &= ~data;
+        return;
+
+    case AST2600_RNG_DATA:
+    case AST2600_SILICON_REV:
+    case AST2600_SILICON_REV2:
+        /* Add read only registers here */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Write to read-only offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+        return;
+    }
+
+    s->regs[reg] = data;
+}
+
+static const MemoryRegionOps aspeed_ast2600_scu_ops = {
+    .read = aspeed_ast2600_scu_read,
+    .write = aspeed_ast2600_scu_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+    .valid.unaligned = false,
+};
+
+static const uint32_t ast2600_a0_resets[ASPEED_AST2600_SCU_NR_REGS] = {
+    [AST2600_SILICON_REV]       = AST2600_SILICON_REV,
+    [AST2600_SILICON_REV2]      = AST2600_SILICON_REV,
+    [AST2600_SYS_RST_CTRL]      = 0xF7CFFEDC | 0x100,
+    [AST2600_SYS_RST_CTRL2]     = 0xFFFFFFFC,
+    [AST2600_CLK_STOP_CTRL]     = 0xEFF43E8B,
+    [AST2600_CLK_STOP_CTRL2]    = 0xFFF0FFF0,
+    [AST2600_HPLL_PARAM]        = 0x1000405F,
+};
+
+static void aspeed_ast2600_scu_reset(DeviceState *dev)
+{
+    AspeedSCUState *s = ASPEED_SCU(dev);
+    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
+
+    memcpy(s->regs, asc->resets, asc->nr_regs * 4);
+
+    s->regs[AST2600_SILICON_REV] = s->silicon_rev;
+    s->regs[AST2600_SILICON_REV2] = s->silicon_rev;
+    s->regs[AST2600_HW_STRAP1] = s->hw_strap1;
+    s->regs[AST2600_HW_STRAP2] = s->hw_strap2;
+    s->regs[PROT_KEY] = s->hw_prot_key;
+}
+
+static void aspeed_2600_scu_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
+
+    dc->desc = "ASPEED 2600 System Control Unit";
+    dc->reset = aspeed_ast2600_scu_reset;
+    asc->resets = ast2600_a0_resets;
+    asc->calc_hpll = aspeed_2500_scu_calc_hpll; /* No change since AST2500 */
+    asc->apb_divider = 4;
+    asc->nr_regs = ASPEED_AST2600_SCU_NR_REGS;
+    asc->ops = &aspeed_ast2600_scu_ops;
+}
+
+static const TypeInfo aspeed_2600_scu_info = {
+    .name = TYPE_ASPEED_2600_SCU,
+    .parent = TYPE_ASPEED_SCU,
+    .instance_size = sizeof(AspeedSCUState),
+    .class_init = aspeed_2600_scu_class_init,
+};
+
 static void aspeed_scu_register_types(void)
 {
     type_register_static(&aspeed_scu_info);
     type_register_static(&aspeed_2400_scu_info);
     type_register_static(&aspeed_2500_scu_info);
+    type_register_static(&aspeed_2600_scu_info);
 }
 
 type_init(aspeed_scu_register_types);
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

The most important changes will be on the register range 0x34 - 0x3C
memops. Introduce class read/write operations to handle the
differences between SoCs.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-5-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/timer/aspeed_timer.h |  15 +++++
 hw/arm/aspeed_soc.c             |   3 +-
 hw/timer/aspeed_timer.c         | 107 ++++++++++++++++++++++++++++----
 3 files changed, 113 insertions(+), 12 deletions(-)

diff --git a/include/hw/timer/aspeed_timer.h b/include/hw/timer/aspeed_timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/aspeed_timer.h
+++ b/include/hw/timer/aspeed_timer.h
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_TIMER(obj) \
     OBJECT_CHECK(AspeedTimerCtrlState, (obj), TYPE_ASPEED_TIMER);
 #define TYPE_ASPEED_TIMER "aspeed.timer"
+#define TYPE_ASPEED_2400_TIMER TYPE_ASPEED_TIMER "-ast2400"
+#define TYPE_ASPEED_2500_TIMER TYPE_ASPEED_TIMER "-ast2500"
+
 #define ASPEED_TIMER_NR_TIMERS 8
 
 typedef struct AspeedTimer {
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedTimerCtrlState {
     AspeedSCUState *scu;
 } AspeedTimerCtrlState;
 
+#define ASPEED_TIMER_CLASS(klass) \
+     OBJECT_CLASS_CHECK(AspeedTimerClass, (klass), TYPE_ASPEED_TIMER)
+#define ASPEED_TIMER_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(AspeedTimerClass, (obj), TYPE_ASPEED_TIMER)
+
+typedef struct AspeedTimerClass {
+    SysBusDeviceClass parent_class;
+
+    uint64_t (*read)(AspeedTimerCtrlState *s, hwaddr offset);
+    void (*write)(AspeedTimerCtrlState *s, hwaddr offset, uint64_t value);
+} AspeedTimerClass;
+
 #endif /* ASPEED_TIMER_H */
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     sysbus_init_child_obj(obj, "rtc", OBJECT(&s->rtc), sizeof(s->rtc),
                           TYPE_ASPEED_RTC);
 
+    snprintf(typename, sizeof(typename), "aspeed.timer-%s", socname);
     sysbus_init_child_obj(obj, "timerctrl", OBJECT(&s->timerctrl),
-                          sizeof(s->timerctrl), TYPE_ASPEED_TIMER);
+                          sizeof(s->timerctrl), typename);
     object_property_add_const_link(OBJECT(&s->timerctrl), "scu",
                                    OBJECT(&s->scu), &error_abort);
 
diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_timer_read(void *opaque, hwaddr offset, unsigned size)
     case 0x40 ... 0x8c: /* Timers 5 - 8 */
         value = aspeed_timer_get_value(&s->timers[(offset >> 4) - 1], reg);
         break;
-    /* Illegal */
-    case 0x38:
-    case 0x3C:
     default:
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
-                __func__, offset);
-        value = 0;
+        value = ASPEED_TIMER_GET_CLASS(s)->read(s, offset);
         break;
     }
     trace_aspeed_timer_read(offset, size, value);
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_write(void *opaque, hwaddr offset, uint64_t value,
     case 0x40 ... 0x8c:
         aspeed_timer_set_value(s, (offset >> TIMER_NR_REGS) - 1, reg, tv);
         break;
-    /* Illegal */
-    case 0x38:
-    case 0x3C:
     default:
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
-                __func__, offset);
+        ASPEED_TIMER_GET_CLASS(s)->write(s, offset, value);
         break;
     }
 }
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_timer_ops = {
     .valid.unaligned = false,
 };
 
+static uint64_t aspeed_2400_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
+{
+    uint64_t value;
+
+    switch (offset) {
+    case 0x38:
+    case 0x3C:
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
+                __func__, offset);
+        value = 0;
+        break;
+    }
+    return value;
+}
+
+static void aspeed_2400_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
+                                    uint64_t value)
+{
+    switch (offset) {
+    case 0x38:
+    case 0x3C:
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
+                __func__, offset);
+        break;
+    }
+}
+
+static uint64_t aspeed_2500_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
+{
+    uint64_t value;
+
+    switch (offset) {
+    case 0x38:
+    case 0x3C:
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
+                __func__, offset);
+        value = 0;
+        break;
+    }
+    return value;
+}
+
+static void aspeed_2500_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
+                                    uint64_t value)
+{
+    switch (offset) {
+    case 0x38:
+    case 0x3C:
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
+                __func__, offset);
+        break;
+    }
+}
+
 static void aspeed_init_one_timer(AspeedTimerCtrlState *s, uint8_t id)
 {
     AspeedTimer *t = &s->timers[id];
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_timer_info = {
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(AspeedTimerCtrlState),
     .class_init = timer_class_init,
+    .class_size = sizeof(AspeedTimerClass),
+    .abstract   = true,
+};
+
+static void aspeed_2400_timer_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedTimerClass *awc = ASPEED_TIMER_CLASS(klass);
+
+    dc->desc = "ASPEED 2400 Timer";
+    awc->read = aspeed_2400_timer_read;
+    awc->write = aspeed_2400_timer_write;
+}
+
+static const TypeInfo aspeed_2400_timer_info = {
+    .name = TYPE_ASPEED_2400_TIMER,
+    .parent = TYPE_ASPEED_TIMER,
+    .class_init = aspeed_2400_timer_class_init,
+};
+
+static void aspeed_2500_timer_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedTimerClass *awc = ASPEED_TIMER_CLASS(klass);
+
+    dc->desc = "ASPEED 2500 Timer";
+    awc->read = aspeed_2500_timer_read;
+    awc->write = aspeed_2500_timer_write;
+}
+
+static const TypeInfo aspeed_2500_timer_info = {
+    .name = TYPE_ASPEED_2500_TIMER,
+    .parent = TYPE_ASPEED_TIMER,
+    .class_init = aspeed_2500_timer_class_init,
 };
 
 static void aspeed_timer_register_types(void)
 {
     type_register_static(&aspeed_timer_info);
+    type_register_static(&aspeed_2400_timer_info);
+    type_register_static(&aspeed_2500_timer_info);
 }
 
 type_init(aspeed_timer_register_types)
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

The AST2500 timer has a third control register that is used to
implement a set-to-clear feature for the main control register.

This models the behaviour expected by the AST2500 while maintaining
the same behaviour for the AST2400.

The vmstate version is not increased yet because the structure is
modified again in the following patches.

Based on previous work from Joel Stanley.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-6-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/timer/aspeed_timer.h |  1 +
 hw/timer/aspeed_timer.c         | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/include/hw/timer/aspeed_timer.h b/include/hw/timer/aspeed_timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/aspeed_timer.h
+++ b/include/hw/timer/aspeed_timer.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedTimerCtrlState {
 
     uint32_t ctrl;
     uint32_t ctrl2;
+    uint32_t ctrl3;
     AspeedTimer timers[ASPEED_TIMER_NR_TIMERS];
 
     AspeedSCUState *scu;
diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2500_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
 
     switch (offset) {
     case 0x38:
+        value = s->ctrl3 & BIT(0);
+        break;
     case 0x3C:
     default:
         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2500_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
 static void aspeed_2500_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
                                     uint64_t value)
 {
+    const uint32_t tv = (uint32_t)(value & 0xFFFFFFFF);
+    uint8_t command;
+
     switch (offset) {
     case 0x38:
+        command = (value >> 1) & 0xFF;
+        if (command == 0xAE) {
+            s->ctrl3 = 0x1;
+        } else if (command == 0xEA) {
+            s->ctrl3 = 0x0;
+        }
+        break;
     case 0x3C:
+        if (s->ctrl3 & BIT(0)) {
+            aspeed_timer_set_ctrl(s, s->ctrl & ~tv);
+        }
+        break;
+
     default:
         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
                 __func__, offset);
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_reset(DeviceState *dev)
     }
     s->ctrl = 0;
     s->ctrl2 = 0;
+    s->ctrl3 = 0;
 }
 
 static const VMStateDescription vmstate_aspeed_timer = {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_timer_state = {
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(ctrl, AspeedTimerCtrlState),
         VMSTATE_UINT32(ctrl2, AspeedTimerCtrlState),
+        VMSTATE_UINT32(ctrl3, AspeedTimerCtrlState),
         VMSTATE_STRUCT_ARRAY(timers, AspeedTimerCtrlState,
                              ASPEED_TIMER_NR_TIMERS, 1, vmstate_aspeed_timer,
                              AspeedTimer),
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

The AST2600 timer has a third control register that is used to
implement a set-to-clear feature for the main control register.

On the AST2600, it is not configurable via 0x38 (control register 3)
as it is on the AST2500.

Based on previous work from Joel Stanley.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-7-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/timer/aspeed_timer.h |  1 +
 hw/timer/aspeed_timer.c         | 51 +++++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)

From: Cédric Le Goater <clg@kaod.org>

The AST2600 timer replaces control register 2 with a interrupt status
register. It is set by hardware when an IRQ occurs and cleared by
software.

Modify the vmstate version to take into account the new fields.

Based on previous work from Joel Stanley.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-8-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/timer/aspeed_timer.h |  1 +
 hw/timer/aspeed_timer.c         | 36 +++++++++++++++++++++++++--------
 2 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/include/hw/timer/aspeed_timer.h b/include/hw/timer/aspeed_timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/aspeed_timer.h
+++ b/include/hw/timer/aspeed_timer.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedTimerCtrlState {
     uint32_t ctrl;
     uint32_t ctrl2;
     uint32_t ctrl3;
+    uint32_t irq_sts;
     AspeedTimer timers[ASPEED_TIMER_NR_TIMERS];
 
     AspeedSCUState *scu;
diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -XXX,XX +XXX,XX @@ static uint64_t calculate_next(struct AspeedTimer *t)
     timer_del(&t->timer);
 
     if (timer_overflow_interrupt(t)) {
+        AspeedTimerCtrlState *s = timer_to_ctrl(t);
         t->level = !t->level;
+        s->irq_sts |= BIT(t->id);
         qemu_set_irq(t->irq, t->level);
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_expire(void *opaque)
     }
 
     if (interrupt) {
+        AspeedTimerCtrlState *s = timer_to_ctrl(t);
         t->level = !t->level;
+        s->irq_sts |= BIT(t->id);
         qemu_set_irq(t->irq, t->level);
     }
 
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_timer_read(void *opaque, hwaddr offset, unsigned size)
     case 0x30: /* Control Register */
         value = s->ctrl;
         break;
-    case 0x34: /* Control Register 2 */
-        value = s->ctrl2;
-        break;
     case 0x00 ... 0x2c: /* Timers 1 - 4 */
         value = aspeed_timer_get_value(&s->timers[(offset >> 4)], reg);
         break;
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_write(void *opaque, hwaddr offset, uint64_t value,
     case 0x30:
         aspeed_timer_set_ctrl(s, tv);
         break;
-    case 0x34:
-        aspeed_timer_set_ctrl2(s, tv);
-        break;
     /* Timer Registers */
     case 0x00 ... 0x2c:
         aspeed_timer_set_value(s, (offset >> TIMER_NR_REGS), reg, tv);
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2400_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
     uint64_t value;
 
     switch (offset) {
+    case 0x34:
+        value = s->ctrl2;
+        break;
     case 0x38:
     case 0x3C:
     default:
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2400_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
 static void aspeed_2400_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
                                     uint64_t value)
 {
+    const uint32_t tv = (uint32_t)(value & 0xFFFFFFFF);
+
     switch (offset) {
+    case 0x34:
+        aspeed_timer_set_ctrl2(s, tv);
+        break;
     case 0x38:
     case 0x3C:
     default:
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2500_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
     uint64_t value;
 
     switch (offset) {
+    case 0x34:
+        value = s->ctrl2;
+        break;
     case 0x38:
         value = s->ctrl3 & BIT(0);
         break;
@@ -XXX,XX +XXX,XX @@ static void aspeed_2500_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
     uint8_t command;
 
     switch (offset) {
+    case 0x34:
+        aspeed_timer_set_ctrl2(s, tv);
+        break;
     case 0x38:
         command = (value >> 1) & 0xFF;
         if (command == 0xAE) {
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_2600_timer_read(AspeedTimerCtrlState *s, hwaddr offset)
     uint64_t value;
 
     switch (offset) {
+    case 0x34:
+        value = s->irq_sts;
+        break;
     case 0x38:
     case 0x3C:
     default:
@@ -XXX,XX +XXX,XX @@ static void aspeed_2600_timer_write(AspeedTimerCtrlState *s, hwaddr offset,
     const uint32_t tv = (uint32_t)(value & 0xFFFFFFFF);
 
     switch (offset) {
+    case 0x34:
+        s->irq_sts &= tv;
+        break;
     case 0x3C:
         aspeed_timer_set_ctrl(s, s->ctrl & ~tv);
         break;
@@ -XXX,XX +XXX,XX @@ static void aspeed_timer_reset(DeviceState *dev)
     s->ctrl = 0;
     s->ctrl2 = 0;
     s->ctrl3 = 0;
+    s->irq_sts = 0;
 }
 
 static const VMStateDescription vmstate_aspeed_timer = {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_timer = {
 
 static const VMStateDescription vmstate_aspeed_timer_state = {
     .name = "aspeed.timerctrl",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(ctrl, AspeedTimerCtrlState),
         VMSTATE_UINT32(ctrl2, AspeedTimerCtrlState),
         VMSTATE_UINT32(ctrl3, AspeedTimerCtrlState),
+        VMSTATE_UINT32(irq_sts, AspeedTimerCtrlState),
         VMSTATE_STRUCT_ARRAY(timers, AspeedTimerCtrlState,
                              ASPEED_TIMER_NR_TIMERS, 1, vmstate_aspeed_timer,
                              AspeedTimer),
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

Use class handlers and class constants to differentiate the
characteristics of the memory controller and remove the 'silicon_rev'
property.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-9-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/aspeed_sdmc.h |  19 +++-
 hw/arm/aspeed_soc.c           |   5 +-
 hw/misc/aspeed_sdmc.c         | 168 +++++++++++++++++++++-------------
 3 files changed, 122 insertions(+), 70 deletions(-)

diff --git a/include/hw/misc/aspeed_sdmc.h b/include/hw/misc/aspeed_sdmc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/aspeed_sdmc.h
+++ b/include/hw/misc/aspeed_sdmc.h
@@ -XXX,XX +XXX,XX @@
 
 #define TYPE_ASPEED_SDMC "aspeed.sdmc"
 #define ASPEED_SDMC(obj) OBJECT_CHECK(AspeedSDMCState, (obj), TYPE_ASPEED_SDMC)
+#define TYPE_ASPEED_2400_SDMC TYPE_ASPEED_SDMC "-ast2400"
+#define TYPE_ASPEED_2500_SDMC TYPE_ASPEED_SDMC "-ast2500"
 
 #define ASPEED_SDMC_NR_REGS (0x174 >> 2)
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSDMCState {
     MemoryRegion iomem;
 
     uint32_t regs[ASPEED_SDMC_NR_REGS];
-    uint32_t silicon_rev;
-    uint32_t ram_bits;
     uint64_t ram_size;
     uint64_t max_ram_size;
-    uint32_t fixed_conf;
-
 } AspeedSDMCState;
 
+#define ASPEED_SDMC_CLASS(klass) \
+     OBJECT_CLASS_CHECK(AspeedSDMCClass, (klass), TYPE_ASPEED_SDMC)
+#define ASPEED_SDMC_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(AspeedSDMCClass, (obj), TYPE_ASPEED_SDMC)
+
+typedef struct AspeedSDMCClass {
+    SysBusDeviceClass parent_class;
+
+    uint64_t max_ram_size;
+    uint32_t (*compute_conf)(AspeedSDMCState *s, uint32_t data);
+    void (*write)(AspeedSDMCState *s, uint32_t reg, uint32_t data);
+} AspeedSDMCClass;
+
 #endif /* ASPEED_SDMC_H */
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                               sizeof(s->spi[i]), typename);
     }
 
+    snprintf(typename, sizeof(typename), "aspeed.sdmc-%s", socname);
     sysbus_init_child_obj(obj, "sdmc", OBJECT(&s->sdmc), sizeof(s->sdmc),
-                          TYPE_ASPEED_SDMC);
-    qdev_prop_set_uint32(DEVICE(&s->sdmc), "silicon-rev",
-                         sc->info->silicon_rev);
+                          typename);
     object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
                               "ram-size", &error_abort);
     object_property_add_alias(obj, "max-ram-size", OBJECT(&s->sdmc),
diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_sdmc.c
+++ b/hw/misc/aspeed_sdmc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,
                              unsigned int size)
 {
     AspeedSDMCState *s = ASPEED_SDMC(opaque);
+    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
 
     addr >>= 2;
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,
         return;
     }
 
-    if (addr == R_CONF) {
-        /* Make sure readonly bits are kept */
-        switch (s->silicon_rev) {
-        case AST2400_A0_SILICON_REV:
-        case AST2400_A1_SILICON_REV:
-            data &= ~ASPEED_SDMC_READONLY_MASK;
-            data |= s->fixed_conf;
-            break;
-        case AST2500_A0_SILICON_REV:
-        case AST2500_A1_SILICON_REV:
-            data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
-            data |= s->fixed_conf;
-            break;
-        default:
-            g_assert_not_reached();
-        }
-    }
-    if (s->silicon_rev == AST2500_A0_SILICON_REV ||
-            s->silicon_rev == AST2500_A1_SILICON_REV) {
-        switch (addr) {
-        case R_STATUS1:
-            /* Will never return 'busy' */
-            data &= ~PHY_BUSY_STATE;
-            break;
-        case R_ECC_TEST_CTRL:
-            /* Always done, always happy */
-            data |= ECC_TEST_FINISHED;
-            data &= ~ECC_TEST_FAIL;
-            break;
-        default:
-            break;
-        }
-    }
-
-    s->regs[addr] = data;
+    asc->write(s, addr, data);
 }
 
 static const MemoryRegionOps aspeed_sdmc_ops = {
@@ -XXX,XX +XXX,XX @@ static int ast2500_rambits(AspeedSDMCState *s)
 static void aspeed_sdmc_reset(DeviceState *dev)
 {
     AspeedSDMCState *s = ASPEED_SDMC(dev);
+    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
 
     memset(s->regs, 0, sizeof(s->regs));
 
     /* Set ram size bit and defaults values */
-    s->regs[R_CONF] = s->fixed_conf;
+    s->regs[R_CONF] = asc->compute_conf(s, 0);
 }
 
 static void aspeed_sdmc_realize(DeviceState *dev, Error **errp)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     AspeedSDMCState *s = ASPEED_SDMC(dev);
+    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
 
-    if (!is_supported_silicon_rev(s->silicon_rev)) {
-        error_setg(errp, "Unknown silicon revision: 0x%" PRIx32,
-                s->silicon_rev);
-        return;
-    }
-
-    switch (s->silicon_rev) {
-    case AST2400_A0_SILICON_REV:
-    case AST2400_A1_SILICON_REV:
-        s->ram_bits = ast2400_rambits(s);
-        s->max_ram_size = 512 << 20;
-        s->fixed_conf = ASPEED_SDMC_VGA_COMPAT |
-            ASPEED_SDMC_DRAM_SIZE(s->ram_bits);
-        break;
-    case AST2500_A0_SILICON_REV:
-    case AST2500_A1_SILICON_REV:
-        s->ram_bits = ast2500_rambits(s);
-        s->max_ram_size = 1024 << 20;
-        s->fixed_conf = ASPEED_SDMC_HW_VERSION(1) |
-            ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
-            ASPEED_SDMC_CACHE_INITIAL_DONE |
-            ASPEED_SDMC_DRAM_SIZE(s->ram_bits);
-        break;
-    default:
-        g_assert_not_reached();
-    }
+    s->max_ram_size = asc->max_ram_size;
 
     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_sdmc_ops, s,
                           TYPE_ASPEED_SDMC, 0x1000);
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_sdmc = {
 };
 
 static Property aspeed_sdmc_properties[] = {
-    DEFINE_PROP_UINT32("silicon-rev", AspeedSDMCState, silicon_rev, 0),
     DEFINE_PROP_UINT64("ram-size", AspeedSDMCState, ram_size, 0),
     DEFINE_PROP_UINT64("max-ram-size", AspeedSDMCState, max_ram_size, 0),
     DEFINE_PROP_END_OF_LIST(),
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_sdmc_info = {
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(AspeedSDMCState),
     .class_init = aspeed_sdmc_class_init,
+    .class_size = sizeof(AspeedSDMCClass),
+    .abstract   = true,
+};
+
+static uint32_t aspeed_2400_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
+{
+    uint32_t fixed_conf = ASPEED_SDMC_VGA_COMPAT |
+        ASPEED_SDMC_DRAM_SIZE(ast2400_rambits(s));
+
+    /* Make sure readonly bits are kept */
+    data &= ~ASPEED_SDMC_READONLY_MASK;
+
+    return data | fixed_conf;
+}
+
+static void aspeed_2400_sdmc_write(AspeedSDMCState *s, uint32_t reg,
+                                   uint32_t data)
+{
+    switch (reg) {
+    case R_CONF:
+        data = aspeed_2400_sdmc_compute_conf(s, data);
+        break;
+    default:
+        break;
+    }
+
+    s->regs[reg] = data;
+}
+
+static void aspeed_2400_sdmc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
+
+    dc->desc = "ASPEED 2400 SDRAM Memory Controller";
+    asc->max_ram_size = 512 << 20;
+    asc->compute_conf = aspeed_2400_sdmc_compute_conf;
+    asc->write = aspeed_2400_sdmc_write;
+}
+
+static const TypeInfo aspeed_2400_sdmc_info = {
+    .name = TYPE_ASPEED_2400_SDMC,
+    .parent = TYPE_ASPEED_SDMC,
+    .class_init = aspeed_2400_sdmc_class_init,
+};
+
+static uint32_t aspeed_2500_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
+{
+    uint32_t fixed_conf = ASPEED_SDMC_HW_VERSION(1) |
+        ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
+        ASPEED_SDMC_CACHE_INITIAL_DONE |
+        ASPEED_SDMC_DRAM_SIZE(ast2500_rambits(s));
+
+    /* Make sure readonly bits are kept */
+    data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
+
+    return data | fixed_conf;
+}
+
+static void aspeed_2500_sdmc_write(AspeedSDMCState *s, uint32_t reg,
+                                   uint32_t data)
+{
+    switch (reg) {
+    case R_CONF:
+        data = aspeed_2500_sdmc_compute_conf(s, data);
+        break;
+    case R_STATUS1:
+        /* Will never return 'busy' */
+        data &= ~PHY_BUSY_STATE;
+        break;
+    case R_ECC_TEST_CTRL:
+        /* Always done, always happy */
+        data |= ECC_TEST_FINISHED;
+        data &= ~ECC_TEST_FAIL;
+        break;
+    default:
+        break;
+    }
+
+    s->regs[reg] = data;
+}
+
+static void aspeed_2500_sdmc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
+
+    dc->desc = "ASPEED 2500 SDRAM Memory Controller";
+    asc->max_ram_size = 1024 << 20;
+    asc->compute_conf = aspeed_2500_sdmc_compute_conf;
+    asc->write = aspeed_2500_sdmc_write;
+}
+
+static const TypeInfo aspeed_2500_sdmc_info = {
+    .name = TYPE_ASPEED_2500_SDMC,
+    .parent = TYPE_ASPEED_SDMC,
+    .class_init = aspeed_2500_sdmc_class_init,
 };
 
 static void aspeed_sdmc_register_types(void)
 {
     type_register_static(&aspeed_sdmc_info);
+    type_register_static(&aspeed_2400_sdmc_info);
+    type_register_static(&aspeed_2500_sdmc_info);
 }
 
 type_init(aspeed_sdmc_register_types);
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

The AST2600 SDMC controller is slightly different from its predecessor
(DRAM training). Max memory is now 2G on the AST2600.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190925143248.10000-10-clg@kaod.org
[clg: - improved commit log
      - reworked model integration into new object class ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/aspeed_sdmc.h |  1 +
 hw/misc/aspeed_scu.c          |  2 +
 hw/misc/aspeed_sdmc.c         | 82 +++++++++++++++++++++++++++++++++++
 3 files changed, 85 insertions(+)

From: Cédric Le Goater <clg@kaod.org>

It cleanups the current models for the Aspeed AST2400 and AST2500 SoCs
and prepares ground for future SoCs.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-11-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/watchdog/wdt_aspeed.h |  18 ++++-
 hw/arm/aspeed_soc.c              |   9 ++-
 hw/watchdog/wdt_aspeed.c         | 122 ++++++++++++++++---------------
 3 files changed, 86 insertions(+), 63 deletions(-)

diff --git a/include/hw/watchdog/wdt_aspeed.h b/include/hw/watchdog/wdt_aspeed.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/watchdog/wdt_aspeed.h
+++ b/include/hw/watchdog/wdt_aspeed.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_ASPEED_WDT "aspeed.wdt"
 #define ASPEED_WDT(obj) \
     OBJECT_CHECK(AspeedWDTState, (obj), TYPE_ASPEED_WDT)
+#define TYPE_ASPEED_2400_WDT TYPE_ASPEED_WDT "-ast2400"
+#define TYPE_ASPEED_2500_WDT TYPE_ASPEED_WDT "-ast2500"
 
 #define ASPEED_WDT_REGS_MAX        (0x20 / 4)
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedWDTState {
 
     AspeedSCUState *scu;
     uint32_t pclk_freq;
-    uint32_t silicon_rev;
-    uint32_t ext_pulse_width_mask;
 } AspeedWDTState;
 
+#define ASPEED_WDT_CLASS(klass) \
+     OBJECT_CLASS_CHECK(AspeedWDTClass, (klass), TYPE_ASPEED_WDT)
+#define ASPEED_WDT_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(AspeedWDTClass, (obj), TYPE_ASPEED_WDT)
+
+typedef struct AspeedWDTClass {
+    SysBusDeviceClass parent_class;
+
+    uint32_t offset;
+    uint32_t ext_pulse_width_mask;
+    uint32_t reset_ctrl_reg;
+    void (*reset_pulse)(AspeedWDTState *s, uint32_t property);
+}  AspeedWDTClass;
+
 #endif /* WDT_ASPEED_H */
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                               "max-ram-size", &error_abort);
 
     for (i = 0; i < sc->info->wdts_num; i++) {
+        snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
         sysbus_init_child_obj(obj, "wdt[*]", OBJECT(&s->wdt[i]),
-                              sizeof(s->wdt[i]), TYPE_ASPEED_WDT);
-        qdev_prop_set_uint32(DEVICE(&s->wdt[i]), "silicon-rev",
-                                    sc->info->silicon_rev);
+                              sizeof(s->wdt[i]), typename);
         object_property_add_const_link(OBJECT(&s->wdt[i]), "scu",
                                        OBJECT(&s->scu), &error_abort);
     }
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
 
     /* Watch dog */
     for (i = 0; i < sc->info->wdts_num; i++) {
+        AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(&s->wdt[i]);
+
         object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
         if (err) {
             error_propagate(errp, err);
             return;
         }
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
-                        sc->info->memmap[ASPEED_WDT] + i * 0x20);
+                        sc->info->memmap[ASPEED_WDT] + i * awc->offset);
     }
 
     /* Net */
diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/wdt_aspeed.c
+++ b/hw/watchdog/wdt_aspeed.c
@@ -XXX,XX +XXX,XX @@ static bool aspeed_wdt_is_enabled(const AspeedWDTState *s)
     return s->regs[WDT_CTRL] & WDT_CTRL_ENABLE;
 }
 
-static bool is_ast2500(const AspeedWDTState *s)
-{
-    switch (s->silicon_rev) {
-    case AST2500_A0_SILICON_REV:
-    case AST2500_A1_SILICON_REV:
-        return true;
-    case AST2400_A0_SILICON_REV:
-    case AST2400_A1_SILICON_REV:
-    default:
-        break;
-    }
-
-    return false;
-}
-
 static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)
 {
     AspeedWDTState *s = ASPEED_WDT(opaque);
@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
                              unsigned size)
 {
     AspeedWDTState *s = ASPEED_WDT(opaque);
+    AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(s);
     bool enable = data & WDT_CTRL_ENABLE;
 
     offset >>= 2;
@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
         }
         break;
     case WDT_RESET_WIDTH:
-    {
-        uint32_t property = data & WDT_POLARITY_MASK;
-
-        if (property && is_ast2500(s)) {
-            if (property == WDT_ACTIVE_HIGH_MAGIC) {
-                s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_ACTIVE_HIGH;
-            } else if (property == WDT_ACTIVE_LOW_MAGIC) {
-                s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_ACTIVE_HIGH;
-            } else if (property == WDT_PUSH_PULL_MAGIC) {
-                s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_PUSH_PULL;
-            } else if (property == WDT_OPEN_DRAIN_MAGIC) {
-                s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_PUSH_PULL;
-            }
+        if (awc->reset_pulse) {
+            awc->reset_pulse(s, data & WDT_POLARITY_MASK);
         }
-        s->regs[WDT_RESET_WIDTH] &= ~s->ext_pulse_width_mask;
-        s->regs[WDT_RESET_WIDTH] |= data & s->ext_pulse_width_mask;
+        s->regs[WDT_RESET_WIDTH] &= ~awc->ext_pulse_width_mask;
+        s->regs[WDT_RESET_WIDTH] |= data & awc->ext_pulse_width_mask;
         break;
-    }
+
     case WDT_TIMEOUT_STATUS:
     case WDT_TIMEOUT_CLEAR:
         qemu_log_mask(LOG_UNIMP,
@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_reset(DeviceState *dev)
 static void aspeed_wdt_timer_expired(void *dev)
 {
     AspeedWDTState *s = ASPEED_WDT(dev);
+    uint32_t reset_ctrl_reg = ASPEED_WDT_GET_CLASS(s)->reset_ctrl_reg;
 
     /* Do not reset on SDRAM controller reset */
-    if (s->scu->regs[SCU_RESET_CONTROL1] & SCU_RESET_SDRAM) {
+    if (s->scu->regs[reset_ctrl_reg] & SCU_RESET_SDRAM) {
         timer_del(s->timer);
         s->regs[WDT_CTRL] = 0;
         return;
@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_realize(DeviceState *dev, Error **errp)
     }
     s->scu = ASPEED_SCU(obj);
 
-    if (!is_supported_silicon_rev(s->silicon_rev)) {
-        error_setg(errp, "Unknown silicon revision: 0x%" PRIx32,
-                s->silicon_rev);
-        return;
-    }
-
-    switch (s->silicon_rev) {
-    case AST2400_A0_SILICON_REV:
-    case AST2400_A1_SILICON_REV:
-        s->ext_pulse_width_mask = 0xff;
-        break;
-    case AST2500_A0_SILICON_REV:
-    case AST2500_A1_SILICON_REV:
-        s->ext_pulse_width_mask = 0xfffff;
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, aspeed_wdt_timer_expired, dev);
 
     /* FIXME: This setting should be derived from the SCU hw strapping
@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_realize(DeviceState *dev, Error **errp)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-static Property aspeed_wdt_properties[] = {
-    DEFINE_PROP_UINT32("silicon-rev", AspeedWDTState, silicon_rev, 0),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void aspeed_wdt_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
+    dc->desc = "ASPEED Watchdog Controller";
     dc->realize = aspeed_wdt_realize;
     dc->reset = aspeed_wdt_reset;
     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
     dc->vmsd = &vmstate_aspeed_wdt;
-    dc->props = aspeed_wdt_properties;
 }
 
 static const TypeInfo aspeed_wdt_info = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_wdt_info = {
     .name  = TYPE_ASPEED_WDT,
     .instance_size  = sizeof(AspeedWDTState),
     .class_init = aspeed_wdt_class_init,
+    .class_size    = sizeof(AspeedWDTClass),
+    .abstract      = true,
+};
+
+static void aspeed_2400_wdt_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
+
+    dc->desc = "ASPEED 2400 Watchdog Controller";
+    awc->offset = 0x20;
+    awc->ext_pulse_width_mask = 0xff;
+    awc->reset_ctrl_reg = SCU_RESET_CONTROL1;
+}
+
+static const TypeInfo aspeed_2400_wdt_info = {
+    .name = TYPE_ASPEED_2400_WDT,
+    .parent = TYPE_ASPEED_WDT,
+    .instance_size = sizeof(AspeedWDTState),
+    .class_init = aspeed_2400_wdt_class_init,
+};
+
+static void aspeed_2500_wdt_reset_pulse(AspeedWDTState *s, uint32_t property)
+{
+    if (property) {
+        if (property == WDT_ACTIVE_HIGH_MAGIC) {
+            s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_ACTIVE_HIGH;
+        } else if (property == WDT_ACTIVE_LOW_MAGIC) {
+            s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_ACTIVE_HIGH;
+        } else if (property == WDT_PUSH_PULL_MAGIC) {
+            s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_PUSH_PULL;
+        } else if (property == WDT_OPEN_DRAIN_MAGIC) {
+            s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_PUSH_PULL;
+        }
+    }
+}
+
+static void aspeed_2500_wdt_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
+
+    dc->desc = "ASPEED 2500 Watchdog Controller";
+    awc->offset = 0x20;
+    awc->ext_pulse_width_mask = 0xfffff;
+    awc->reset_ctrl_reg = SCU_RESET_CONTROL1;
+    awc->reset_pulse = aspeed_2500_wdt_reset_pulse;
+}
+
+static const TypeInfo aspeed_2500_wdt_info = {
+    .name = TYPE_ASPEED_2500_WDT,
+    .parent = TYPE_ASPEED_WDT,
+    .instance_size = sizeof(AspeedWDTState),
+    .class_init = aspeed_2500_wdt_class_init,
 };
 
 static void wdt_aspeed_register_types(void)
 {
     watchdog_add_model(&model);
     type_register_static(&aspeed_wdt_info);
+    type_register_static(&aspeed_2400_wdt_info);
+    type_register_static(&aspeed_2500_wdt_info);
 }
 
 type_init(wdt_aspeed_register_types)
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

The AST2600 has four watchdogs, and they each have a 0x40 of registers.

When running as part of an ast2600 system we must check a different
offset for the system reset control register in the SCU.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190925143248.10000-12-clg@kaod.org
[clg: - reworked model integration into new object class ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h      |  2 +-
 include/hw/watchdog/wdt_aspeed.h |  1 +
 hw/watchdog/wdt_aspeed.c         | 29 +++++++++++++++++++++++++++++
 3 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sd/aspeed_sdhci.h"
 
 #define ASPEED_SPIS_NUM  2
-#define ASPEED_WDTS_NUM  3
+#define ASPEED_WDTS_NUM  4
 #define ASPEED_CPUS_NUM  2
 #define ASPEED_MACS_NUM  2
 
diff --git a/include/hw/watchdog/wdt_aspeed.h b/include/hw/watchdog/wdt_aspeed.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/watchdog/wdt_aspeed.h
+++ b/include/hw/watchdog/wdt_aspeed.h
@@ -XXX,XX +XXX,XX @@
     OBJECT_CHECK(AspeedWDTState, (obj), TYPE_ASPEED_WDT)
 #define TYPE_ASPEED_2400_WDT TYPE_ASPEED_WDT "-ast2400"
 #define TYPE_ASPEED_2500_WDT TYPE_ASPEED_WDT "-ast2500"
+#define TYPE_ASPEED_2600_WDT TYPE_ASPEED_WDT "-ast2600"
 
 #define ASPEED_WDT_REGS_MAX        (0x20 / 4)
 
diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/wdt_aspeed.c
+++ b/hw/watchdog/wdt_aspeed.c
@@ -XXX,XX +XXX,XX @@
 #define     WDT_DRIVE_TYPE_MASK         (0xFF << 24)
 #define     WDT_PUSH_PULL_MAGIC         (0xA8 << 24)
 #define     WDT_OPEN_DRAIN_MAGIC        (0x8A << 24)
+#define WDT_RESET_MASK1                 (0x1c / 4)
 
 #define WDT_TIMEOUT_STATUS              (0x10 / 4)
 #define WDT_TIMEOUT_CLEAR               (0x14 / 4)
 
 #define WDT_RESTART_MAGIC               0x4755
 
+#define AST2600_SCU_RESET_CONTROL1      (0x40 / 4)
 #define SCU_RESET_CONTROL1              (0x04 / 4)
 #define    SCU_RESET_SDRAM              BIT(0)
 
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)
         return s->regs[WDT_CTRL];
     case WDT_RESET_WIDTH:
         return s->regs[WDT_RESET_WIDTH];
+    case WDT_RESET_MASK1:
+        return s->regs[WDT_RESET_MASK1];
     case WDT_TIMEOUT_STATUS:
     case WDT_TIMEOUT_CLEAR:
         qemu_log_mask(LOG_UNIMP,
@@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
         s->regs[WDT_RESET_WIDTH] |= data & awc->ext_pulse_width_mask;
         break;
 
+    case WDT_RESET_MASK1:
+        /* TODO: implement */
+        s->regs[WDT_RESET_MASK1] = data;
+        break;
+
     case WDT_TIMEOUT_STATUS:
     case WDT_TIMEOUT_CLEAR:
         qemu_log_mask(LOG_UNIMP,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_2500_wdt_info = {
     .class_init = aspeed_2500_wdt_class_init,
 };
 
+static void aspeed_2600_wdt_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
+
+    dc->desc = "ASPEED 2600 Watchdog Controller";
+    awc->offset = 0x40;
+    awc->ext_pulse_width_mask = 0xfffff; /* TODO */
+    awc->reset_ctrl_reg = AST2600_SCU_RESET_CONTROL1;
+    awc->reset_pulse = aspeed_2500_wdt_reset_pulse;
+}
+
+static const TypeInfo aspeed_2600_wdt_info = {
+    .name = TYPE_ASPEED_2600_WDT,
+    .parent = TYPE_ASPEED_WDT,
+    .instance_size = sizeof(AspeedWDTState),
+    .class_init = aspeed_2600_wdt_class_init,
+};
+
 static void wdt_aspeed_register_types(void)
 {
     watchdog_add_model(&model);
     type_register_static(&aspeed_wdt_info);
     type_register_static(&aspeed_2400_wdt_info);
     type_register_static(&aspeed_2500_wdt_info);
+    type_register_static(&aspeed_2600_wdt_info);
 }
 
 type_init(wdt_aspeed_register_types)
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

AST2600 will use a different encoding for the addresses defined in the
Segment Register.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-13-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/ssi/aspeed_smc.h |  4 ++++
 hw/ssi/aspeed_smc.c         | 45 ++++++++++++++++++++++++-------------
 2 files changed, 34 insertions(+), 15 deletions(-)

diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ssi/aspeed_smc.h
+++ b/include/hw/ssi/aspeed_smc.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCController {
     hwaddr dma_flash_mask;
     hwaddr dma_dram_mask;
     uint32_t nregs;
+    uint32_t (*segment_to_reg)(const struct AspeedSMCState *s,
+                               const AspeedSegments *seg);
+    void (*reg_to_segment)(const struct AspeedSMCState *s, uint32_t reg,
+                           AspeedSegments *seg);
 } AspeedSMCController;
 
 typedef struct AspeedSMCFlash {
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSegments aspeed_segments_ast2500_spi2[] = {
     { 0x38000000, 32 * 1024 * 1024 }, /* start address is readonly */
     { 0x3A000000, 96 * 1024 * 1024 }, /* end address is readonly */
 };
+static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
+                                          const AspeedSegments *seg);
+static void aspeed_smc_reg_to_segment(const AspeedSMCState *s, uint32_t reg,
+                                      AspeedSegments *seg);
 
 static const AspeedSMCController controllers[] = {
     {
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .flash_window_size = 0x6000000,
         .has_dma           = false,
         .nregs             = ASPEED_SMC_R_SMC_MAX,
+        .segment_to_reg    = aspeed_smc_segment_to_reg,
+        .reg_to_segment    = aspeed_smc_reg_to_segment,
     }, {
         .name              = "aspeed.fmc-ast2400",
         .r_conf            = R_CONF,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .dma_flash_mask    = 0x0FFFFFFC,
         .dma_dram_mask     = 0x1FFFFFFC,
         .nregs             = ASPEED_SMC_R_MAX,
+        .segment_to_reg    = aspeed_smc_segment_to_reg,
+        .reg_to_segment    = aspeed_smc_reg_to_segment,
     }, {
         .name              = "aspeed.spi1-ast2400",
         .r_conf            = R_SPI_CONF,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .flash_window_size = 0x10000000,
         .has_dma           = false,
         .nregs             = ASPEED_SMC_R_SPI_MAX,
+        .segment_to_reg    = aspeed_smc_segment_to_reg,
+        .reg_to_segment    = aspeed_smc_reg_to_segment,
     }, {
         .name              = "aspeed.fmc-ast2500",
         .r_conf            = R_CONF,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .dma_flash_mask    = 0x0FFFFFFC,
         .dma_dram_mask     = 0x3FFFFFFC,
         .nregs             = ASPEED_SMC_R_MAX,
+        .segment_to_reg    = aspeed_smc_segment_to_reg,
+        .reg_to_segment    = aspeed_smc_reg_to_segment,
     }, {
         .name              = "aspeed.spi1-ast2500",
         .r_conf            = R_CONF,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .flash_window_size = 0x8000000,
         .has_dma           = false,
         .nregs             = ASPEED_SMC_R_MAX,
+        .segment_to_reg    = aspeed_smc_segment_to_reg,
+        .reg_to_segment    = aspeed_smc_reg_to_segment,
     }, {
         .name              = "aspeed.spi2-ast2500",
         .r_conf            = R_CONF,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .flash_window_size = 0x8000000,
         .has_dma           = false,
         .nregs             = ASPEED_SMC_R_MAX,
+        .segment_to_reg    = aspeed_smc_segment_to_reg,
+        .reg_to_segment    = aspeed_smc_reg_to_segment,
     },
 };
 
 /*
- * The Segment Register uses a 8MB unit to encode the start address
- * and the end address of the mapping window of a flash SPI slave :
- *
- *        | byte 1 | byte 2 | byte 3 | byte 4 |
- *        +--------+--------+--------+--------+
- *        |  end   |  start |   0    |   0    |
- *
+ * The Segment Registers of the AST2400 and AST2500 have a 8MB
+ * unit. The address range of a flash SPI slave is encoded with
+ * absolute addresses which should be part of the overall controller
+ * window.
  */
-static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg)
+static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
+                                          const AspeedSegments *seg)
 {
     uint32_t reg = 0;
     reg |= ((seg->addr >> 23) & SEG_START_MASK) << SEG_START_SHIFT;
@@ -XXX,XX +XXX,XX @@ static inline uint32_t aspeed_smc_segment_to_reg(const AspeedSegments *seg)
     return reg;
 }
 
-static inline void aspeed_smc_reg_to_segment(uint32_t reg, AspeedSegments *seg)
+static void aspeed_smc_reg_to_segment(const AspeedSMCState *s,
+                                      uint32_t reg, AspeedSegments *seg)
 {
     seg->addr = ((reg >> SEG_START_SHIFT) & SEG_START_MASK) << 23;
     seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
@@ -XXX,XX +XXX,XX @@ static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
             continue;
         }
 
-        aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + i], &seg);
+        s->ctrl->reg_to_segment(s, s->regs[R_SEG_ADDR0 + i], &seg);
 
         if (new->addr + new->size > seg.addr &&
             new->addr < seg.addr + seg.size) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
     AspeedSMCFlash *fl = &s->flashes[cs];
     AspeedSegments seg;
 
-    aspeed_smc_reg_to_segment(new, &seg);
+    s->ctrl->reg_to_segment(s, new, &seg);
 
     /* The start address of CS0 is read-only */
     if (cs == 0 && seg.addr != s->ctrl->flash_window_base) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
                       "%s: Tried to change CS0 start address to 0x%"
                       HWADDR_PRIx "\n", s->ctrl->name, seg.addr);
         seg.addr = s->ctrl->flash_window_base;
-        new = aspeed_smc_segment_to_reg(&seg);
+        new = s->ctrl->segment_to_reg(s, &seg);
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
                       HWADDR_PRIx "\n", s->ctrl->name, cs, seg.addr + seg.size);
         seg.size = s->ctrl->segments[cs].addr + s->ctrl->segments[cs].size -
             seg.addr;
-        new = aspeed_smc_segment_to_reg(&seg);
+        new = s->ctrl->segment_to_reg(s, &seg);
     }
 
     /* Keep the segment in the overall flash window */
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
     const AspeedSMCState *s = fl->controller;
     AspeedSegments seg;
 
-    aspeed_smc_reg_to_segment(s->regs[R_SEG_ADDR0 + fl->id], &seg);
+    s->ctrl->reg_to_segment(s, s->regs[R_SEG_ADDR0 + fl->id], &seg);
     if ((addr % seg.size) != addr) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid address 0x%08x for CS%d segment : "
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reset(DeviceState *d)
     /* setup default segment register values for all */
     for (i = 0; i < s->ctrl->max_slaves; ++i) {
         s->regs[R_SEG_ADDR0 + i] =
-            aspeed_smc_segment_to_reg(&s->ctrl->segments[i]);
+            s->ctrl->segment_to_reg(s, &s->ctrl->segments[i]);
     }
 
     /* HW strapping flash type for FMC controllers  */
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

The AST2600 SoC SMC controller is a SPI only controller now and has a
few extensions which we will need to take into account when SW
requires it. This is enough to support u-boot and Linux.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-14-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/aspeed_smc.c | 132 ++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 128 insertions(+), 4 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "exec/address-spaces.h"
+#include "qemu/units.h"
 
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@
 #define   CONF_FLASH_TYPE0     0
 #define      CONF_FLASH_TYPE_NOR   0x0
 #define      CONF_FLASH_TYPE_NAND  0x1
-#define      CONF_FLASH_TYPE_SPI   0x2
+#define      CONF_FLASH_TYPE_SPI   0x2 /* AST2600 is SPI only */
 
 /* CE Control Register */
 #define R_CE_CTRL            (0x04 / 4)
@@ -XXX,XX +XXX,XX @@
 
 /* CEx Control Register */
 #define R_CTRL0           (0x10 / 4)
+#define   CTRL_IO_QPI              (1 << 31)
+#define   CTRL_IO_QUAD_DATA        (1 << 30)
 #define   CTRL_IO_DUAL_DATA        (1 << 29)
 #define   CTRL_IO_DUAL_ADDR_DATA   (1 << 28) /* Includes dummies */
+#define   CTRL_IO_QUAD_ADDR_DATA   (1 << 28) /* Includes dummies */
 #define   CTRL_CMD_SHIFT           16
 #define   CTRL_CMD_MASK            0xff
 #define   CTRL_DUMMY_HIGH_SHIFT    14
@@ -XXX,XX +XXX,XX @@
 /* Misc Control Register #2 */
 #define R_TIMINGS         (0x94 / 4)
 
-/* SPI controller registers and bits */
+/* SPI controller registers and bits (AST2400) */
 #define R_SPI_CONF        (0x00 / 4)
 #define   SPI_CONF_ENABLE_W0   0
 #define R_SPI_CTRL0       (0x4 / 4)
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_smc_segment_to_reg(const AspeedSMCState *s,
 static void aspeed_smc_reg_to_segment(const AspeedSMCState *s, uint32_t reg,
                                       AspeedSegments *seg);
 
+/*
+ * AST2600 definitions
+ */
+#define ASPEED26_SOC_FMC_FLASH_BASE   0x20000000
+#define ASPEED26_SOC_SPI_FLASH_BASE   0x30000000
+#define ASPEED26_SOC_SPI2_FLASH_BASE  0x50000000
+
+static const AspeedSegments aspeed_segments_ast2600_fmc[] = {
+    { 0x0, 128 * MiB }, /* start address is readonly */
+    { 0x0, 0 }, /* disabled */
+    { 0x0, 0 }, /* disabled */
+};
+
+static const AspeedSegments aspeed_segments_ast2600_spi1[] = {
+    { 0x0, 128 * MiB }, /* start address is readonly */
+    { 0x0, 0 }, /* disabled */
+};
+
+static const AspeedSegments aspeed_segments_ast2600_spi2[] = {
+    { 0x0, 128 * MiB }, /* start address is readonly */
+    { 0x0, 0 }, /* disabled */
+    { 0x0, 0 }, /* disabled */
+};
+
+static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s,
+                                               const AspeedSegments *seg);
+static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s,
+                                           uint32_t reg, AspeedSegments *seg);
+
 static const AspeedSMCController controllers[] = {
     {
         .name              = "aspeed.smc-ast2400",
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .nregs             = ASPEED_SMC_R_MAX,
         .segment_to_reg    = aspeed_smc_segment_to_reg,
         .reg_to_segment    = aspeed_smc_reg_to_segment,
+    }, {
+        .name              = "aspeed.fmc-ast2600",
+        .r_conf            = R_CONF,
+        .r_ce_ctrl         = R_CE_CTRL,
+        .r_ctrl0           = R_CTRL0,
+        .r_timings         = R_TIMINGS,
+        .conf_enable_w0    = CONF_ENABLE_W0,
+        .max_slaves        = 3,
+        .segments          = aspeed_segments_ast2600_fmc,
+        .flash_window_base = ASPEED26_SOC_FMC_FLASH_BASE,
+        .flash_window_size = 0x10000000,
+        .has_dma           = true,
+        .nregs             = ASPEED_SMC_R_MAX,
+        .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
+        .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
+    }, {
+        .name              = "aspeed.spi1-ast2600",
+        .r_conf            = R_CONF,
+        .r_ce_ctrl         = R_CE_CTRL,
+        .r_ctrl0           = R_CTRL0,
+        .r_timings         = R_TIMINGS,
+        .conf_enable_w0    = CONF_ENABLE_W0,
+        .max_slaves        = 2,
+        .segments          = aspeed_segments_ast2600_spi1,
+        .flash_window_base = ASPEED26_SOC_SPI_FLASH_BASE,
+        .flash_window_size = 0x10000000,
+        .has_dma           = false,
+        .nregs             = ASPEED_SMC_R_MAX,
+        .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
+        .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
+    }, {
+        .name              = "aspeed.spi2-ast2600",
+        .r_conf            = R_CONF,
+        .r_ce_ctrl         = R_CE_CTRL,
+        .r_ctrl0           = R_CTRL0,
+        .r_timings         = R_TIMINGS,
+        .conf_enable_w0    = CONF_ENABLE_W0,
+        .max_slaves        = 3,
+        .segments          = aspeed_segments_ast2600_spi2,
+        .flash_window_base = ASPEED26_SOC_SPI2_FLASH_BASE,
+        .flash_window_size = 0x10000000,
+        .has_dma           = false,
+        .nregs             = ASPEED_SMC_R_MAX,
+        .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
+        .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reg_to_segment(const AspeedSMCState *s,
     seg->size = (((reg >> SEG_END_SHIFT) & SEG_END_MASK) << 23) - seg->addr;
 }
 
+/*
+ * The Segment Registers of the AST2600 have a 1MB unit. The address
+ * range of a flash SPI slave is encoded with offsets in the overall
+ * controller window. The previous SoC AST2400 and AST2500 used
+ * absolute addresses. Only bits [27:20] are relevant and the end
+ * address is an upper bound limit.
+ */
+#define AST2600_SEG_ADDR_MASK 0x0ff00000
+
+static uint32_t aspeed_2600_smc_segment_to_reg(const AspeedSMCState *s,
+                                               const AspeedSegments *seg)
+{
+    uint32_t reg = 0;
+
+    /* Disabled segments have a nil register */
+    if (!seg->size) {
+        return 0;
+    }
+
+    reg |= (seg->addr & AST2600_SEG_ADDR_MASK) >> 16; /* start offset */
+    reg |= (seg->addr + seg->size - 1) & AST2600_SEG_ADDR_MASK; /* end offset */
+    return reg;
+}
+
+static void aspeed_2600_smc_reg_to_segment(const AspeedSMCState *s,
+                                           uint32_t reg, AspeedSegments *seg)
+{
+    uint32_t start_offset = (reg << 16) & AST2600_SEG_ADDR_MASK;
+    uint32_t end_offset = reg & AST2600_SEG_ADDR_MASK;
+
+    seg->addr = s->ctrl->flash_window_base + start_offset;
+    seg->size = end_offset + MiB - start_offset;
+}
+
 static bool aspeed_smc_flash_overlap(const AspeedSMCState *s,
                                      const AspeedSegments *new,
                                      int cs)
@@ -XXX,XX +XXX,XX @@ static inline int aspeed_smc_flash_cmd(const AspeedSMCFlash *fl)
     const AspeedSMCState *s = fl->controller;
     int cmd = (s->regs[s->r_ctrl0 + fl->id] >> CTRL_CMD_SHIFT) & CTRL_CMD_MASK;
 
-    /* In read mode, the default SPI command is READ (0x3). In other
-     * modes, the command should necessarily be defined */
+    /*
+     * In read mode, the default SPI command is READ (0x3). In other
+     * modes, the command should necessarily be defined
+     *
+     * TODO: add support for READ4 (0x13) on AST2600
+     */
     if (aspeed_smc_flash_mode(fl) == CTRL_READMODE) {
         cmd = SPI_OP_READ;
     }
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reset(DeviceState *d)
             s->ctrl->segment_to_reg(s, &s->ctrl->segments[i]);
     }
 
+    /* HW strapping flash type for the AST2600 controllers  */
+    if (s->ctrl->segments == aspeed_segments_ast2600_fmc) {
+        /* flash type is fixed to SPI for all */
+        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0);
+        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1);
+        s->regs[s->r_conf] |= (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE2);
+    }
+
     /* HW strapping flash type for FMC controllers  */
     if (s->ctrl->segments == aspeed_segments_ast2500_fmc) {
         /* flash type is fixed to SPI for CE0 and CE1 */
-- 
2.20.1

From: Rashmica Gupta <rashmica.g@gmail.com>

The AST2600 has the same sets of 3.6v gpios as the AST2400 plus an
addtional two sets of 1.8V gpios.

Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-15-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/aspeed_gpio.c | 142 ++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 137 insertions(+), 5 deletions(-)

diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/aspeed_gpio.c
+++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@
 #define GPIO_3_6V_MEM_SIZE         0x1F0
 #define GPIO_3_6V_REG_ARRAY_SIZE   (GPIO_3_6V_MEM_SIZE >> 2)
 
+/* AST2600 only - 1.8V gpios */
+/*
+ * The AST2600 has same 3.6V gpios as the AST2400 (memory offsets 0x0-0x198)
+ * and addtional 1.8V gpios (memory offsets 0x800-0x9D4).
+ */
+#define GPIO_1_8V_REG_OFFSET          0x800
+#define GPIO_1_8V_ABCD_DATA_VALUE     ((0x800 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_DIRECTION      ((0x804 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_INT_ENABLE     ((0x808 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_INT_SENS_0     ((0x80C - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_INT_SENS_1     ((0x810 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_INT_SENS_2     ((0x814 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_INT_STATUS     ((0x818 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_RESET_TOLERANT ((0x81C - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_DATA_VALUE        ((0x820 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_DIRECTION         ((0x824 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_INT_ENABLE        ((0x828 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_INT_SENS_0        ((0x82C - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_INT_SENS_1        ((0x830 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_INT_SENS_2        ((0x834 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_INT_STATUS        ((0x838 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_RESET_TOLERANT    ((0x83C - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_DEBOUNCE_1     ((0x840 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_DEBOUNCE_2     ((0x844 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_DEBOUNCE_1        ((0x848 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_DEBOUNCE_2        ((0x84C - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_DEBOUNCE_TIME_1     ((0x850 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_DEBOUNCE_TIME_2     ((0x854 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_DEBOUNCE_TIME_3     ((0x858 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_COMMAND_SRC_0  ((0x860 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_COMMAND_SRC_1  ((0x864 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_COMMAND_SRC_0     ((0x868 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_COMMAND_SRC_1     ((0x86C - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_DATA_READ      ((0x8C0 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_DATA_READ         ((0x8C4 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_ABCD_INPUT_MASK     ((0x9D0 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_E_INPUT_MASK        ((0x9D4 - GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_1_8V_MEM_SIZE            0x9D8
+#define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
+                                      GPIO_1_8V_REG_OFFSET) >> 2)
+#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
+
 static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
 {
     uint32_t falling_edge = 0, rising_edge = 0;
@@ -XXX,XX +XXX,XX @@ static const AspeedGPIOReg aspeed_3_6v_gpios[GPIO_3_6V_REG_ARRAY_SIZE] = {
     [GPIO_AC_INPUT_MASK] =         { 7, gpio_reg_input_mask },
 };
 
+static const AspeedGPIOReg aspeed_1_8v_gpios[GPIO_1_8V_REG_ARRAY_SIZE] = {
+    /* 1.8V Set ABCD */
+    [GPIO_1_8V_ABCD_DATA_VALUE] =     {0, gpio_reg_data_value},
+    [GPIO_1_8V_ABCD_DIRECTION] =      {0, gpio_reg_direction},
+    [GPIO_1_8V_ABCD_INT_ENABLE] =     {0, gpio_reg_int_enable},
+    [GPIO_1_8V_ABCD_INT_SENS_0] =     {0, gpio_reg_int_sens_0},
+    [GPIO_1_8V_ABCD_INT_SENS_1] =     {0, gpio_reg_int_sens_1},
+    [GPIO_1_8V_ABCD_INT_SENS_2] =     {0, gpio_reg_int_sens_2},
+    [GPIO_1_8V_ABCD_INT_STATUS] =     {0, gpio_reg_int_status},
+    [GPIO_1_8V_ABCD_RESET_TOLERANT] = {0, gpio_reg_reset_tolerant},
+    [GPIO_1_8V_ABCD_DEBOUNCE_1] =     {0, gpio_reg_debounce_1},
+    [GPIO_1_8V_ABCD_DEBOUNCE_2] =     {0, gpio_reg_debounce_2},
+    [GPIO_1_8V_ABCD_COMMAND_SRC_0] =  {0, gpio_reg_cmd_source_0},
+    [GPIO_1_8V_ABCD_COMMAND_SRC_1] =  {0, gpio_reg_cmd_source_1},
+    [GPIO_1_8V_ABCD_DATA_READ] =      {0, gpio_reg_data_read},
+    [GPIO_1_8V_ABCD_INPUT_MASK] =     {0, gpio_reg_input_mask},
+    /* 1.8V Set E */
+    [GPIO_1_8V_E_DATA_VALUE] =     {1, gpio_reg_data_value},
+    [GPIO_1_8V_E_DIRECTION] =      {1, gpio_reg_direction},
+    [GPIO_1_8V_E_INT_ENABLE] =     {1, gpio_reg_int_enable},
+    [GPIO_1_8V_E_INT_SENS_0] =     {1, gpio_reg_int_sens_0},
+    [GPIO_1_8V_E_INT_SENS_1] =     {1, gpio_reg_int_sens_1},
+    [GPIO_1_8V_E_INT_SENS_2] =     {1, gpio_reg_int_sens_2},
+    [GPIO_1_8V_E_INT_STATUS] =     {1, gpio_reg_int_status},
+    [GPIO_1_8V_E_RESET_TOLERANT] = {1, gpio_reg_reset_tolerant},
+    [GPIO_1_8V_E_DEBOUNCE_1] =     {1, gpio_reg_debounce_1},
+    [GPIO_1_8V_E_DEBOUNCE_2] =     {1, gpio_reg_debounce_2},
+    [GPIO_1_8V_E_COMMAND_SRC_0] =  {1, gpio_reg_cmd_source_0},
+    [GPIO_1_8V_E_COMMAND_SRC_1] =  {1, gpio_reg_cmd_source_1},
+    [GPIO_1_8V_E_DATA_READ] =      {1, gpio_reg_data_read},
+    [GPIO_1_8V_E_INPUT_MASK] =     {1, gpio_reg_input_mask},
+};
+
 static uint64_t aspeed_gpio_read(void *opaque, hwaddr offset, uint32_t size)
 {
     AspeedGPIOState *s = ASPEED_GPIO(opaque);
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_get_pin(Object *obj, Visitor *v, const char *name,
     int set_idx, group_idx = 0;
 
     if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
-        error_setg(errp, "%s: error reading %s", __func__, name);
-        return;
+        /* 1.8V gpio */
+        if (sscanf(name, "gpio%3s%1d", group, &pin) != 2) {
+            error_setg(errp, "%s: error reading %s", __func__, name);
+            return;
+        }
     }
     set_idx = get_set_idx(s, group, &group_idx);
     if (set_idx == -1) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_set_pin(Object *obj, Visitor *v, const char *name,
         return;
     }
     if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
-        error_setg(errp, "%s: error reading %s", __func__, name);
-        return;
+        /* 1.8V gpio */
+        if (sscanf(name, "gpio%3s%1d", group, &pin) != 2) {
+            error_setg(errp, "%s: error reading %s", __func__, name);
+            return;
+        }
     }
     set_idx = get_set_idx(s, group, &group_idx);
     if (set_idx == -1) {
@@ -XXX,XX +XXX,XX @@ static const GPIOSetProperties ast2500_set_props[] = {
     [7] = {0x000000ff,  0x000000ff,  {"AC"} },
 };
 
+static GPIOSetProperties ast2600_3_6v_set_props[] = {
+    [0] = {0xffffffff,  0xffffffff,  {"A", "B", "C", "D"} },
+    [1] = {0xffffffff,  0xffffffff,  {"E", "F", "G", "H"} },
+    [2] = {0xffffffff,  0xffffffff,  {"I", "J", "K", "L"} },
+    [3] = {0xffffffff,  0xffffffff,  {"M", "N", "O", "P"} },
+    [4] = {0xffffffff,  0xffffffff,  {"Q", "R", "S", "T"} },
+    [5] = {0xffffffff,  0x0000ffff,  {"U", "V", "W", "X"} },
+    [6] = {0xffff0000,  0x0fff0000,  {"Y", "Z", "", ""} },
+};
+
+static GPIOSetProperties ast2600_1_8v_set_props[] = {
+    [0] = {0xffffffff,  0xffffffff,  {"18A", "18B", "18C", "18D"} },
+    [1] = {0x0000000f,  0x0000000f,  {"18E"} },
+};
+
 static const MemoryRegionOps aspeed_gpio_ops = {
     .read       = aspeed_gpio_read,
     .write      = aspeed_gpio_write,
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
-            TYPE_ASPEED_GPIO, GPIO_3_6V_MEM_SIZE);
+            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
 
     sysbus_init_mmio(sbd, &s->iomem);
 }
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_2500_class_init(ObjectClass *klass, void *data)
     agc->reg_table = aspeed_3_6v_gpios;
 }
 
+static void aspeed_gpio_ast2600_3_6v_class_init(ObjectClass *klass, void *data)
+{
+    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
+
+    agc->props = ast2600_3_6v_set_props;
+    agc->nr_gpio_pins = 208;
+    agc->nr_gpio_sets = 7;
+    agc->reg_table = aspeed_3_6v_gpios;
+}
+
+static void aspeed_gpio_ast2600_1_8v_class_init(ObjectClass *klass, void *data)
+{
+    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
+
+    agc->props = ast2600_1_8v_set_props;
+    agc->nr_gpio_pins = 36;
+    agc->nr_gpio_sets = 2;
+    agc->reg_table = aspeed_1_8v_gpios;
+}
+
 static const TypeInfo aspeed_gpio_info = {
     .name           = TYPE_ASPEED_GPIO,
     .parent         = TYPE_SYS_BUS_DEVICE,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_gpio_ast2500_info = {
     .instance_init  = aspeed_gpio_init,
 };
 
+static const TypeInfo aspeed_gpio_ast2600_3_6v_info = {
+    .name           = TYPE_ASPEED_GPIO "-ast2600",
+    .parent         = TYPE_ASPEED_GPIO,
+    .class_init     = aspeed_gpio_ast2600_3_6v_class_init,
+    .instance_init  = aspeed_gpio_init,
+};
+
+static const TypeInfo aspeed_gpio_ast2600_1_8v_info = {
+    .name           = TYPE_ASPEED_GPIO "-ast2600-1_8v",
+    .parent         = TYPE_ASPEED_GPIO,
+    .class_init     = aspeed_gpio_ast2600_1_8v_class_init,
+    .instance_init  = aspeed_gpio_init,
+};
+
 static void aspeed_gpio_register_types(void)
 {
     type_register_static(&aspeed_gpio_info);
     type_register_static(&aspeed_gpio_ast2400_info);
     type_register_static(&aspeed_gpio_ast2500_info);
+    type_register_static(&aspeed_gpio_ast2600_3_6v_info);
+    type_register_static(&aspeed_gpio_ast2600_1_8v_info);
 }
 
 type_init(aspeed_gpio_register_types);
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

It prepares ground for register differences between SoCs.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-16-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/i2c/aspeed_i2c.h | 15 ++++++++++
 hw/arm/aspeed_soc.c         |  3 +-
 hw/i2c/aspeed_i2c.c         | 60 ++++++++++++++++++++++++++++++++-----
 3 files changed, 69 insertions(+), 9 deletions(-)

diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/aspeed_i2c.h
+++ b/include/hw/i2c/aspeed_i2c.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 
 #define TYPE_ASPEED_I2C "aspeed.i2c"
+#define TYPE_ASPEED_2400_I2C TYPE_ASPEED_I2C "-ast2400"
+#define TYPE_ASPEED_2500_I2C TYPE_ASPEED_I2C "-ast2500"
 #define ASPEED_I2C(obj) \
     OBJECT_CHECK(AspeedI2CState, (obj), TYPE_ASPEED_I2C)
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedI2CState {
     AspeedI2CBus busses[ASPEED_I2C_NR_BUSSES];
 } AspeedI2CState;
 
+#define ASPEED_I2C_CLASS(klass) \
+     OBJECT_CLASS_CHECK(AspeedI2CClass, (klass), TYPE_ASPEED_I2C)
+#define ASPEED_I2C_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(AspeedI2CClass, (obj), TYPE_ASPEED_I2C)
+
+typedef struct AspeedI2CClass {
+    SysBusDeviceClass parent_class;
+
+    uint8_t num_busses;
+    uint8_t reg_size;
+    uint8_t gap;
+} AspeedI2CClass;
+
 I2CBus *aspeed_i2c_get_bus(DeviceState *dev, int busnr);
 
 #endif /* ASPEED_I2C_H */
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     object_property_add_const_link(OBJECT(&s->timerctrl), "scu",
                                    OBJECT(&s->scu), &error_abort);
 
+    snprintf(typename, sizeof(typename), "aspeed.i2c-%s", socname);
     sysbus_init_child_obj(obj, "i2c", OBJECT(&s->i2c), sizeof(s->i2c),
-                          TYPE_ASPEED_I2C);
+                          typename);
 
     snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
     sysbus_init_child_obj(obj, "fmc", OBJECT(&s->fmc), sizeof(s->fmc),
diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_reset(DeviceState *dev)
 {
     int i;
     AspeedI2CState *s = ASPEED_I2C(dev);
+    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
 
     s->intr_status = 0;
 
-    for (i = 0; i < ASPEED_I2C_NR_BUSSES; i++) {
+    for (i = 0; i < aic->num_busses; i++) {
         s->busses[i].intr_ctrl = 0;
         s->busses[i].intr_status = 0;
         s->busses[i].cmd = 0;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_reset(DeviceState *dev)
 }
 
 /*
- * Address Definitions
+ * Address Definitions (AST2400 and AST2500)
  *
  *   0x000 ... 0x03F: Global Register
  *   0x040 ... 0x07F: Device 1
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
     int i;
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     AspeedI2CState *s = ASPEED_I2C(dev);
+    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
 
     sysbus_init_irq(sbd, &s->irq);
     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_i2c_ctrl_ops, s,
                           "aspeed.i2c", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
 
-    for (i = 0; i < ASPEED_I2C_NR_BUSSES; i++) {
-        char name[16];
-        int offset = i < 7 ? 1 : 5;
+    for (i = 0; i < aic->num_busses; i++) {
+        char name[32];
+        int offset = i < aic->gap ? 1 : 5;
         snprintf(name, sizeof(name), "aspeed.i2c.%d", i);
         s->busses[i].controller = s;
         s->busses[i].id = i;
         s->busses[i].bus = i2c_init_bus(dev, name);
         memory_region_init_io(&s->busses[i].mr, OBJECT(dev),
-                              &aspeed_i2c_bus_ops, &s->busses[i], name, 0x40);
-        memory_region_add_subregion(&s->iomem, 0x40 * (i + offset),
+                              &aspeed_i2c_bus_ops, &s->busses[i], name,
+                              aic->reg_size);
+        memory_region_add_subregion(&s->iomem, aic->reg_size * (i + offset),
                                     &s->busses[i].mr);
     }
 }
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_i2c_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(AspeedI2CState),
     .class_init    = aspeed_i2c_class_init,
+    .class_size = sizeof(AspeedI2CClass),
+    .abstract   = true,
+};
+
+static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
+
+    dc->desc = "ASPEED 2400 I2C Controller";
+
+    aic->num_busses = 14;
+    aic->reg_size = 0x40;
+    aic->gap = 7;
+}
+
+static const TypeInfo aspeed_2400_i2c_info = {
+    .name = TYPE_ASPEED_2400_I2C,
+    .parent = TYPE_ASPEED_I2C,
+    .class_init = aspeed_2400_i2c_class_init,
+};
+
+static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
+
+    dc->desc = "ASPEED 2500 I2C Controller";
+
+    aic->num_busses = 14;
+    aic->reg_size = 0x40;
+    aic->gap = 7;
+}
+
+static const TypeInfo aspeed_2500_i2c_info = {
+    .name = TYPE_ASPEED_2500_I2C,
+    .parent = TYPE_ASPEED_I2C,
+    .class_init = aspeed_2500_i2c_class_init,
 };
 
 static void aspeed_i2c_register_types(void)
 {
     type_register_static(&aspeed_i2c_info);
+    type_register_static(&aspeed_2400_i2c_info);
+    type_register_static(&aspeed_2500_i2c_info);
 }
 
 type_init(aspeed_i2c_register_types)
@@ -XXX,XX +XXX,XX @@ type_init(aspeed_i2c_register_types)
 I2CBus *aspeed_i2c_get_bus(DeviceState *dev, int busnr)
 {
     AspeedI2CState *s = ASPEED_I2C(dev);
+    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(s);
     I2CBus *bus = NULL;
 
-    if (busnr >= 0 && busnr < ASPEED_I2C_NR_BUSSES) {
+    if (busnr >= 0 && busnr < aic->num_busses) {
         bus = s->busses[busnr].bus;
     }
 
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

The I2C controller of the AST2400 and AST2500 SoCs have one IRQ shared
by all I2C busses. The AST2600 SoC I2C controller has one IRQ per bus
and 16 busses.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-17-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/i2c/aspeed_i2c.h |  5 +++-
 hw/i2c/aspeed_i2c.c         | 46 +++++++++++++++++++++++++++++++++++--
 2 files changed, 48 insertions(+), 3 deletions(-)

diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/aspeed_i2c.h
+++ b/include/hw/i2c/aspeed_i2c.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_ASPEED_I2C "aspeed.i2c"
 #define TYPE_ASPEED_2400_I2C TYPE_ASPEED_I2C "-ast2400"
 #define TYPE_ASPEED_2500_I2C TYPE_ASPEED_I2C "-ast2500"
+#define TYPE_ASPEED_2600_I2C TYPE_ASPEED_I2C "-ast2600"
 #define ASPEED_I2C(obj) \
     OBJECT_CHECK(AspeedI2CState, (obj), TYPE_ASPEED_I2C)
 
-#define ASPEED_I2C_NR_BUSSES 14
+#define ASPEED_I2C_NR_BUSSES 16
 
 struct AspeedI2CState;
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedI2CBus {
 
     I2CBus *bus;
     uint8_t id;
+    qemu_irq irq;
 
     uint32_t ctrl;
     uint32_t timing[2];
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedI2CClass {
     uint8_t num_busses;
     uint8_t reg_size;
     uint8_t gap;
+    qemu_irq (*bus_get_irq)(AspeedI2CBus *);
 } AspeedI2CClass;
 
 I2CBus *aspeed_i2c_get_bus(DeviceState *dev, int busnr);
diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static inline bool aspeed_i2c_bus_is_enabled(AspeedI2CBus *bus)
 
 static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
 {
+    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
+
     bus->intr_status &= bus->intr_ctrl;
     if (bus->intr_status) {
         bus->controller->intr_status |= 1 << bus->id;
-        qemu_irq_raise(bus->controller->irq);
+        qemu_irq_raise(aic->bus_get_irq(bus));
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
                                  uint64_t value, unsigned size)
 {
     AspeedI2CBus *bus = opaque;
+    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
     bool handle_rx;
 
     switch (offset) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
         bus->intr_status &= ~(value & 0x7FFF);
         if (!bus->intr_status) {
             bus->controller->intr_status &= ~(1 << bus->id);
-            qemu_irq_lower(bus->controller->irq);
+            qemu_irq_lower(aic->bus_get_irq(bus));
         }
         if (handle_rx && (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST))) {
             aspeed_i2c_handle_rx_cmd(bus);
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < aic->num_busses; i++) {
         char name[32];
         int offset = i < aic->gap ? 1 : 5;
+
+        sysbus_init_irq(sbd, &s->busses[i].irq);
         snprintf(name, sizeof(name), "aspeed.i2c.%d", i);
         s->busses[i].controller = s;
         s->busses[i].id = i;
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_i2c_info = {
     .abstract   = true,
 };
 
+static qemu_irq aspeed_2400_i2c_bus_get_irq(AspeedI2CBus *bus)
+{
+    return bus->controller->irq;
+}
+
 static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void aspeed_2400_i2c_class_init(ObjectClass *klass, void *data)
     aic->num_busses = 14;
     aic->reg_size = 0x40;
     aic->gap = 7;
+    aic->bus_get_irq = aspeed_2400_i2c_bus_get_irq;
 }
 
 static const TypeInfo aspeed_2400_i2c_info = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_2400_i2c_info = {
     .class_init = aspeed_2400_i2c_class_init,
 };
 
+static qemu_irq aspeed_2500_i2c_bus_get_irq(AspeedI2CBus *bus)
+{
+    return bus->controller->irq;
+}
+
 static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void aspeed_2500_i2c_class_init(ObjectClass *klass, void *data)
     aic->num_busses = 14;
     aic->reg_size = 0x40;
     aic->gap = 7;
+    aic->bus_get_irq = aspeed_2500_i2c_bus_get_irq;
 }
 
 static const TypeInfo aspeed_2500_i2c_info = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_2500_i2c_info = {
     .class_init = aspeed_2500_i2c_class_init,
 };
 
+static qemu_irq aspeed_2600_i2c_bus_get_irq(AspeedI2CBus *bus)
+{
+    return bus->irq;
+}
+
+static void aspeed_2600_i2c_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedI2CClass *aic = ASPEED_I2C_CLASS(klass);
+
+    dc->desc = "ASPEED 2600 I2C Controller";
+
+    aic->num_busses = 16;
+    aic->reg_size = 0x80;
+    aic->gap = -1; /* no gap */
+    aic->bus_get_irq = aspeed_2600_i2c_bus_get_irq;
+}
+
+static const TypeInfo aspeed_2600_i2c_info = {
+    .name = TYPE_ASPEED_2600_I2C,
+    .parent = TYPE_ASPEED_I2C,
+    .class_init = aspeed_2600_i2c_class_init,
+};
+
 static void aspeed_i2c_register_types(void)
 {
     type_register_static(&aspeed_i2c_info);
     type_register_static(&aspeed_2400_i2c_info);
     type_register_static(&aspeed_2500_i2c_info);
+    type_register_static(&aspeed_2600_i2c_info);
 }
 
 type_init(aspeed_i2c_register_types)
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

It prepares ground for the AST2600.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-18-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |   9 +--
 hw/arm/aspeed.c             |   4 +-
 hw/arm/aspeed_soc.c         | 148 +++++++++++++++++++-----------------
 3 files changed, 84 insertions(+), 77 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
 #define TYPE_ASPEED_SOC "aspeed-soc"
 #define ASPEED_SOC(obj) OBJECT_CHECK(AspeedSoCState, (obj), TYPE_ASPEED_SOC)
 
-typedef struct AspeedSoCInfo {
+typedef struct AspeedSoCClass {
+    DeviceClass parent_class;
+
     const char *name;
     const char *cpu_type;
     uint32_t silicon_rev;
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
     const int *irqmap;
     const hwaddr *memmap;
     uint32_t num_cpus;
-} AspeedSoCInfo;
-
-typedef struct AspeedSoCClass {
-    DeviceClass parent_class;
-    AspeedSoCInfo *info;
 } AspeedSoCClass;
 
 #define ASPEED_SOC_CLASS(klass)                                         \
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
     memory_region_allocate_system_memory(&bmc->ram, NULL, "ram", ram_size);
     memory_region_add_subregion(&bmc->ram_container, 0, &bmc->ram);
     memory_region_add_subregion(get_system_memory(),
-                                sc->info->memmap[ASPEED_SDRAM],
+                                sc->memmap[ASPEED_SDRAM],
                                 &bmc->ram_container);
 
     max_ram_size = object_property_get_uint(OBJECT(&bmc->soc), "max-ram-size",
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
     }
 
     aspeed_board_binfo.ram_size = ram_size;
-    aspeed_board_binfo.loader_start = sc->info->memmap[ASPEED_SDRAM];
+    aspeed_board_binfo.loader_start = sc->memmap[ASPEED_SDRAM];
     aspeed_board_binfo.nb_cpus = bmc->soc.num_cpus;
 
     if (cfg->i2c_init) {
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2400_irqmap[] = {
 
 #define aspeed_soc_ast2500_irqmap aspeed_soc_ast2400_irqmap
 
-static const AspeedSoCInfo aspeed_socs[] = {
-    {
-        .name         = "ast2400-a1",
-        .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
-        .silicon_rev  = AST2400_A1_SILICON_REV,
-        .sram_size    = 0x8000,
-        .spis_num     = 1,
-        .wdts_num     = 2,
-        .irqmap       = aspeed_soc_ast2400_irqmap,
-        .memmap       = aspeed_soc_ast2400_memmap,
-        .num_cpus     = 1,
-    }, {
-        .name         = "ast2500-a1",
-        .cpu_type     = ARM_CPU_TYPE_NAME("arm1176"),
-        .silicon_rev  = AST2500_A1_SILICON_REV,
-        .sram_size    = 0x9000,
-        .spis_num     = 2,
-        .wdts_num     = 3,
-        .irqmap       = aspeed_soc_ast2500_irqmap,
-        .memmap       = aspeed_soc_ast2500_memmap,
-        .num_cpus     = 1,
-    },
-};
-
 static qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int ctrl)
 {
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 
-    return qdev_get_gpio_in(DEVICE(&s->vic), sc->info->irqmap[ctrl]);
+    return qdev_get_gpio_in(DEVICE(&s->vic), sc->irqmap[ctrl]);
 }
 
 static void aspeed_soc_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     char socname[8];
     char typename[64];
 
-    if (sscanf(sc->info->name, "%7s", socname) != 1) {
+    if (sscanf(sc->name, "%7s", socname) != 1) {
         g_assert_not_reached();
     }
 
-    for (i = 0; i < sc->info->num_cpus; i++) {
+    for (i = 0; i < sc->num_cpus; i++) {
         object_initialize_child(obj, "cpu[*]", OBJECT(&s->cpu[i]),
-                                sizeof(s->cpu[i]), sc->info->cpu_type,
+                                sizeof(s->cpu[i]), sc->cpu_type,
                                 &error_abort, NULL);
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     sysbus_init_child_obj(obj, "scu", OBJECT(&s->scu), sizeof(s->scu),
                           typename);
     qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev",
-                         sc->info->silicon_rev);
+                         sc->silicon_rev);
     object_property_add_alias(obj, "hw-strap1", OBJECT(&s->scu),
                               "hw-strap1", &error_abort);
     object_property_add_alias(obj, "hw-strap2", OBJECT(&s->scu),
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     object_property_add_alias(obj, "dram", OBJECT(&s->fmc), "dram",
                               &error_abort);
 
-    for (i = 0; i < sc->info->spis_num; i++) {
+    for (i = 0; i < sc->spis_num; i++) {
         snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
         sysbus_init_child_obj(obj, "spi[*]", OBJECT(&s->spi[i]),
                               sizeof(s->spi[i]), typename);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     object_property_add_alias(obj, "max-ram-size", OBJECT(&s->sdmc),
                               "max-ram-size", &error_abort);
 
-    for (i = 0; i < sc->info->wdts_num; i++) {
+    for (i = 0; i < sc->wdts_num; i++) {
         snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
         sysbus_init_child_obj(obj, "wdt[*]", OBJECT(&s->wdt[i]),
                               sizeof(s->wdt[i]), typename);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     Error *err = NULL, *local_err = NULL;
 
     /* IO space */
-    create_unimplemented_device("aspeed_soc.io", sc->info->memmap[ASPEED_IOMEM],
+    create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_IOMEM],
                                 ASPEED_SOC_IOMEM_SIZE);
 
-    if (s->num_cpus > sc->info->num_cpus) {
+    if (s->num_cpus > sc->num_cpus) {
         warn_report("%s: invalid number of CPUs %d, using default %d",
-                    sc->info->name, s->num_cpus, sc->info->num_cpus);
-        s->num_cpus = sc->info->num_cpus;
+                    sc->name, s->num_cpus, sc->num_cpus);
+        s->num_cpus = sc->num_cpus;
     }
 
     /* CPU */
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
 
     /* SRAM */
     memory_region_init_ram(&s->sram, OBJECT(dev), "aspeed.sram",
-                           sc->info->sram_size, &err);
+                           sc->sram_size, &err);
     if (err) {
         error_propagate(errp, err);
         return;
     }
     memory_region_add_subregion(get_system_memory(),
-                                sc->info->memmap[ASPEED_SRAM], &s->sram);
+                                sc->memmap[ASPEED_SRAM], &s->sram);
 
     /* SCU */
     object_property_set_bool(OBJECT(&s->scu), true, "realized", &err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->info->memmap[ASPEED_SCU]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_SCU]);
 
     /* VIC */
     object_property_set_bool(OBJECT(&s->vic), true, "realized", &err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->vic), 0, sc->info->memmap[ASPEED_VIC]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->vic), 0, sc->memmap[ASPEED_VIC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->vic), 0,
                        qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ));
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->vic), 1,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, sc->info->memmap[ASPEED_RTC]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_RTC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
                        aspeed_soc_get_irq(s, ASPEED_RTC));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         return;
     }
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->timerctrl), 0,
-                    sc->info->memmap[ASPEED_TIMER1]);
+                    sc->memmap[ASPEED_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
         qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_TIMER1 + i);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->timerctrl), i, irq);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     /* UART - attach an 8250 to the IO space as our UART5 */
     if (serial_hd(0)) {
         qemu_irq uart5 = aspeed_soc_get_irq(s, ASPEED_UART5);
-        serial_mm_init(get_system_memory(), sc->info->memmap[ASPEED_UART5], 2,
+        serial_mm_init(get_system_memory(), sc->memmap[ASPEED_UART5], 2,
                        uart5, 38400, serial_hd(0), DEVICE_LITTLE_ENDIAN);
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->info->memmap[ASPEED_I2C]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_I2C]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c), 0,
                        aspeed_soc_get_irq(s, ASPEED_I2C));
 
     /* FMC, The number of CS is set at the board level */
-    object_property_set_int(OBJECT(&s->fmc), sc->info->memmap[ASPEED_SDRAM],
+    object_property_set_int(OBJECT(&s->fmc), sc->memmap[ASPEED_SDRAM],
                             "sdram-base", &err);
     if (err) {
         error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->info->memmap[ASPEED_FMC]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_FMC]);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 1,
                     s->fmc.ctrl->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_FMC));
 
     /* SPI */
-    for (i = 0; i < sc->info->spis_num; i++) {
+    for (i = 0; i < sc->spis_num; i++) {
         object_property_set_int(OBJECT(&s->spi[i]), 1, "num-cs", &err);
         object_property_set_bool(OBJECT(&s->spi[i]), true, "realized",
                                  &local_err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
             return;
         }
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
-                        sc->info->memmap[ASPEED_SPI1 + i]);
+                        sc->memmap[ASPEED_SPI1 + i]);
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 1,
                         s->spi[i].ctrl->flash_window_base);
     }
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, sc->info->memmap[ASPEED_SDMC]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, sc->memmap[ASPEED_SDMC]);
 
     /* Watch dog */
-    for (i = 0; i < sc->info->wdts_num; i++) {
+    for (i = 0; i < sc->wdts_num; i++) {
         AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(&s->wdt[i]);
 
         object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
             return;
         }
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
-                        sc->info->memmap[ASPEED_WDT] + i * awc->offset);
+                        sc->memmap[ASPEED_WDT] + i * awc->offset);
     }
 
     /* Net */
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
            return;
         }
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
-                        sc->info->memmap[ASPEED_ETH1 + i]);
+                        sc->memmap[ASPEED_ETH1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_ETH1 + i));
     }
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         return;
     }
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->xdma), 0,
-                    sc->info->memmap[ASPEED_XDMA]);
+                    sc->memmap[ASPEED_XDMA]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
                        aspeed_soc_get_irq(s, ASPEED_XDMA));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->info->memmap[ASPEED_GPIO]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                        aspeed_soc_get_irq(s, ASPEED_GPIO));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         return;
     }
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
-                    sc->info->memmap[ASPEED_SDHCI]);
+                    sc->memmap[ASPEED_SDHCI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
                        aspeed_soc_get_irq(s, ASPEED_SDHCI));
 }
@@ -XXX,XX +XXX,XX @@ static Property aspeed_soc_properties[] = {
 static void aspeed_soc_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
-    AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
 
-    sc->info = (AspeedSoCInfo *) data;
     dc->realize = aspeed_soc_realize;
     /* Reason: Uses serial_hds and nd_table in realize() directly */
     dc->user_creatable = false;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_class_init(ObjectClass *oc, void *data)
 static const TypeInfo aspeed_soc_type_info = {
     .name           = TYPE_ASPEED_SOC,
     .parent         = TYPE_DEVICE,
-    .instance_init  = aspeed_soc_init,
     .instance_size  = sizeof(AspeedSoCState),
     .class_size     = sizeof(AspeedSoCClass),
+    .class_init     = aspeed_soc_class_init,
     .abstract       = true,
 };
 
-static void aspeed_soc_register_types(void)
+static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
 {
-    int i;
+    AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
 
-    type_register_static(&aspeed_soc_type_info);
-    for (i = 0; i < ARRAY_SIZE(aspeed_socs); ++i) {
-        TypeInfo ti = {
-            .name       = aspeed_socs[i].name,
-            .parent     = TYPE_ASPEED_SOC,
-            .class_init = aspeed_soc_class_init,
-            .class_data = (void *) &aspeed_socs[i],
-        };
-        type_register(&ti);
-    }
+    sc->name         = "ast2400-a1";
+    sc->cpu_type     = ARM_CPU_TYPE_NAME("arm926");
+    sc->silicon_rev  = AST2400_A1_SILICON_REV;
+    sc->sram_size    = 0x8000;
+    sc->spis_num     = 1;
+    sc->wdts_num     = 2;
+    sc->irqmap       = aspeed_soc_ast2400_irqmap;
+    sc->memmap       = aspeed_soc_ast2400_memmap;
+    sc->num_cpus     = 1;
 }
 
+static const TypeInfo aspeed_soc_ast2400_type_info = {
+    .name           = "ast2400-a1",
+    .parent         = TYPE_ASPEED_SOC,
+    .instance_init  = aspeed_soc_init,
+    .instance_size  = sizeof(AspeedSoCState),
+    .class_init     = aspeed_soc_ast2400_class_init,
+};
+
+static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
+{
+    AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
+
+    sc->name         = "ast2500-a1";
+    sc->cpu_type     = ARM_CPU_TYPE_NAME("arm1176");
+    sc->silicon_rev  = AST2500_A1_SILICON_REV;
+    sc->sram_size    = 0x9000;
+    sc->spis_num     = 2;
+    sc->wdts_num     = 3;
+    sc->irqmap       = aspeed_soc_ast2500_irqmap;
+    sc->memmap       = aspeed_soc_ast2500_memmap;
+    sc->num_cpus     = 1;
+}
+
+static const TypeInfo aspeed_soc_ast2500_type_info = {
+    .name           = "ast2500-a1",
+    .parent         = TYPE_ASPEED_SOC,
+    .instance_init  = aspeed_soc_init,
+    .instance_size  = sizeof(AspeedSoCState),
+    .class_init     = aspeed_soc_ast2500_class_init,
+};
+static void aspeed_soc_register_types(void)
+{
+    type_register_static(&aspeed_soc_type_info);
+    type_register_static(&aspeed_soc_ast2400_type_info);
+    type_register_static(&aspeed_soc_ast2500_type_info);
+};
+
 type_init(aspeed_soc_register_types)
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

Initial definitions for a simple machine using an AST2600 SoC (Cortex
CPU).

The Cortex CPU and its interrupt controller are too complex to handle
in the common Aspeed SoC framework. We introduce a new Aspeed SoC
class with instance_init and realize handlers to handle the differences
with the AST2400 and the AST2500 SoCs. This will add extra work to
keep in sync both models with future extensions but it makes the code
clearer.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-19-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs        |   2 +-
 include/hw/arm/aspeed_soc.h |   4 +
 hw/arm/aspeed_ast2600.c     | 492 ++++++++++++++++++++++++++++++++++++
 3 files changed, 497 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/aspeed_ast2600.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o xlnx-versal-virt.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o
-obj-$(CONFIG_ASPEED_SOC) += aspeed_soc.o aspeed.o
+obj-$(CONFIG_ASPEED_SOC) += aspeed_soc.o aspeed.o aspeed_ast2600.o
 obj-$(CONFIG_MPS2) += mps2.o
 obj-$(CONFIG_MPS2) += mps2-tz.o
 obj-$(CONFIG_MSF2) += msf2-soc.o
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef ASPEED_SOC_H
 #define ASPEED_SOC_H
 
+#include "hw/cpu/a15mpcore.h"
 #include "hw/intc/aspeed_vic.h"
 #include "hw/misc/aspeed_scu.h"
 #include "hw/misc/aspeed_sdmc.h"
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
     /*< public >*/
     ARMCPU cpu[ASPEED_CPUS_NUM];
     uint32_t num_cpus;
+    A15MPPrivState     a7mpcore;
     MemoryRegion sram;
     AspeedVICState vic;
     AspeedRtcState rtc;
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
     AspeedWDTState wdt[ASPEED_WDTS_NUM];
     FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
     AspeedGPIOState gpio;
+    AspeedGPIOState gpio_1_8v;
     AspeedSDHCIState sdhci;
 } AspeedSoCState;
 
@@ -XXX,XX +XXX,XX @@ enum {
     ASPEED_SRAM,
     ASPEED_SDHCI,
     ASPEED_GPIO,
+    ASPEED_GPIO_1_8V,
     ASPEED_RTC,
     ASPEED_TIMER1,
     ASPEED_TIMER2,
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ASPEED SoC 2600 family
+ *
+ * Copyright (c) 2016-2019, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "cpu.h"
+#include "exec/address-spaces.h"
+#include "hw/misc/unimp.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/char/serial.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/error-report.h"
+#include "hw/i2c/aspeed_i2c.h"
+#include "net/net.h"
+#include "sysemu/sysemu.h"
+
+#define ASPEED_SOC_IOMEM_SIZE       0x00200000
+
+static const hwaddr aspeed_soc_ast2600_memmap[] = {
+    [ASPEED_SRAM]      = 0x10000000,
+    /* 0x16000000     0x17FFFFFF : AHB BUS do LPC Bus bridge */
+    [ASPEED_IOMEM]     = 0x1E600000,
+    [ASPEED_PWM]       = 0x1E610000,
+    [ASPEED_FMC]       = 0x1E620000,
+    [ASPEED_SPI1]      = 0x1E630000,
+    [ASPEED_SPI2]      = 0x1E641000,
+    [ASPEED_ETH1]      = 0x1E660000,
+    [ASPEED_ETH2]      = 0x1E680000,
+    [ASPEED_VIC]       = 0x1E6C0000,
+    [ASPEED_SDMC]      = 0x1E6E0000,
+    [ASPEED_SCU]       = 0x1E6E2000,
+    [ASPEED_XDMA]      = 0x1E6E7000,
+    [ASPEED_ADC]       = 0x1E6E9000,
+    [ASPEED_SDHCI]     = 0x1E740000,
+    [ASPEED_GPIO]      = 0x1E780000,
+    [ASPEED_GPIO_1_8V] = 0x1E780800,
+    [ASPEED_RTC]       = 0x1E781000,
+    [ASPEED_TIMER1]    = 0x1E782000,
+    [ASPEED_WDT]       = 0x1E785000,
+    [ASPEED_LPC]       = 0x1E789000,
+    [ASPEED_IBT]       = 0x1E789140,
+    [ASPEED_I2C]       = 0x1E78A000,
+    [ASPEED_UART1]     = 0x1E783000,
+    [ASPEED_UART5]     = 0x1E784000,
+    [ASPEED_VUART]     = 0x1E787000,
+    [ASPEED_SDRAM]     = 0x80000000,
+};
+
+#define ASPEED_A7MPCORE_ADDR 0x40460000
+
+#define ASPEED_SOC_AST2600_MAX_IRQ 128
+
+static const int aspeed_soc_ast2600_irqmap[] = {
+    [ASPEED_UART1]     = 47,
+    [ASPEED_UART2]     = 48,
+    [ASPEED_UART3]     = 49,
+    [ASPEED_UART4]     = 50,
+    [ASPEED_UART5]     = 8,
+    [ASPEED_VUART]     = 8,
+    [ASPEED_FMC]       = 39,
+    [ASPEED_SDMC]      = 0,
+    [ASPEED_SCU]       = 12,
+    [ASPEED_ADC]       = 78,
+    [ASPEED_XDMA]      = 6,
+    [ASPEED_SDHCI]     = 43,
+    [ASPEED_GPIO]      = 40,
+    [ASPEED_GPIO_1_8V] = 11,
+    [ASPEED_RTC]       = 13,
+    [ASPEED_TIMER1]    = 16,
+    [ASPEED_TIMER2]    = 17,
+    [ASPEED_TIMER3]    = 18,
+    [ASPEED_TIMER4]    = 19,
+    [ASPEED_TIMER5]    = 20,
+    [ASPEED_TIMER6]    = 21,
+    [ASPEED_TIMER7]    = 22,
+    [ASPEED_TIMER8]    = 23,
+    [ASPEED_WDT]       = 24,
+    [ASPEED_PWM]       = 44,
+    [ASPEED_LPC]       = 35,
+    [ASPEED_IBT]       = 35,    /* LPC */
+    [ASPEED_I2C]       = 110,   /* 110 -> 125 */
+    [ASPEED_ETH1]      = 2,
+    [ASPEED_ETH2]      = 3,
+};
+
+static qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int ctrl)
+{
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+
+    return qdev_get_gpio_in(DEVICE(&s->a7mpcore), sc->irqmap[ctrl]);
+}
+
+static void aspeed_soc_ast2600_init(Object *obj)
+{
+    AspeedSoCState *s = ASPEED_SOC(obj);
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    int i;
+    char socname[8];
+    char typename[64];
+
+    if (sscanf(sc->name, "%7s", socname) != 1) {
+        g_assert_not_reached();
+    }
+
+    for (i = 0; i < sc->num_cpus; i++) {
+        object_initialize_child(obj, "cpu[*]", OBJECT(&s->cpu[i]),
+                                sizeof(s->cpu[i]), sc->cpu_type,
+                                &error_abort, NULL);
+    }
+
+    snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
+    sysbus_init_child_obj(obj, "scu", OBJECT(&s->scu), sizeof(s->scu),
+                          typename);
+    qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev",
+                         sc->silicon_rev);
+    object_property_add_alias(obj, "hw-strap1", OBJECT(&s->scu),
+                              "hw-strap1", &error_abort);
+    object_property_add_alias(obj, "hw-strap2", OBJECT(&s->scu),
+                              "hw-strap2", &error_abort);
+    object_property_add_alias(obj, "hw-prot-key", OBJECT(&s->scu),
+                              "hw-prot-key", &error_abort);
+
+    sysbus_init_child_obj(obj, "a7mpcore", &s->a7mpcore,
+                          sizeof(s->a7mpcore), TYPE_A15MPCORE_PRIV);
+
+    sysbus_init_child_obj(obj, "rtc", OBJECT(&s->rtc), sizeof(s->rtc),
+                          TYPE_ASPEED_RTC);
+
+    snprintf(typename, sizeof(typename), "aspeed.timer-%s", socname);
+    sysbus_init_child_obj(obj, "timerctrl", OBJECT(&s->timerctrl),
+                          sizeof(s->timerctrl), typename);
+    object_property_add_const_link(OBJECT(&s->timerctrl), "scu",
+                                   OBJECT(&s->scu), &error_abort);
+
+    snprintf(typename, sizeof(typename), "aspeed.i2c-%s", socname);
+    sysbus_init_child_obj(obj, "i2c", OBJECT(&s->i2c), sizeof(s->i2c),
+                          typename);
+
+    snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
+    sysbus_init_child_obj(obj, "fmc", OBJECT(&s->fmc), sizeof(s->fmc),
+                          typename);
+    object_property_add_alias(obj, "num-cs", OBJECT(&s->fmc), "num-cs",
+                              &error_abort);
+    object_property_add_alias(obj, "dram", OBJECT(&s->fmc), "dram",
+                              &error_abort);
+
+    for (i = 0; i < sc->spis_num; i++) {
+        snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
+        sysbus_init_child_obj(obj, "spi[*]", OBJECT(&s->spi[i]),
+                              sizeof(s->spi[i]), typename);
+    }
+
+    snprintf(typename, sizeof(typename), "aspeed.sdmc-%s", socname);
+    sysbus_init_child_obj(obj, "sdmc", OBJECT(&s->sdmc), sizeof(s->sdmc),
+                          typename);
+    object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
+                              "ram-size", &error_abort);
+    object_property_add_alias(obj, "max-ram-size", OBJECT(&s->sdmc),
+                              "max-ram-size", &error_abort);
+
+    for (i = 0; i < sc->wdts_num; i++) {
+        snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
+        sysbus_init_child_obj(obj, "wdt[*]", OBJECT(&s->wdt[i]),
+                              sizeof(s->wdt[i]), typename);
+        object_property_add_const_link(OBJECT(&s->wdt[i]), "scu",
+                                       OBJECT(&s->scu), &error_abort);
+    }
+
+    for (i = 0; i < ASPEED_MACS_NUM; i++) {
+        sysbus_init_child_obj(obj, "ftgmac100[*]", OBJECT(&s->ftgmac100[i]),
+                              sizeof(s->ftgmac100[i]), TYPE_FTGMAC100);
+    }
+
+    sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
+                          TYPE_ASPEED_XDMA);
+
+    snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
+    sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
+                          typename);
+
+    snprintf(typename, sizeof(typename), "aspeed.gpio-%s-1_8v", socname);
+    sysbus_init_child_obj(obj, "gpio_1_8v", OBJECT(&s->gpio_1_8v),
+                          sizeof(s->gpio_1_8v), typename);
+
+    sysbus_init_child_obj(obj, "sdc", OBJECT(&s->sdhci), sizeof(s->sdhci),
+                          TYPE_ASPEED_SDHCI);
+
+    /* Init sd card slot class here so that they're under the correct parent */
+    for (i = 0; i < ASPEED_SDHCI_NUM_SLOTS; ++i) {
+        sysbus_init_child_obj(obj, "sdhci[*]", OBJECT(&s->sdhci.slots[i]),
+                              sizeof(s->sdhci.slots[i]), TYPE_SYSBUS_SDHCI);
+    }
+}
+
+/*
+ * ASPEED ast2600 has 0xf as cluster ID
+ *
+ * http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0388e/CIHEBGFG.html
+ */
+static uint64_t aspeed_calc_affinity(int cpu)
+{
+    return (0xf << ARM_AFF1_SHIFT) | cpu;
+}
+
+static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
+{
+    int i;
+    AspeedSoCState *s = ASPEED_SOC(dev);
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    Error *err = NULL, *local_err = NULL;
+    qemu_irq irq;
+
+    /* IO space */
+    create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_IOMEM],
+                                ASPEED_SOC_IOMEM_SIZE);
+
+    if (s->num_cpus > sc->num_cpus) {
+        warn_report("%s: invalid number of CPUs %d, using default %d",
+                    sc->name, s->num_cpus, sc->num_cpus);
+        s->num_cpus = sc->num_cpus;
+    }
+
+    /* CPU */
+    for (i = 0; i < s->num_cpus; i++) {
+        object_property_set_int(OBJECT(&s->cpu[i]), QEMU_PSCI_CONDUIT_SMC,
+                                "psci-conduit", &error_abort);
+        if (s->num_cpus > 1) {
+            object_property_set_int(OBJECT(&s->cpu[i]),
+                                    ASPEED_A7MPCORE_ADDR,
+                                    "reset-cbar", &error_abort);
+        }
+        object_property_set_int(OBJECT(&s->cpu[i]), aspeed_calc_affinity(i),
+                                "mp-affinity", &error_abort);
+
+        /*
+         * TODO: the secondary CPUs are started and a boot helper
+         * is needed when using -kernel
+         */
+
+        object_property_set_bool(OBJECT(&s->cpu[i]), true, "realized", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
+
+    /* A7MPCORE */
+    object_property_set_int(OBJECT(&s->a7mpcore), s->num_cpus, "num-cpu",
+                            &error_abort);
+    object_property_set_int(OBJECT(&s->a7mpcore),
+                            ASPEED_SOC_AST2600_MAX_IRQ + GIC_INTERNAL,
+                            "num-irq", &error_abort);
+
+    object_property_set_bool(OBJECT(&s->a7mpcore), true, "realized",
+                             &error_abort);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->a7mpcore), 0, ASPEED_A7MPCORE_ADDR);
+
+    for (i = 0; i < s->num_cpus; i++) {
+        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->a7mpcore);
+        DeviceState  *d   = DEVICE(qemu_get_cpu(i));
+
+        irq = qdev_get_gpio_in(d, ARM_CPU_IRQ);
+        sysbus_connect_irq(sbd, i, irq);
+        irq = qdev_get_gpio_in(d, ARM_CPU_FIQ);
+        sysbus_connect_irq(sbd, i + s->num_cpus, irq);
+        irq = qdev_get_gpio_in(d, ARM_CPU_VIRQ);
+        sysbus_connect_irq(sbd, i + 2 * s->num_cpus, irq);
+        irq = qdev_get_gpio_in(d, ARM_CPU_VFIQ);
+        sysbus_connect_irq(sbd, i + 3 * s->num_cpus, irq);
+    }
+
+    /* SRAM */
+    memory_region_init_ram(&s->sram, OBJECT(dev), "aspeed.sram",
+                           sc->sram_size, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    memory_region_add_subregion(get_system_memory(),
+                                sc->memmap[ASPEED_SRAM], &s->sram);
+
+    /* SCU */
+    object_property_set_bool(OBJECT(&s->scu), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_SCU]);
+
+    /* RTC */
+    object_property_set_bool(OBJECT(&s->rtc), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_RTC]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
+                       aspeed_soc_get_irq(s, ASPEED_RTC));
+
+    /* Timer */
+    object_property_set_bool(OBJECT(&s->timerctrl), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->timerctrl), 0,
+                    sc->memmap[ASPEED_TIMER1]);
+    for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
+        qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_TIMER1 + i);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->timerctrl), i, irq);
+    }
+
+    /* UART - attach an 8250 to the IO space as our UART5 */
+    if (serial_hd(0)) {
+        qemu_irq uart5 = aspeed_soc_get_irq(s, ASPEED_UART5);
+        serial_mm_init(get_system_memory(), sc->memmap[ASPEED_UART5], 2,
+                       uart5, 38400, serial_hd(0), DEVICE_LITTLE_ENDIAN);
+    }
+
+    /* I2C */
+    object_property_set_bool(OBJECT(&s->i2c), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_I2C]);
+    for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
+        qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+                                        sc->irqmap[ASPEED_I2C] + i);
+        /*
+         * The AST2600 SoC has one IRQ per I2C bus. Skip the common
+         * IRQ (AST2400 and AST2500) and connect all bussses.
+         */
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c), i + 1, irq);
+    }
+
+    /* FMC, The number of CS is set at the board level */
+    object_property_set_int(OBJECT(&s->fmc), sc->memmap[ASPEED_SDRAM],
+                            "sdram-base", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    object_property_set_bool(OBJECT(&s->fmc), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_FMC]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 1,
+                    s->fmc.ctrl->flash_window_base);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
+                       aspeed_soc_get_irq(s, ASPEED_FMC));
+
+    /* SPI */
+    for (i = 0; i < sc->spis_num; i++) {
+        object_property_set_int(OBJECT(&s->spi[i]), 1, "num-cs", &err);
+        object_property_set_bool(OBJECT(&s->spi[i]), true, "realized",
+                                 &local_err);
+        error_propagate(&err, local_err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
+                        sc->memmap[ASPEED_SPI1 + i]);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 1,
+                        s->spi[i].ctrl->flash_window_base);
+    }
+
+    /* SDMC - SDRAM Memory Controller */
+    object_property_set_bool(OBJECT(&s->sdmc), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, sc->memmap[ASPEED_SDMC]);
+
+    /* Watch dog */
+    for (i = 0; i < sc->wdts_num; i++) {
+        AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(&s->wdt[i]);
+
+        object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
+                        sc->memmap[ASPEED_WDT] + i * awc->offset);
+    }
+
+    /* Net */
+    for (i = 0; i < nb_nics; i++) {
+        qdev_set_nic_properties(DEVICE(&s->ftgmac100[i]), &nd_table[i]);
+        object_property_set_bool(OBJECT(&s->ftgmac100[i]), true, "aspeed",
+                                 &err);
+        object_property_set_bool(OBJECT(&s->ftgmac100[i]), true, "realized",
+                                 &local_err);
+        error_propagate(&err, local_err);
+        if (err) {
+            error_propagate(errp, err);
+           return;
+        }
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
+                        sc->memmap[ASPEED_ETH1 + i]);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
+                           aspeed_soc_get_irq(s, ASPEED_ETH1 + i));
+    }
+
+    /* XDMA */
+    object_property_set_bool(OBJECT(&s->xdma), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->xdma), 0,
+                    sc->memmap[ASPEED_XDMA]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
+                       aspeed_soc_get_irq(s, ASPEED_XDMA));
+
+    /* GPIO */
+    object_property_set_bool(OBJECT(&s->gpio), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_GPIO]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
+                       aspeed_soc_get_irq(s, ASPEED_GPIO));
+
+    object_property_set_bool(OBJECT(&s->gpio_1_8v), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
+                    sc->memmap[ASPEED_GPIO_1_8V]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
+                       aspeed_soc_get_irq(s, ASPEED_GPIO_1_8V));
+
+    /* SDHCI */
+    object_property_set_bool(OBJECT(&s->sdhci), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
+                    sc->memmap[ASPEED_SDHCI]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
+                       aspeed_soc_get_irq(s, ASPEED_SDHCI));
+}
+
+static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
+
+    dc->realize      = aspeed_soc_ast2600_realize;
+
+    sc->name         = "ast2600-a0";
+    sc->cpu_type     = ARM_CPU_TYPE_NAME("cortex-a7");
+    sc->silicon_rev  = AST2600_A0_SILICON_REV;
+    sc->sram_size    = 0x10000;
+    sc->spis_num     = 2;
+    sc->wdts_num     = 4;
+    sc->irqmap       = aspeed_soc_ast2600_irqmap;
+    sc->memmap       = aspeed_soc_ast2600_memmap;
+    sc->num_cpus     = 2;
+}
+
+static const TypeInfo aspeed_soc_ast2600_type_info = {
+    .name           = "ast2600-a0",
+    .parent         = TYPE_ASPEED_SOC,
+    .instance_size  = sizeof(AspeedSoCState),
+    .instance_init  = aspeed_soc_ast2600_init,
+    .class_init     = aspeed_soc_ast2600_class_init,
+    .class_size     = sizeof(AspeedSoCClass),
+};
+
+static void aspeed_soc_register_types(void)
+{
+    type_register_static(&aspeed_soc_ast2600_type_info);
+};
+
+type_init(aspeed_soc_register_types)
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-21-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed.h |  1 +
 hw/arm/aspeed.c         | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardConfig {
     const char *desc;
     const char *soc_name;
     uint32_t hw_strap1;
+    uint32_t hw_strap2;
     const char *fmc_model;
     const char *spi_model;
     uint32_t num_cs;
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ struct AspeedBoardState {
 /* Witherspoon hardware value: 0xF10AD216 (but use romulus definition) */
 #define WITHERSPOON_BMC_HW_STRAP1 ROMULUS_BMC_HW_STRAP1
 
+/* AST2600 evb hardware value */
+#define AST2600_EVB_HW_STRAP1 0x000000C0
+#define AST2600_EVB_HW_STRAP2 0x00000003
+
 /*
  * The max ram region is for firmwares that scan the address space
  * with load/store to guess how much RAM the SoC has.
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
                              &error_abort);
     object_property_set_int(OBJECT(&bmc->soc), cfg->hw_strap1, "hw-strap1",
                             &error_abort);
+    object_property_set_int(OBJECT(&bmc->soc), cfg->hw_strap2, "hw-strap2",
+                            &error_abort);
     object_property_set_int(OBJECT(&bmc->soc), cfg->num_cs, "num-cs",
                             &error_abort);
     object_property_set_int(OBJECT(&bmc->soc), machine->smp.cpus, "num-cpus",
@@ -XXX,XX +XXX,XX @@ static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
 }
 
+static void ast2600_evb_i2c_init(AspeedBoardState *bmc)
+{
+    /* Start with some devices on our I2C busses */
+    ast2500_evb_i2c_init(bmc);
+}
+
 static void romulus_bmc_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .num_cs    = 2,
         .i2c_init  = witherspoon_bmc_i2c_init,
         .ram       = 512 * MiB,
+    }, {
+        .name      = MACHINE_TYPE_NAME("ast2600-evb"),
+        .desc      = "Aspeed AST2600 EVB (Cortex A7)",
+        .soc_name  = "ast2600-a0",
+        .hw_strap1 = AST2600_EVB_HW_STRAP1,
+        .hw_strap2 = AST2600_EVB_HW_STRAP2,
+        .fmc_model = "w25q512jv",
+        .spi_model = "mx66u51235f",
+        .num_cs    = 1,
+        .i2c_init  = ast2600_evb_i2c_init,
+        .ram       = 2 * GiB,
     },
 };
 
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

To support the ast2600's four MACs allow SoCs to specify the number
they have, and create that many.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190925143248.10000-22-clg@kaod.org
[clg: - included a check on sc->macs_num when realizing the macs
      - included interrupt definitions for the AST2600 ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |  5 ++++-
 hw/arm/aspeed_ast2600.c     | 10 ++++++++--
 hw/arm/aspeed_soc.c         |  6 ++++--
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_SPIS_NUM  2
 #define ASPEED_WDTS_NUM  4
 #define ASPEED_CPUS_NUM  2
-#define ASPEED_MACS_NUM  2
+#define ASPEED_MACS_NUM  4
 
 typedef struct AspeedSoCState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCClass {
     uint64_t sram_size;
     int spis_num;
     int wdts_num;
+    int macs_num;
     const int *irqmap;
     const hwaddr *memmap;
     uint32_t num_cpus;
@@ -XXX,XX +XXX,XX @@ enum {
     ASPEED_I2C,
     ASPEED_ETH1,
     ASPEED_ETH2,
+    ASPEED_ETH3,
+    ASPEED_ETH4,
     ASPEED_SDRAM,
     ASPEED_XDMA,
 };
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
     [ASPEED_SPI1]      = 0x1E630000,
     [ASPEED_SPI2]      = 0x1E641000,
     [ASPEED_ETH1]      = 0x1E660000,
+    [ASPEED_ETH3]      = 0x1E670000,
     [ASPEED_ETH2]      = 0x1E680000,
+    [ASPEED_ETH4]      = 0x1E690000,
     [ASPEED_VIC]       = 0x1E6C0000,
     [ASPEED_SDMC]      = 0x1E6E0000,
     [ASPEED_SCU]       = 0x1E6E2000,
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2600_irqmap[] = {
     [ASPEED_I2C]       = 110,   /* 110 -> 125 */
     [ASPEED_ETH1]      = 2,
     [ASPEED_ETH2]      = 3,
+    [ASPEED_ETH3]      = 32,
+    [ASPEED_ETH4]      = 33,
+
 };
 
 static qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int ctrl)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
                                        OBJECT(&s->scu), &error_abort);
     }
 
-    for (i = 0; i < ASPEED_MACS_NUM; i++) {
+    for (i = 0; i < sc->macs_num; i++) {
         sysbus_init_child_obj(obj, "ftgmac100[*]", OBJECT(&s->ftgmac100[i]),
                               sizeof(s->ftgmac100[i]), TYPE_FTGMAC100);
     }
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     }
 
     /* Net */
-    for (i = 0; i < nb_nics; i++) {
+    for (i = 0; i < nb_nics && i < sc->macs_num; i++) {
         qdev_set_nic_properties(DEVICE(&s->ftgmac100[i]), &nd_table[i]);
         object_property_set_bool(OBJECT(&s->ftgmac100[i]), true, "aspeed",
                                  &err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)
     sc->sram_size    = 0x10000;
     sc->spis_num     = 2;
     sc->wdts_num     = 4;
+    sc->macs_num     = 4;
     sc->irqmap       = aspeed_soc_ast2600_irqmap;
     sc->memmap       = aspeed_soc_ast2600_memmap;
     sc->num_cpus     = 2;
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                                        OBJECT(&s->scu), &error_abort);
     }
 
-    for (i = 0; i < ASPEED_MACS_NUM; i++) {
+    for (i = 0; i < sc->macs_num; i++) {
         sysbus_init_child_obj(obj, "ftgmac100[*]", OBJECT(&s->ftgmac100[i]),
                               sizeof(s->ftgmac100[i]), TYPE_FTGMAC100);
     }
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     }
 
     /* Net */
-    for (i = 0; i < nb_nics; i++) {
+    for (i = 0; i < nb_nics && i < sc->macs_num; i++) {
         qdev_set_nic_properties(DEVICE(&s->ftgmac100[i]), &nd_table[i]);
         object_property_set_bool(OBJECT(&s->ftgmac100[i]), true, "aspeed",
                                  &err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
     sc->sram_size    = 0x8000;
     sc->spis_num     = 1;
     sc->wdts_num     = 2;
+    sc->macs_num     = 2;
     sc->irqmap       = aspeed_soc_ast2400_irqmap;
     sc->memmap       = aspeed_soc_ast2400_memmap;
     sc->num_cpus     = 1;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
     sc->sram_size    = 0x9000;
     sc->spis_num     = 2;
     sc->wdts_num     = 3;
+    sc->macs_num     = 2;
     sc->irqmap       = aspeed_soc_ast2500_irqmap;
     sc->memmap       = aspeed_soc_ast2500_memmap;
     sc->num_cpus     = 1;
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

The AST2600 SoC has an extra controller to set the PHY registers.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190925143248.10000-23-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |   5 ++
 include/hw/net/ftgmac100.h  |  17 ++++
 hw/arm/aspeed_ast2600.c     |  20 +++++
 hw/net/ftgmac100.c          | 162 ++++++++++++++++++++++++++++++++++++
 4 files changed, 204 insertions(+)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
     AspeedSDMCState sdmc;
     AspeedWDTState wdt[ASPEED_WDTS_NUM];
     FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
+    AspeedMiiState mii[ASPEED_MACS_NUM];
     AspeedGPIOState gpio;
     AspeedGPIOState gpio_1_8v;
     AspeedSDHCIState sdhci;
@@ -XXX,XX +XXX,XX @@ enum {
     ASPEED_ETH2,
     ASPEED_ETH3,
     ASPEED_ETH4,
+    ASPEED_MII1,
+    ASPEED_MII2,
+    ASPEED_MII3,
+    ASPEED_MII4,
     ASPEED_SDRAM,
     ASPEED_XDMA,
 };
diff --git a/include/hw/net/ftgmac100.h b/include/hw/net/ftgmac100.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/ftgmac100.h
+++ b/include/hw/net/ftgmac100.h
@@ -XXX,XX +XXX,XX @@ typedef struct FTGMAC100State {
     uint32_t rxdes0_edorr;
 } FTGMAC100State;
 
+#define TYPE_ASPEED_MII "aspeed-mmi"
+#define ASPEED_MII(obj) OBJECT_CHECK(AspeedMiiState, (obj), TYPE_ASPEED_MII)
+
+/*
+ * AST2600 MII controller
+ */
+typedef struct AspeedMiiState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    FTGMAC100State *nic;
+
+    MemoryRegion iomem;
+    uint32_t phycr;
+    uint32_t phydata;
+} AspeedMiiState;
+
 #endif
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
     [ASPEED_FMC]       = 0x1E620000,
     [ASPEED_SPI1]      = 0x1E630000,
     [ASPEED_SPI2]      = 0x1E641000,
+    [ASPEED_MII1]      = 0x1E650000,
+    [ASPEED_MII2]      = 0x1E650008,
+    [ASPEED_MII3]      = 0x1E650010,
+    [ASPEED_MII4]      = 0x1E650018,
     [ASPEED_ETH1]      = 0x1E660000,
     [ASPEED_ETH3]      = 0x1E670000,
     [ASPEED_ETH2]      = 0x1E680000,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
     for (i = 0; i < sc->macs_num; i++) {
         sysbus_init_child_obj(obj, "ftgmac100[*]", OBJECT(&s->ftgmac100[i]),
                               sizeof(s->ftgmac100[i]), TYPE_FTGMAC100);
+
+        sysbus_init_child_obj(obj, "mii[*]", &s->mii[i], sizeof(s->mii[i]),
+                              TYPE_ASPEED_MII);
+        object_property_add_const_link(OBJECT(&s->mii[i]), "nic",
+                                       OBJECT(&s->ftgmac100[i]),
+                                       &error_abort);
     }
 
     sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
                         sc->memmap[ASPEED_ETH1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_ETH1 + i));
+
+        object_property_set_bool(OBJECT(&s->mii[i]), true, "realized",
+                                 &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->mii[i]), 0,
+                        sc->memmap[ASPEED_MII1 + i]);
     }
 
     /* XDMA */
diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/net/ftgmac100.h"
 #include "sysemu/dma.h"
+#include "qapi/error.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "net/checksum.h"
@@ -XXX,XX +XXX,XX @@ static const TypeInfo ftgmac100_info = {
     .class_init = ftgmac100_class_init,
 };
 
+/*
+ * AST2600 MII controller
+ */
+#define ASPEED_MII_PHYCR_FIRE        BIT(31)
+#define ASPEED_MII_PHYCR_ST_22       BIT(28)
+#define ASPEED_MII_PHYCR_OP(x)       ((x) & (ASPEED_MII_PHYCR_OP_WRITE | \
+                                             ASPEED_MII_PHYCR_OP_READ))
+#define ASPEED_MII_PHYCR_OP_WRITE    BIT(26)
+#define ASPEED_MII_PHYCR_OP_READ     BIT(27)
+#define ASPEED_MII_PHYCR_DATA(x)     (x & 0xffff)
+#define ASPEED_MII_PHYCR_PHY(x)      (((x) >> 21) & 0x1f)
+#define ASPEED_MII_PHYCR_REG(x)      (((x) >> 16) & 0x1f)
+
+#define ASPEED_MII_PHYDATA_IDLE      BIT(16)
+
+static void aspeed_mii_transition(AspeedMiiState *s, bool fire)
+{
+    if (fire) {
+        s->phycr |= ASPEED_MII_PHYCR_FIRE;
+        s->phydata &= ~ASPEED_MII_PHYDATA_IDLE;
+    } else {
+        s->phycr &= ~ASPEED_MII_PHYCR_FIRE;
+        s->phydata |= ASPEED_MII_PHYDATA_IDLE;
+    }
+}
+
+static void aspeed_mii_do_phy_ctl(AspeedMiiState *s)
+{
+    uint8_t reg;
+    uint16_t data;
+
+    if (!(s->phycr & ASPEED_MII_PHYCR_ST_22)) {
+        aspeed_mii_transition(s, !ASPEED_MII_PHYCR_FIRE);
+        qemu_log_mask(LOG_UNIMP, "%s: unsupported ST code\n", __func__);
+        return;
+    }
+
+    /* Nothing to do */
+    if (!(s->phycr & ASPEED_MII_PHYCR_FIRE)) {
+        return;
+    }
+
+    reg = ASPEED_MII_PHYCR_REG(s->phycr);
+    data = ASPEED_MII_PHYCR_DATA(s->phycr);
+
+    switch (ASPEED_MII_PHYCR_OP(s->phycr)) {
+    case ASPEED_MII_PHYCR_OP_WRITE:
+        do_phy_write(s->nic, reg, data);
+        break;
+    case ASPEED_MII_PHYCR_OP_READ:
+        s->phydata = (s->phydata & ~0xffff) | do_phy_read(s->nic, reg);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid OP code %08x\n",
+                      __func__, s->phycr);
+    }
+
+    aspeed_mii_transition(s, !ASPEED_MII_PHYCR_FIRE);
+}
+
+static uint64_t aspeed_mii_read(void *opaque, hwaddr addr, unsigned size)
+{
+    AspeedMiiState *s = ASPEED_MII(opaque);
+
+    switch (addr) {
+    case 0x0:
+        return s->phycr;
+    case 0x4:
+        return s->phydata;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static void aspeed_mii_write(void *opaque, hwaddr addr,
+                             uint64_t value, unsigned size)
+{
+    AspeedMiiState *s = ASPEED_MII(opaque);
+
+    switch (addr) {
+    case 0x0:
+        s->phycr = value & ~(s->phycr & ASPEED_MII_PHYCR_FIRE);
+        break;
+    case 0x4:
+        s->phydata = value & ~(0xffff | ASPEED_MII_PHYDATA_IDLE);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    aspeed_mii_transition(s, !!(s->phycr & ASPEED_MII_PHYCR_FIRE));
+    aspeed_mii_do_phy_ctl(s);
+}
+
+static const MemoryRegionOps aspeed_mii_ops = {
+    .read = aspeed_mii_read,
+    .write = aspeed_mii_write,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void aspeed_mii_reset(DeviceState *dev)
+{
+    AspeedMiiState *s = ASPEED_MII(dev);
+
+    s->phycr = 0;
+    s->phydata = 0;
+
+    aspeed_mii_transition(s, !!(s->phycr & ASPEED_MII_PHYCR_FIRE));
+};
+
+static void aspeed_mii_realize(DeviceState *dev, Error **errp)
+{
+    AspeedMiiState *s = ASPEED_MII(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    Object *obj;
+    Error *local_err = NULL;
+
+    obj = object_property_get_link(OBJECT(dev), "nic", &local_err);
+    if (!obj) {
+        error_propagate(errp, local_err);
+        error_prepend(errp, "required link 'nic' not found: ");
+        return;
+    }
+
+    s->nic = FTGMAC100(obj);
+
+    memory_region_init_io(&s->iomem, OBJECT(dev), &aspeed_mii_ops, s,
+                          TYPE_ASPEED_MII, 0x8);
+    sysbus_init_mmio(sbd, &s->iomem);
+}
+
+static const VMStateDescription vmstate_aspeed_mii = {
+    .name = TYPE_ASPEED_MII,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(phycr, FTGMAC100State),
+        VMSTATE_UINT32(phydata, FTGMAC100State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+static void aspeed_mii_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &vmstate_aspeed_mii;
+    dc->reset = aspeed_mii_reset;
+    dc->realize = aspeed_mii_realize;
+    dc->desc = "Aspeed MII controller";
+}
+
+static const TypeInfo aspeed_mii_info = {
+    .name = TYPE_ASPEED_MII,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(AspeedMiiState),
+    .class_init = aspeed_mii_class_init,
+};
+
 static void ftgmac100_register_types(void)
 {
     type_register_static(&ftgmac100_info);
+    type_register_static(&aspeed_mii_info);
 }
 
 type_init(ftgmac100_register_types)
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190925143248.10000-24-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h | 1 +
 hw/arm/aspeed_ast2600.c     | 5 +++++
 hw/arm/aspeed_soc.c         | 6 ++++++
 3 files changed, 12 insertions(+)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ enum {
     ASPEED_SDMC,
     ASPEED_SCU,
     ASPEED_ADC,
+    ASPEED_VIDEO,
     ASPEED_SRAM,
     ASPEED_SDHCI,
     ASPEED_GPIO,
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
     [ASPEED_SCU]       = 0x1E6E2000,
     [ASPEED_XDMA]      = 0x1E6E7000,
     [ASPEED_ADC]       = 0x1E6E9000,
+    [ASPEED_VIDEO]     = 0x1E700000,
     [ASPEED_SDHCI]     = 0x1E740000,
     [ASPEED_GPIO]      = 0x1E780000,
     [ASPEED_GPIO_1_8V] = 0x1E780800,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_IOMEM],
                                 ASPEED_SOC_IOMEM_SIZE);
 
+    /* Video engine stub */
+    create_unimplemented_device("aspeed.video", sc->memmap[ASPEED_VIDEO],
+                                0x1000);
+
     if (s->num_cpus > sc->num_cpus) {
         warn_report("%s: invalid number of CPUs %d, using default %d",
                     sc->name, s->num_cpus, sc->num_cpus);
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2400_memmap[] = {
     [ASPEED_SDMC]   = 0x1E6E0000,
     [ASPEED_SCU]    = 0x1E6E2000,
     [ASPEED_XDMA]   = 0x1E6E7000,
+    [ASPEED_VIDEO]  = 0x1E700000,
     [ASPEED_ADC]    = 0x1E6E9000,
     [ASPEED_SRAM]   = 0x1E720000,
     [ASPEED_SDHCI]  = 0x1E740000,
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2500_memmap[] = {
     [ASPEED_SCU]    = 0x1E6E2000,
     [ASPEED_XDMA]   = 0x1E6E7000,
     [ASPEED_ADC]    = 0x1E6E9000,
+    [ASPEED_VIDEO]  = 0x1E700000,
     [ASPEED_SRAM]   = 0x1E720000,
     [ASPEED_SDHCI]  = 0x1E740000,
     [ASPEED_GPIO]   = 0x1E780000,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_IOMEM],
                                 ASPEED_SOC_IOMEM_SIZE);
 
+    /* Video engine stub */
+    create_unimplemented_device("aspeed.video", sc->memmap[ASPEED_VIDEO],
+                                0x1000);
+
     if (s->num_cpus > sc->num_cpus) {
         warn_report("%s: invalid number of CPUs %d, using default %d",
                     sc->name, s->num_cpus, sc->num_cpus);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

IEC binary prefixes ease code review: the unit is explicit.

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->max_cpus = BCM283X_NCPUS;
     mc->min_cpus = BCM283X_NCPUS;
     mc->default_cpus = BCM283X_NCPUS;
-    mc->default_ram_size = 1024 * 1024 * 1024;
+    mc->default_ram_size = 1 * GiB;
     mc->ignore_memory_transaction_failures = true;
 };
 DEFINE_MACHINE("raspi2", raspi2_machine_init)
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
     mc->max_cpus = BCM283X_NCPUS;
     mc->min_cpus = BCM283X_NCPUS;
     mc->default_cpus = BCM283X_NCPUS;
-    mc->default_ram_size = 1024 * 1024 * 1024;
+    mc->default_ram_size = 1 * GiB;
 }
 DEFINE_MACHINE("raspi3", raspi3_machine_init)
 #endif
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Various logging improvements as once:
- Use 0x prefix for hex numbers
- Display value written during write accesses
- Move some logs from GUEST_ERROR to UNIMP

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
Message-id: 20190926173428.10713-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/bcm2835_aux.c      |  5 +++--
 hw/dma/bcm2835_dma.c       |  8 ++++----
 hw/intc/bcm2836_control.c  |  7 ++++---
 hw/misc/bcm2835_mbox.c     |  7 ++++---
 hw/misc/bcm2835_property.c | 16 ++++++++++------
 5 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/bcm2835_aux.c
+++ b/hw/char/bcm2835_aux.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_aux_write(void *opaque, hwaddr offset, uint64_t value,
     switch (offset) {
     case AUX_ENABLES:
         if (value != 1) {
-            qemu_log_mask(LOG_UNIMP, "%s: unsupported attempt to enable SPI "
-                          "or disable UART\n", __func__);
+            qemu_log_mask(LOG_UNIMP, "%s: unsupported attempt to enable SPI"
+                                     " or disable UART: 0x%"PRIx64"\n",
+                          __func__, value);
         }
         break;
 
diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/bcm2835_dma.c
+++ b/hw/dma/bcm2835_dma.c
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2835_dma_read(BCM2835DMAState *s, hwaddr offset,
         res = ch->debug;
         break;
     default:
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
                       __func__, offset);
         break;
     }
@@ -XXX,XX +XXX,XX @@ static void bcm2835_dma_write(BCM2835DMAState *s, hwaddr offset,
         ch->debug = value;
         break;
     default:
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
                       __func__, offset);
         break;
     }
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2835_dma0_read(void *opaque, hwaddr offset, unsigned size)
         case BCM2708_DMA_ENABLE:
             return s->enable;
         default:
-            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
                           __func__, offset);
             return 0;
         }
@@ -XXX,XX +XXX,XX @@ static void bcm2835_dma0_write(void *opaque, hwaddr offset, uint64_t value,
             s->enable = (value & 0xffff);
             break;
         default:
-            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
                           __func__, offset);
         }
     }
diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/bcm2836_control.c
+++ b/hw/intc/bcm2836_control.c
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
     } else if (offset >= REG_MBOX0_RDCLR && offset < REG_LIMIT) {
         return s->mailboxes[(offset - REG_MBOX0_RDCLR) >> 2];
     } else {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx"\n",
                       __func__, offset);
         return 0;
     }
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_write(void *opaque, hwaddr offset,
     } else if (offset >= REG_MBOX0_RDCLR && offset < REG_LIMIT) {
         s->mailboxes[(offset - REG_MBOX0_RDCLR) >> 2] &= ~val;
     } else {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
-                      __func__, offset);
+        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx
+                                 " value 0x%"PRIx64"\n",
+                      __func__, offset, val);
         return;
     }
 
diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/bcm2835_mbox.c
+++ b/hw/misc/bcm2835_mbox.c
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size)
         break;
 
     default:
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx"\n",
                       __func__, offset);
         return 0;
     }
@@ -XXX,XX +XXX,XX @@ static void bcm2835_mbox_write(void *opaque, hwaddr offset,
         break;
 
     default:
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
-                      __func__, offset);
+        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx
+                                 " value 0x%"PRIx64"\n",
+                      __func__, offset, value);
         return;
     }
 
diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/bcm2835_property.c
+++ b/hw/misc/bcm2835_property.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
             break;
         case 0x00010001: /* Get board model */
             qemu_log_mask(LOG_UNIMP,
-                          "bcm2835_property: %x get board model NYI\n", tag);
+                          "bcm2835_property: 0x%08x get board model NYI\n",
+                          tag);
             resplen = 4;
             break;
         case 0x00010002: /* Get board revision */
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
             break;
         case 0x00010004: /* Get board serial */
             qemu_log_mask(LOG_UNIMP,
-                          "bcm2835_property: %x get board serial NYI\n", tag);
+                          "bcm2835_property: 0x%08x get board serial NYI\n",
+                          tag);
             resplen = 8;
             break;
         case 0x00010005: /* Get ARM memory */
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
 
         case 0x00038001: /* Set clock state */
             qemu_log_mask(LOG_UNIMP,
-                          "bcm2835_property: %x set clock state NYI\n", tag);
+                          "bcm2835_property: 0x%08x set clock state NYI\n",
+                          tag);
             resplen = 8;
             break;
 
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
         case 0x00038004: /* Set max clock rate */
         case 0x00038007: /* Set min clock rate */
             qemu_log_mask(LOG_UNIMP,
-                          "bcm2835_property: %x set clock rates NYI\n", tag);
+                          "bcm2835_property: 0x%08x set clock rate NYI\n",
+                          tag);
             resplen = 8;
             break;
 
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
             break;
 
         default:
-            qemu_log_mask(LOG_GUEST_ERROR,
-                          "bcm2835_property: unhandled tag %08x\n", tag);
+            qemu_log_mask(LOG_UNIMP,
+                          "bcm2835_property: unhandled tag 0x%08x\n", tag);
             break;
         }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Various address spaces from the BCM2835 are reported as
'anonymous' in memory tree:

(qemu) info mtree

address-space: anonymous
    0000000000000000-000000000000008f (prio 0, i/o): bcm2835-mbox
      0000000000000010-000000000000001f (prio 0, i/o): bcm2835-fb
      0000000000000080-000000000000008f (prio 0, i/o): bcm2835-property

address-space: anonymous
    0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
      0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
      0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff

[...]

Since the address_space_init() function takes a 'name' argument,
set it to correctly describe each address space:

(qemu) info mtree

address-space: bcm2835-mbox-memory
    0000000000000000-000000000000008f (prio 0, i/o): bcm2835-mbox
      0000000000000010-000000000000001f (prio 0, i/o): bcm2835-fb
      0000000000000080-000000000000008f (prio 0, i/o): bcm2835-property

address-space: bcm2835-fb-memory
    0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
      0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
      0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff

address-space: bcm2835-property-memory
    0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
      0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
      0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff

address-space: bcm2835-dma-memory
    0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
      0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
      0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Cleber Rosa <crosa@redhat.com>
Message-id: 20190926173428.10713-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/display/bcm2835_fb.c    | 2 +-
 hw/dma/bcm2835_dma.c       | 2 +-
 hw/misc/bcm2835_mbox.c     | 2 +-
 hw/misc/bcm2835_property.c | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/display/bcm2835_fb.c b/hw/display/bcm2835_fb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/bcm2835_fb.c
+++ b/hw/display/bcm2835_fb.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_fb_realize(DeviceState *dev, Error **errp)
     s->initial_config.base = s->vcram_base + BCM2835_FB_OFFSET;
 
     s->dma_mr = MEMORY_REGION(obj);
-    address_space_init(&s->dma_as, s->dma_mr, NULL);
+    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_FB "-memory");
 
     bcm2835_fb_reset(dev);
 
diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/bcm2835_dma.c
+++ b/hw/dma/bcm2835_dma.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_dma_realize(DeviceState *dev, Error **errp)
     }
 
     s->dma_mr = MEMORY_REGION(obj);
-    address_space_init(&s->dma_as, s->dma_mr, NULL);
+    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_DMA "-memory");
 
     bcm2835_dma_reset(dev);
 }
diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/bcm2835_mbox.c
+++ b/hw/misc/bcm2835_mbox.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_mbox_realize(DeviceState *dev, Error **errp)
     }
 
     s->mbox_mr = MEMORY_REGION(obj);
-    address_space_init(&s->mbox_as, s->mbox_mr, NULL);
+    address_space_init(&s->mbox_as, s->mbox_mr, TYPE_BCM2835_MBOX "-memory");
     bcm2835_mbox_reset(dev);
 }
 
diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/bcm2835_property.c
+++ b/hw/misc/bcm2835_property.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_realize(DeviceState *dev, Error **errp)
     }
 
     s->dma_mr = MEMORY_REGION(obj);
-    address_space_init(&s->dma_as, s->dma_mr, NULL);
+    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_PROPERTY "-memory");
 
     /* TODO: connect to MAC address of USB NIC device, once we emulate it */
     qemu_macaddr_default_if_unset(&s->macaddr);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The UART1 is part of the AUX peripheral,
the PCM_CLOCK (yet unimplemented) is part of the CPRMAN.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190926173428.10713-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/raspi_platform.h | 16 +++++++---------
 hw/arm/bcm2835_peripherals.c    |  7 ++++---
 hw/arm/bcm2836.c                |  2 +-
 3 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/raspi_platform.h
+++ b/include/hw/arm/raspi_platform.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HW_ARM_RASPI_PLATFORM_H
 #define HW_ARM_RASPI_PLATFORM_H
 
-#define MCORE_OFFSET            0x0000   /* Fake frame buffer device
-                                          * (the multicore sync block) */
+#define MSYNC_OFFSET            0x0000   /* Multicore Sync Block */
 #define IC0_OFFSET              0x2000
 #define ST_OFFSET               0x3000   /* System Timer */
 #define MPHI_OFFSET             0x6000   /* Message-based Parallel Host Intf. */
@@ -XXX,XX +XXX,XX @@
 #define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 */
 #define ARMCTRL_0_SBM_OFFSET    (ARM_OFFSET + 0x800) /* User 0 (ARM) Semaphores
                                                       * Doorbells & Mailboxes */
-#define PM_OFFSET               0x100000 /* Power Management, Reset controller
-                                          * and Watchdog registers */
-#define PCM_CLOCK_OFFSET        0x101098
+#define CPRMAN_OFFSET           0x100000 /* Power Management, Watchdog */
+#define CM_OFFSET               0x101000 /* Clock Management */
 #define RNG_OFFSET              0x104000
 #define GPIO_OFFSET             0x200000
 #define UART0_OFFSET            0x201000
@@ -XXX,XX +XXX,XX @@
 #define I2S_OFFSET              0x203000
 #define SPI0_OFFSET             0x204000
 #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
-#define UART1_OFFSET            0x215000
-#define EMMC_OFFSET             0x300000
+#define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
+#define EMMC1_OFFSET            0x300000
 #define SMI_OFFSET              0x600000
 #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
-#define USB_OFFSET              0x980000 /* DTC_OTG USB controller */
+#define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
 #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
 
 /* GPU interrupts */
@@ -XXX,XX +XXX,XX @@
 #define INTERRUPT_SPI                  54
 #define INTERRUPT_I2SPCM               55
 #define INTERRUPT_SDIO                 56
-#define INTERRUPT_UART                 57
+#define INTERRUPT_UART0                57
 #define INTERRUPT_SLIMBUS              58
 #define INTERRUPT_VEC                  59
 #define INTERRUPT_CPG                  60
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
                 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart0), 0));
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart0), 0,
         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
-                               INTERRUPT_UART));
+                               INTERRUPT_UART0));
+
     /* AUX / UART1 */
     qdev_prop_set_chr(DEVICE(&s->aux), "chardev", serial_hd(1));
 
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    memory_region_add_subregion(&s->peri_mr, UART1_OFFSET,
+    memory_region_add_subregion(&s->peri_mr, AUX_OFFSET,
                 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->aux), 0));
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->aux), 0,
         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    memory_region_add_subregion(&s->peri_mr, EMMC_OFFSET,
+    memory_region_add_subregion(&s->peri_mr, EMMC1_OFFSET,
                 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->sdhci), 0));
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
         /* set periphbase/CBAR value for CPU-local registers */
         object_property_set_int(OBJECT(&s->cpus[n]),
-                                BCM2836_PERI_BASE + MCORE_OFFSET,
+                                BCM2836_PERI_BASE + MSYNC_OFFSET,
                                 "reset-cbar", &err);
         if (err) {
             error_propagate(errp, err);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Base addresses and sizes taken from the "BCM2835 ARM Peripherals"
datasheet from February 06 2012:
https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190926173428.10713-6-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/bcm2835_peripherals.h | 15 ++++++++++++++
 include/hw/arm/raspi_platform.h      |  8 +++++++
 hw/arm/bcm2835_peripherals.c         | 31 ++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+)

diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sd/sdhci.h"
 #include "hw/sd/bcm2835_sdhost.h"
 #include "hw/gpio/bcm2835_gpio.h"
+#include "hw/misc/unimp.h"
 
 #define TYPE_BCM2835_PERIPHERALS "bcm2835-peripherals"
 #define BCM2835_PERIPHERALS(obj) \
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2835PeripheralState {
     MemoryRegion ram_alias[4];
     qemu_irq irq, fiq;
 
+    UnimplementedDeviceState systmr;
+    UnimplementedDeviceState armtmr;
+    UnimplementedDeviceState cprman;
+    UnimplementedDeviceState a2w;
     PL011State uart0;
     BCM2835AuxState aux;
     BCM2835FBState fb;
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2835PeripheralState {
     SDHCIState sdhci;
     BCM2835SDHostState sdhost;
     BCM2835GpioState gpio;
+    UnimplementedDeviceState i2s;
+    UnimplementedDeviceState spi[1];
+    UnimplementedDeviceState i2c[3];
+    UnimplementedDeviceState otp;
+    UnimplementedDeviceState dbus;
+    UnimplementedDeviceState ave0;
+    UnimplementedDeviceState bscsl;
+    UnimplementedDeviceState smi;
+    UnimplementedDeviceState dwc2;
+    UnimplementedDeviceState sdramc;
 } BCM2835PeripheralState;
 
 #endif /* BCM2835_PERIPHERALS_H */
diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/raspi_platform.h
+++ b/include/hw/arm/raspi_platform.h
@@ -XXX,XX +XXX,XX @@
                                                       * Doorbells & Mailboxes */
 #define CPRMAN_OFFSET           0x100000 /* Power Management, Watchdog */
 #define CM_OFFSET               0x101000 /* Clock Management */
+#define A2W_OFFSET              0x102000 /* Reset controller */
+#define AVS_OFFSET              0x103000 /* Audio Video Standard */
 #define RNG_OFFSET              0x104000
 #define GPIO_OFFSET             0x200000
 #define UART0_OFFSET            0x201000
@@ -XXX,XX +XXX,XX @@
 #define I2S_OFFSET              0x203000
 #define SPI0_OFFSET             0x204000
 #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
+#define OTP_OFFSET              0x20f000
+#define BSC_SL_OFFSET           0x214000 /* SPI slave */
 #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
 #define EMMC1_OFFSET            0x300000
 #define SMI_OFFSET              0x600000
 #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
+#define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
+#define DBUS_OFFSET             0x900000
+#define AVE0_OFFSET             0x910000
 #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
+#define SDRAMC_OFFSET           0xe00000
 #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
 
 /* GPU interrupts */
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@
 /* Capabilities for SD controller: no DMA, high-speed, default clocks etc. */
 #define BCM2835_SDHC_CAPAREG 0x52134b4
 
+static void create_unimp(BCM2835PeripheralState *ps,
+                         UnimplementedDeviceState *uds,
+                         const char *name, hwaddr ofs, hwaddr size)
+{
+    sysbus_init_child_obj(OBJECT(ps), name, uds,
+                          sizeof(UnimplementedDeviceState),
+                          TYPE_UNIMPLEMENTED_DEVICE);
+    qdev_prop_set_string(DEVICE(uds), "name", name);
+    qdev_prop_set_uint64(DEVICE(uds), "size", size);
+    object_property_set_bool(OBJECT(uds), true, "realized", &error_fatal);
+    memory_region_add_subregion_overlap(&ps->peri_mr, ofs,
+                    sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0), -1000);
+}
+
 static void bcm2835_peripherals_init(Object *obj)
 {
     BCM2835PeripheralState *s = BCM2835_PERIPHERALS(obj);
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
+
+    create_unimp(s, &s->armtmr, "bcm2835-sp804", ARMCTRL_TIMER0_1_OFFSET, 0x40);
+    create_unimp(s, &s->systmr, "bcm2835-systimer", ST_OFFSET, 0x20);
+    create_unimp(s, &s->cprman, "bcm2835-cprman", CPRMAN_OFFSET, 0x1000);
+    create_unimp(s, &s->a2w, "bcm2835-a2w", A2W_OFFSET, 0x1000);
+    create_unimp(s, &s->i2s, "bcm2835-i2s", I2S_OFFSET, 0x100);
+    create_unimp(s, &s->smi, "bcm2835-smi", SMI_OFFSET, 0x100);
+    create_unimp(s, &s->spi[0], "bcm2835-spi0", SPI0_OFFSET, 0x20);
+    create_unimp(s, &s->bscsl, "bcm2835-spis", BSC_SL_OFFSET, 0x100);
+    create_unimp(s, &s->i2c[0], "bcm2835-i2c0", BSC0_OFFSET, 0x20);
+    create_unimp(s, &s->i2c[1], "bcm2835-i2c1", BSC1_OFFSET, 0x20);
+    create_unimp(s, &s->i2c[2], "bcm2835-i2c2", BSC2_OFFSET, 0x20);
+    create_unimp(s, &s->otp, "bcm2835-otp", OTP_OFFSET, 0x80);
+    create_unimp(s, &s->dbus, "bcm2835-dbus", DBUS_OFFSET, 0x8000);
+    create_unimp(s, &s->ave0, "bcm2835-ave0", AVE0_OFFSET, 0x8000);
+    create_unimp(s, &s->dwc2, "dwc-usb2", USB_OTG_OFFSET, 0x1000);
+    create_unimp(s, &s->sdramc, "bcm2835-sdramc", SDRAMC_OFFSET, 0x100);
 }
 
 static void bcm2835_peripherals_class_init(ObjectClass *oc, void *data)
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add trace events for read/write accesses and IRQ.

Properties are structures used for the ARM particular MBOX.
Since one call in bcm2835_property.c concerns the mbox block,
name this trace event in the same bcm2835_mbox* namespace.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190926173428.10713-8-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/bcm2835_mbox.c     | 5 +++++
 hw/misc/bcm2835_property.c | 2 ++
 hw/misc/trace-events       | 6 ++++++
 3 files changed, 13 insertions(+)

diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/bcm2835_mbox.c
+++ b/hw/misc/bcm2835_mbox.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
+#include "trace.h"
 
 #define MAIL0_PEEK   0x90
 #define MAIL0_SENDER 0x94
@@ -XXX,XX +XXX,XX @@ static void bcm2835_mbox_update(BCM2835MboxState *s)
             set = true;
         }
     }
+    trace_bcm2835_mbox_irq(set);
     qemu_set_irq(s->arm_irq, set);
 }
 
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size)
     default:
         qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx"\n",
                       __func__, offset);
+        trace_bcm2835_mbox_read(size, offset, res);
         return 0;
     }
+    trace_bcm2835_mbox_read(size, offset, res);
 
     bcm2835_mbox_update(s);
 
@@ -XXX,XX +XXX,XX @@ static void bcm2835_mbox_write(void *opaque, hwaddr offset,
 
     offset &= 0xff;
 
+    trace_bcm2835_mbox_write(size, offset, value);
     switch (offset) {
     case MAIL0_SENDER:
         break;
diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/bcm2835_property.c
+++ b/hw/misc/bcm2835_property.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/dma.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
+#include "trace.h"
 
 /* https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface */
 
@@ -XXX,XX +XXX,XX @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
             break;
         }
 
+        trace_bcm2835_mbox_property(tag, bufsize, resplen);
         if (tag == 0) {
             break;
         }
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ armsse_mhu_write(uint64_t offset, uint64_t data, unsigned size) "SSE-200 MHU wri
 
 # aspeed_xdma.c
 aspeed_xdma_write(uint64_t offset, uint64_t data) "XDMA write: offset 0x%" PRIx64 " data 0x%" PRIx64
+
+# bcm2835_mbox.c
+bcm2835_mbox_write(unsigned int size, uint64_t addr, uint64_t value) "mbox write sz:%u addr:0x%"PRIx64" data:0x%"PRIx64
+bcm2835_mbox_read(unsigned int size, uint64_t addr, uint64_t value) "mbox read sz:%u addr:0x%"PRIx64" data:0x%"PRIx64
+bcm2835_mbox_irq(unsigned level) "mbox irq:ARM level:%u"
+bcm2835_mbox_property(uint32_t tag, uint32_t bufsize, size_t resplen) "mbox property tag:0x%08x in_sz:%u out_sz:%zu"
-- 
2.20.1

arm queue; dunno if this will be the last before softfreeze
or not, but anyway probably the last large one. New orangepi-pc
board model is the big item here.

thanks
-- PMM

The following changes since commit 67d9ef7d541c3d21a25796c51c26da096a433565:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-docs-20200312' into staging (2020-03-12 15:20:52 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200312

for you to fetch changes up to aca53be34ac3e7cac5f39396a51a338860a5a837:

target/arm: kvm: Inject events at the last stage of sync (2020-03-12 16:31:10 +0000)

----------------------------------------------------------------
target-arm queue:
 * Fix various bugs that might result in an assert() due to
   incorrect hflags for M-profile CPUs
 * Fix Aspeed SMC Controller user-mode select handling
 * Report correct (with-tag) address in fault address register
   when TBI is enabled
 * cubieboard: make sure SOC object isn't leaked
 * fsl-imx25: Wire up eSDHC controllers
 * fsl-imx25: Wire up USB controllers
 * New board model: orangepi-pc (OrangePi PC)
 * ARM/KVM: if user doesn't select GIC version and the
   host kernel can only provide GICv3, use that, rather
   than defaulting to "fail because GICv2 isn't possible"
 * kvm: Only do KVM_SET_VCPU_EVENTS at the last stage of sync

----------------------------------------------------------------
Beata Michalska (1):
      target/arm: kvm: Inject events at the last stage of sync

Cédric Le Goater (2):
      aspeed/smc: Add some tracing
      aspeed/smc: Fix User mode select/unselect scheme

Eric Auger (6):
      hw/arm/virt: Document 'max' value in gic-version property description
      hw/arm/virt: Introduce VirtGICType enum type
      hw/arm/virt: Introduce finalize_gic_version()
      target/arm/kvm: Let kvm_arm_vgic_probe() return a bitmap
      hw/arm/virt: kvm: Restructure finalize_gic_version()
      hw/arm/virt: kvm: allow gicv3 by default if v2 cannot work

Guenter Roeck (2):
      hw/arm/fsl-imx25: Wire up eSDHC controllers
      hw/arm/fsl-imx25: Wire up USB controllers

Igor Mammedov (1):
      hw/arm/cubieboard: make sure SOC object isn't leaked

Niek Linnenbank (13):
      hw/arm: add Allwinner H3 System-on-Chip
      hw/arm: add Xunlong Orange Pi PC machine
      hw/arm/allwinner-h3: add Clock Control Unit
      hw/arm/allwinner-h3: add USB host controller
      hw/arm/allwinner-h3: add System Control module
      hw/arm/allwinner: add CPU Configuration module
      hw/arm/allwinner: add Security Identifier device
      hw/arm/allwinner: add SD/MMC host controller
      hw/arm/allwinner-h3: add EMAC ethernet device
      hw/arm/allwinner-h3: add Boot ROM support
      hw/arm/allwinner-h3: add SDRAM controller device
      hw/arm/allwinner: add RTC device support
      docs: add Orange Pi PC document

Peter Maydell (4):
      hw/intc/armv7m_nvic: Rebuild hflags on reset
      target/arm: Update hflags in trans_CPS_v7m()
      target/arm: Recalculate hflags correctly after writes to CONTROL
      target/arm: Fix some comment typos

Philippe Mathieu-Daudé (5):
      tests/boot_linux_console: Add a quick test for the OrangePi PC board
      tests/boot_linux_console: Add initrd test for the Orange Pi PC board
      tests/boot_linux_console: Add a SD card test for the OrangePi PC board
      tests/boot_linux_console: Add a SLOW test booting Ubuntu on OrangePi PC
      tests/boot_linux_console: Test booting NetBSD via U-Boot on OrangePi PC

Richard Henderson (2):
      target/arm: Check addresses for disabled regimes
      target/arm: Disable clean_data_tbi for system mode

Makefile.objs                          |   1 +
 hw/arm/Makefile.objs                   |   1 +
 hw/misc/Makefile.objs                  |   5 +
 hw/net/Makefile.objs                   |   1 +
 hw/rtc/Makefile.objs                   |   1 +
 hw/sd/Makefile.objs                    |   1 +
 hw/usb/hcd-ehci.h                      |   1 +
 include/hw/arm/allwinner-a10.h         |   4 +
 include/hw/arm/allwinner-h3.h          | 161 ++++++
 include/hw/arm/fsl-imx25.h             |  18 +
 include/hw/arm/virt.h                  |  12 +-
 include/hw/misc/allwinner-cpucfg.h     |  52 ++
 include/hw/misc/allwinner-h3-ccu.h     |  66 +++
 include/hw/misc/allwinner-h3-dramc.h   | 106 ++++
 include/hw/misc/allwinner-h3-sysctrl.h |  67 +++
 include/hw/misc/allwinner-sid.h        |  60 +++
 include/hw/net/allwinner-sun8i-emac.h  |  99 ++++
 include/hw/rtc/allwinner-rtc.h         | 134 +++++
 include/hw/sd/allwinner-sdhost.h       | 135 +++++
 target/arm/helper.h                    |   1 +
 target/arm/kvm_arm.h                   |   3 +
 hw/arm/allwinner-a10.c                 |  19 +
 hw/arm/allwinner-h3.c                  | 465 ++++++++++++++++++
 hw/arm/cubieboard.c                    |  18 +
 hw/arm/fsl-imx25.c                     |  56 +++
 hw/arm/imx25_pdk.c                     |  16 +
 hw/arm/orangepi.c                      | 130 +++++
 hw/arm/virt.c                          | 145 ++++--
 hw/intc/armv7m_nvic.c                  |   6 +
 hw/misc/allwinner-cpucfg.c             | 282 +++++++++++
 hw/misc/allwinner-h3-ccu.c             | 242 +++++++++
 hw/misc/allwinner-h3-dramc.c           | 358 ++++++++++++++
 hw/misc/allwinner-h3-sysctrl.c         | 140 ++++++
 hw/misc/allwinner-sid.c                | 168 +++++++
 hw/net/allwinner-sun8i-emac.c          | 871 +++++++++++++++++++++++++++++++++
 hw/rtc/allwinner-rtc.c                 | 411 ++++++++++++++++
 hw/sd/allwinner-sdhost.c               | 854 ++++++++++++++++++++++++++++++++
 hw/ssi/aspeed_smc.c                    |  56 ++-
 hw/usb/hcd-ehci-sysbus.c               |  17 +
 target/arm/helper.c                    |  49 +-
 target/arm/kvm.c                       |  14 +-
 target/arm/kvm32.c                     |  15 +-
 target/arm/kvm64.c                     |  15 +-
 target/arm/translate-a64.c             |  11 +
 target/arm/translate.c                 |  14 +-
 MAINTAINERS                            |   9 +
 default-configs/arm-softmmu.mak        |   1 +
 docs/system/arm/orangepi.rst           | 253 ++++++++++
 docs/system/target-arm.rst             |   2 +
 hw/arm/Kconfig                         |  12 +
 hw/misc/trace-events                   |  19 +
 hw/net/Kconfig                         |   3 +
 hw/net/trace-events                    |  10 +
 hw/rtc/trace-events                    |   4 +
 hw/sd/trace-events                     |   7 +
 hw/ssi/trace-events                    |  10 +
 tests/acceptance/boot_linux_console.py | 230 +++++++++
 57 files changed, 5787 insertions(+), 74 deletions(-)
 create mode 100644 include/hw/arm/allwinner-h3.h
 create mode 100644 include/hw/misc/allwinner-cpucfg.h
 create mode 100644 include/hw/misc/allwinner-h3-ccu.h
 create mode 100644 include/hw/misc/allwinner-h3-dramc.h
 create mode 100644 include/hw/misc/allwinner-h3-sysctrl.h
 create mode 100644 include/hw/misc/allwinner-sid.h
 create mode 100644 include/hw/net/allwinner-sun8i-emac.h
 create mode 100644 include/hw/rtc/allwinner-rtc.h
 create mode 100644 include/hw/sd/allwinner-sdhost.h
 create mode 100644 hw/arm/allwinner-h3.c
 create mode 100644 hw/arm/orangepi.c
 create mode 100644 hw/misc/allwinner-cpucfg.c
 create mode 100644 hw/misc/allwinner-h3-ccu.c
 create mode 100644 hw/misc/allwinner-h3-dramc.c
 create mode 100644 hw/misc/allwinner-h3-sysctrl.c
 create mode 100644 hw/misc/allwinner-sid.c
 create mode 100644 hw/net/allwinner-sun8i-emac.c
 create mode 100644 hw/rtc/allwinner-rtc.c
 create mode 100644 hw/sd/allwinner-sdhost.c
 create mode 100644 docs/system/arm/orangepi.rst
 create mode 100644 hw/ssi/trace-events

Some of an M-profile CPU's cached hflags state depends on state that's
in our NVIC object. We already do an hflags rebuild when the NVIC
registers are written, but we also need to do this on NVIC reset,
because there's no guarantee that this will happen before the
CPU reset.

This fixes an assertion due to mismatched hflags which happens if
the CPU is reset from inside a HardFault handler.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200303174950.3298-2-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
             s->itns[i] = true;
         }
     }
+
+    /*
+     * We updated state that affects the CPU's MMUidx and thus its hflags;
+     * and we can't guarantee that we run before the CPU reset function.
+     */
+    arm_rebuild_hflags(&s->cpu->env);
 }
 
 static void nvic_systick_trigger(void *opaque, int n, int level)
-- 
2.20.1

For M-profile CPUs, the FAULTMASK value affects the CPU's MMU index
(it changes the NegPri bit). We update the hflags after calls
to the v7m_msr helper in trans_MSR_v7m() but forgot to do so
in trans_CPS_v7m().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200303174950.3298-3-peter.maydell@linaro.org
---
 target/arm/translate.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_CPS(DisasContext *s, arg_CPS *a)
 
 static bool trans_CPS_v7m(DisasContext *s, arg_CPS_v7m *a)
 {
-    TCGv_i32 tmp, addr;
+    TCGv_i32 tmp, addr, el;
 
     if (!arm_dc_feature(s, ARM_FEATURE_M)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_CPS_v7m(DisasContext *s, arg_CPS_v7m *a)
         gen_helper_v7m_msr(cpu_env, addr, tmp);
         tcg_temp_free_i32(addr);
     }
+    el = tcg_const_i32(s->current_el);
+    gen_helper_rebuild_hflags_m32(cpu_env, el);
+    tcg_temp_free_i32(el);
     tcg_temp_free_i32(tmp);
     gen_lookup_tb(s);
     return true;
-- 
2.20.1

A write to the CONTROL register can change our current EL (by
writing to the nPRIV bit). That means that we can't assume
that s->current_el is still valid in trans_MSR_v7m() when
we try to rebuild the hflags.

Add a new helper rebuild_hflags_m32_newel() which, like the
existing rebuild_hflags_a32_newel(), recalculates the current
EL from scratch, and use it in trans_MSR_v7m().

This fixes an assertion about an hflags mismatch when the
guest changes privilege by writing to CONTROL.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200303174950.3298-4-peter.maydell@linaro.org
---
 target/arm/helper.h    |  1 +
 target/arm/helper.c    | 12 ++++++++++++
 target/arm/translate.c |  7 +++----
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(msr_banked, void, env, i32, i32, i32)
 DEF_HELPER_2(get_user_reg, i32, env, i32)
 DEF_HELPER_3(set_user_reg, void, env, i32, i32)
 
+DEF_HELPER_FLAGS_1(rebuild_hflags_m32_newel, TCG_CALL_NO_RWG, void, env)
 DEF_HELPER_FLAGS_2(rebuild_hflags_m32, TCG_CALL_NO_RWG, void, env, int)
 DEF_HELPER_FLAGS_1(rebuild_hflags_a32_newel, TCG_CALL_NO_RWG, void, env)
 DEF_HELPER_FLAGS_2(rebuild_hflags_a32, TCG_CALL_NO_RWG, void, env, int)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_rebuild_hflags(CPUARMState *env)
     env->hflags = rebuild_hflags_internal(env);
 }
 
+/*
+ * If we have triggered a EL state change we can't rely on the
+ * translator having passed it to us, we need to recompute.
+ */
+void HELPER(rebuild_hflags_m32_newel)(CPUARMState *env)
+{
+    int el = arm_current_el(env);
+    int fp_el = fp_exception_el(env, el);
+    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
+    env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
+}
+
 void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
 {
     int fp_el = fp_exception_el(env, el);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_MRS_v7m(DisasContext *s, arg_MRS_v7m *a)
 
 static bool trans_MSR_v7m(DisasContext *s, arg_MSR_v7m *a)
 {
-    TCGv_i32 addr, reg, el;
+    TCGv_i32 addr, reg;
 
     if (!arm_dc_feature(s, ARM_FEATURE_M)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_MSR_v7m(DisasContext *s, arg_MSR_v7m *a)
     gen_helper_v7m_msr(cpu_env, addr, reg);
     tcg_temp_free_i32(addr);
     tcg_temp_free_i32(reg);
-    el = tcg_const_i32(s->current_el);
-    gen_helper_rebuild_hflags_m32(cpu_env, el);
-    tcg_temp_free_i32(el);
+    /* If we wrote to CONTROL, the EL might have changed */
+    gen_helper_rebuild_hflags_m32_newel(cpu_env);
     gen_lookup_tb(s);
     return true;
 }
-- 
2.20.1

Fix a couple of comment typos.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200303174950.3298-5-peter.maydell@linaro.org
---
 target/arm/helper.c    | 2 +-
 target/arm/translate.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
 
 /*
  * If we have triggered a EL state change we can't rely on the
- * translator having passed it too us, we need to recompute.
+ * translator having passed it to us, we need to recompute.
  */
 void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env)
 {
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
 
         if (!isread && !(ri->type & ARM_CP_SUPPRESS_TB_END)) {
             /*
-             * A write to any coprocessor regiser that ends a TB
+             * A write to any coprocessor register that ends a TB
              * must rebuild the hflags for the next TB.
              */
             TCGv_i32 tcg_el = tcg_const_i32(s->current_el);
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200206112645.21275-2-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 Makefile.objs       |  1 +
 hw/ssi/aspeed_smc.c | 17 +++++++++++++++++
 hw/ssi/trace-events |  9 +++++++++
 3 files changed, 27 insertions(+)
 create mode 100644 hw/ssi/trace-events

diff --git a/Makefile.objs b/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -XXX,XX +XXX,XX @@ trace-events-subdirs += hw/scsi
 trace-events-subdirs += hw/sd
 trace-events-subdirs += hw/sparc
 trace-events-subdirs += hw/sparc64
+trace-events-subdirs += hw/ssi
 trace-events-subdirs += hw/timer
 trace-events-subdirs += hw/tpm
 trace-events-subdirs += hw/usb
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "exec/address-spaces.h"
 #include "qemu/units.h"
+#include "trace.h"
 
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_set_segment(AspeedSMCState *s, int cs,
 
     s->ctrl->reg_to_segment(s, new, &seg);
 
+    trace_aspeed_smc_flash_set_segment(cs, new, seg.addr, seg.addr + seg.size);
+
     /* The start address of CS0 is read-only */
     if (cs == 0 && seg.addr != s->ctrl->flash_window_base) {
         qemu_log_mask(LOG_GUEST_ERROR,
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
                       __func__, aspeed_smc_flash_mode(fl));
     }
 
+    trace_aspeed_smc_flash_read(fl->id, addr, size, ret,
+                                aspeed_smc_flash_mode(fl));
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool aspeed_smc_do_snoop(AspeedSMCFlash *fl,  uint64_t data,
     AspeedSMCState *s = fl->controller;
     uint8_t addr_width = aspeed_smc_flash_is_4byte(fl) ? 4 : 3;
 
+    trace_aspeed_smc_do_snoop(fl->id, s->snoop_index, s->snoop_dummies,
+                              (uint8_t) data & 0xff);
+
     if (s->snoop_index == SNOOP_OFF) {
         return false; /* Do nothing */
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
     AspeedSMCState *s = fl->controller;
     int i;
 
+    trace_aspeed_smc_flash_write(fl->id, addr, size, data,
+                                 aspeed_smc_flash_mode(fl));
+
     if (!aspeed_smc_is_writable(fl)) {
         qemu_log_mask(LOG_GUEST_ERROR, "%s: flash is not writable at 0x%"
                       HWADDR_PRIx "\n", __func__, addr);
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
         (s->ctrl->has_dma && addr == R_DMA_CHECKSUM) ||
         (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) ||
         (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->ctrl->max_slaves)) {
+
+        trace_aspeed_smc_read(addr, size, s->regs[addr]);
+
         return s->regs[addr];
     } else {
         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_checksum(AspeedSMCState *s)
                           __func__, s->regs[R_DMA_FLASH_ADDR]);
             return;
         }
+        trace_aspeed_smc_dma_checksum(s->regs[R_DMA_FLASH_ADDR], data);
 
         /*
          * When the DMA is on-going, the DMA registers are updated
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
 
     addr >>= 2;
 
+    trace_aspeed_smc_write(addr, size, data);
+
     if (addr == s->r_conf ||
         (addr >= s->r_timings &&
          addr < s->r_timings + s->ctrl->nregs_timings) ||
diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/ssi/trace-events
@@ -XXX,XX +XXX,XX @@
+# aspeed_smc.c
+
+aspeed_smc_flash_set_segment(int cs, uint64_t reg, uint64_t start, uint64_t end) "CS%d segreg=0x%"PRIx64" [ 0x%"PRIx64" - 0x%"PRIx64" ]"
+aspeed_smc_flash_read(int cs, uint64_t addr,  uint32_t size, uint64_t data, int mode) "CS%d @0x%" PRIx64 " size %u: 0x%" PRIx64" mode:%d"
+aspeed_smc_do_snoop(int cs, int index, int dummies, int data) "CS%d index:0x%x dummies:%d data:0x%x"
+aspeed_smc_flash_write(int cs, uint64_t addr,  uint32_t size, uint64_t data, int mode) "CS%d @0x%" PRIx64 " size %u: 0x%" PRIx64" mode:%d"
+aspeed_smc_read(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
+aspeed_smc_dma_checksum(uint32_t addr, uint32_t data) "0x%08x: 0x%08x"
+aspeed_smc_write(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

The Aspeed SMC Controller can operate in different modes : Read, Fast
Read, Write and User modes. When the User mode is configured, it
selects automatically the SPI slave device until the CE_STOP_ACTIVE
bit is set to 1. When any other modes are configured the device is
unselected. The HW logic handles the chip select automatically when
the flash is accessed through its AHB window.

When configuring the CEx Control Register, the User mode logic to
select and unselect the slave is incorrect and data corruption can be
seen on machines using two chips, witherspoon and romulus.

Rework the handler setting the CEx Control Register to fix this issue.

Fixes: 7c1c69bca43c ("ast2400: add SMC controllers (FMC and SPI)")
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 20200206112645.21275-3-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/aspeed_smc.c | 39 +++++++++++++++++++++++----------------
 hw/ssi/trace-events |  1 +
 2 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static inline int aspeed_smc_flash_is_4byte(const AspeedSMCFlash *fl)
     }
 }
 
-static inline bool aspeed_smc_is_ce_stop_active(const AspeedSMCFlash *fl)
+static void aspeed_smc_flash_do_select(AspeedSMCFlash *fl, bool unselect)
 {
-    const AspeedSMCState *s = fl->controller;
+    AspeedSMCState *s = fl->controller;
 
-    return s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE;
+    trace_aspeed_smc_flash_select(fl->id, unselect ? "un" : "");
+
+    qemu_set_irq(s->cs_lines[fl->id], unselect);
 }
 
 static void aspeed_smc_flash_select(AspeedSMCFlash *fl)
 {
-    AspeedSMCState *s = fl->controller;
-
-    s->regs[s->r_ctrl0 + fl->id] &= ~CTRL_CE_STOP_ACTIVE;
-    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
+    aspeed_smc_flash_do_select(fl, false);
 }
 
 static void aspeed_smc_flash_unselect(AspeedSMCFlash *fl)
 {
-    AspeedSMCState *s = fl->controller;
-
-    s->regs[s->r_ctrl0 + fl->id] |= CTRL_CE_STOP_ACTIVE;
-    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
+    aspeed_smc_flash_do_select(fl, true);
 }
 
 static uint32_t aspeed_smc_check_segment_addr(const AspeedSMCFlash *fl,
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_smc_flash_ops = {
     },
 };
 
-static void aspeed_smc_flash_update_cs(AspeedSMCFlash *fl)
+static void aspeed_smc_flash_update_ctrl(AspeedSMCFlash *fl, uint32_t value)
 {
     AspeedSMCState *s = fl->controller;
+    bool unselect;
 
-    s->snoop_index = aspeed_smc_is_ce_stop_active(fl) ? SNOOP_OFF : SNOOP_START;
+    /* User mode selects the CS, other modes unselect */
+    unselect = (value & CTRL_CMD_MODE_MASK) != CTRL_USERMODE;
 
-    qemu_set_irq(s->cs_lines[fl->id], aspeed_smc_is_ce_stop_active(fl));
+    /* A change of CTRL_CE_STOP_ACTIVE from 0 to 1, unselects the CS */
+    if (!(s->regs[s->r_ctrl0 + fl->id] & CTRL_CE_STOP_ACTIVE) &&
+        value & CTRL_CE_STOP_ACTIVE) {
+        unselect = true;
+    }
+
+    s->regs[s->r_ctrl0 + fl->id] = value;
+
+    s->snoop_index = unselect ? SNOOP_OFF : SNOOP_START;
+
+    aspeed_smc_flash_do_select(fl, unselect);
 }
 
 static void aspeed_smc_reset(DeviceState *d)
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
         s->regs[addr] = value;
     } else if (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->num_cs) {
         int cs = addr - s->r_ctrl0;
-        s->regs[addr] = value;
-        aspeed_smc_flash_update_cs(&s->flashes[cs]);
+        aspeed_smc_flash_update_ctrl(&s->flashes[cs], value);
     } else if (addr >= R_SEG_ADDR0 &&
                addr < R_SEG_ADDR0 + s->ctrl->max_slaves) {
         int cs = addr - R_SEG_ADDR0;
diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/trace-events
+++ b/hw/ssi/trace-events
@@ -XXX,XX +XXX,XX @@ aspeed_smc_flash_write(int cs, uint64_t addr,  uint32_t size, uint64_t data, int
 aspeed_smc_read(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
 aspeed_smc_dma_checksum(uint32_t addr, uint32_t data) "0x%08x: 0x%08x"
 aspeed_smc_write(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
+aspeed_smc_flash_select(int cs, const char *prefix) "CS%d %sselect"
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

We fail to validate the upper bits of a virtual address on a
translation disabled regime, as per AArch64.TranslateAddressS1Off.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200308012946.16303-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 35 ++++++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
     /* Definitely a real MMU, not an MPU */
 
     if (regime_translation_disabled(env, mmu_idx)) {
-        /* MMU disabled. */
+        /*
+         * MMU disabled.  S1 addresses within aa64 translation regimes are
+         * still checked for bounds -- see AArch64.TranslateAddressS1Off.
+         */
+        if (mmu_idx != ARMMMUIdx_Stage2) {
+            int r_el = regime_el(env, mmu_idx);
+            if (arm_el_is_aa64(env, r_el)) {
+                int pamax = arm_pamax(env_archcpu(env));
+                uint64_t tcr = env->cp15.tcr_el[r_el].raw_tcr;
+                int addrtop, tbi;
+
+                tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
+                if (access_type == MMU_INST_FETCH) {
+                    tbi &= ~aa64_va_parameter_tbid(tcr, mmu_idx);
+                }
+                tbi = (tbi >> extract64(address, 55, 1)) & 1;
+                addrtop = (tbi ? 55 : 63);
+
+                if (extract64(address, pamax, addrtop - pamax + 1) != 0) {
+                    fi->type = ARMFault_AddressSize;
+                    fi->level = 0;
+                    fi->stage2 = false;
+                    return 1;
+                }
+
+                /*
+                 * When TBI is disabled, we've just validated that all of the
+                 * bits above PAMax are zero, so logically we only need to
+                 * clear the top byte for TBI.  But it's clearer to follow
+                 * the pseudocode set of addrdesc.paddress.
+                 */
+                address = extract64(address, 0, 52);
+            }
+        }
         *phys_ptr = address;
         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
         *page_size = TARGET_PAGE_SIZE;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

We must include the tag in the FAR_ELx register when raising
an addressing exception.  Which means that we should not clear
out the tag during translation.

We cannot at present comply with this for user mode, so we
retain the clean_data_tbi function for the moment, though it
no longer does what it says on the tin for system mode.  This
function is to be replaced with MTE, so don't worry about the
slight misnaming.

Buglink: https://bugs.launchpad.net/qemu/+bug/1867072
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200308012946.16303-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_a64_set_pc(DisasContext *s, TCGv_i64 src)
 static TCGv_i64 clean_data_tbi(DisasContext *s, TCGv_i64 addr)
 {
     TCGv_i64 clean = new_tmp_a64(s);
+    /*
+     * In order to get the correct value in the FAR_ELx register,
+     * we must present the memory subsystem with the "dirty" address
+     * including the TBI.  In system mode we can make this work via
+     * the TLB, dropping the TBI during translation.  But for user-only
+     * mode we don't have that option, and must remove the top byte now.
+     */
+#ifdef CONFIG_USER_ONLY
     gen_top_byte_ignore(s, clean, addr, s->tbid);
+#else
+    tcg_gen_mov_i64(clean, addr);
+#endif
     return clean;
 }
 
-- 
2.20.1

From: Igor Mammedov <imammedo@redhat.com>

SOC object returned by object_new() is leaked in current code.
Set SOC parent explicitly to board and then unref to SOC object
to make sure that refererence returned by object_new() is taken
care of.

The SOC object will be kept alive by its parent (machine) and
will be automatically freed when MachineState is destroyed.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reported-by: Andrew Jones <drjones@redhat.com>
Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Message-id: 20200303091254.22373-1-imammedo@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/cubieboard.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/arm/cubieboard.c b/hw/arm/cubieboard.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/cubieboard.c
+++ b/hw/arm/cubieboard.c
@@ -XXX,XX +XXX,XX @@ static void cubieboard_init(MachineState *machine)
     }
 
     a10 = AW_A10(object_new(TYPE_AW_A10));
+    object_property_add_child(OBJECT(machine), "soc", OBJECT(a10),
+                              &error_abort);
+    object_unref(OBJECT(a10));
 
     object_property_set_int(OBJECT(&a10->emac), 1, "phy-addr", &err);
     if (err != NULL) {
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Wire up eSDHC controllers in fsl-imx25. For imx25-pdk, connect drives
provided on the command line to available eSDHC controllers.

This patch enables booting the imx25-pdk emulation from SD card.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200310215146.19688-2-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: made commit subject consistent with other patch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx25.h |  9 +++++++++
 hw/arm/fsl-imx25.c         | 32 ++++++++++++++++++++++++++++++++
 hw/arm/imx25_pdk.c         | 16 ++++++++++++++++
 3 files changed, 57 insertions(+)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/imx_rngc.h"
 #include "hw/i2c/imx_i2c.h"
 #include "hw/gpio/imx_gpio.h"
+#include "hw/sd/sdhci.h"
 #include "exec/memory.h"
 #include "target/arm/cpu.h"
 
@@ -XXX,XX +XXX,XX @@
 #define FSL_IMX25_NUM_EPITS 2
 #define FSL_IMX25_NUM_I2CS 3
 #define FSL_IMX25_NUM_GPIOS 4
+#define FSL_IMX25_NUM_ESDHCS 2
 
 typedef struct FslIMX25State {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
     IMXRNGCState   rngc;
     IMXI2CState    i2c[FSL_IMX25_NUM_I2CS];
     IMXGPIOState   gpio[FSL_IMX25_NUM_GPIOS];
+    SDHCIState     esdhc[FSL_IMX25_NUM_ESDHCS];
     MemoryRegion   rom[2];
     MemoryRegion   iram;
     MemoryRegion   iram_alias;
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
 #define FSL_IMX25_GPIO3_SIZE    0x4000
 #define FSL_IMX25_RNGC_ADDR     0x53FB0000
 #define FSL_IMX25_RNGC_SIZE     0x4000
+#define FSL_IMX25_ESDHC1_ADDR   0x53FB4000
+#define FSL_IMX25_ESDHC1_SIZE   0x4000
+#define FSL_IMX25_ESDHC2_ADDR   0x53FB8000
+#define FSL_IMX25_ESDHC2_SIZE   0x4000
 #define FSL_IMX25_GPIO1_ADDR    0x53FCC000
 #define FSL_IMX25_GPIO1_SIZE    0x4000
 #define FSL_IMX25_GPIO2_ADDR    0x53FD0000
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
 #define FSL_IMX25_GPIO2_IRQ     51
 #define FSL_IMX25_GPIO3_IRQ     16
 #define FSL_IMX25_GPIO4_IRQ     23
+#define FSL_IMX25_ESDHC1_IRQ    9
+#define FSL_IMX25_ESDHC2_IRQ    8
 
 #endif /* FSL_IMX25_H */
diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "chardev/char.h"
 
+#define IMX25_ESDHC_CAPABILITIES     0x07e20000
+
 static void fsl_imx25_init(Object *obj)
 {
     FslIMX25State *s = FSL_IMX25(obj);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_init(Object *obj)
         sysbus_init_child_obj(obj, "gpio[*]", &s->gpio[i], sizeof(s->gpio[i]),
                               TYPE_IMX_GPIO);
     }
+
+    for (i = 0; i < FSL_IMX25_NUM_ESDHCS; i++) {
+        sysbus_init_child_obj(obj, "sdhc[*]", &s->esdhc[i], sizeof(s->esdhc[i]),
+                              TYPE_IMX_USDHC);
+    }
 }
 
 static void fsl_imx25_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
                                             gpio_table[i].irq));
     }
 
+    /* Initialize all SDHC */
+    for (i = 0; i < FSL_IMX25_NUM_ESDHCS; i++) {
+        static const struct {
+            hwaddr addr;
+            unsigned int irq;
+        } esdhc_table[FSL_IMX25_NUM_ESDHCS] = {
+            { FSL_IMX25_ESDHC1_ADDR, FSL_IMX25_ESDHC1_IRQ },
+            { FSL_IMX25_ESDHC2_ADDR, FSL_IMX25_ESDHC2_IRQ },
+        };
+
+        object_property_set_uint(OBJECT(&s->esdhc[i]), 2, "sd-spec-version",
+                                 &err);
+        object_property_set_uint(OBJECT(&s->esdhc[i]), IMX25_ESDHC_CAPABILITIES,
+                                 "capareg", &err);
+        object_property_set_bool(OBJECT(&s->esdhc[i]), true, "realized", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->esdhc[i]), 0, esdhc_table[i].addr);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->esdhc[i]), 0,
+                           qdev_get_gpio_in(DEVICE(&s->avic),
+                                            esdhc_table[i].irq));
+    }
+
     /* initialize 2 x 16 KB ROM */
     memory_region_init_rom(&s->rom[0], NULL,
                            "imx25.rom0", FSL_IMX25_ROM0_SIZE, &err);
diff --git a/hw/arm/imx25_pdk.c b/hw/arm/imx25_pdk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/imx25_pdk.c
+++ b/hw/arm/imx25_pdk.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "cpu.h"
+#include "hw/qdev-properties.h"
 #include "hw/arm/fsl-imx25.h"
 #include "hw/boards.h"
 #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static void imx25_pdk_init(MachineState *machine)
     imx25_pdk_binfo.board_id = 1771,
     imx25_pdk_binfo.nb_cpus = 1;
 
+    for (i = 0; i < FSL_IMX25_NUM_ESDHCS; i++) {
+        BusState *bus;
+        DeviceState *carddev;
+        DriveInfo *di;
+        BlockBackend *blk;
+
+        di = drive_get_next(IF_SD);
+        blk = di ? blk_by_legacy_dinfo(di) : NULL;
+        bus = qdev_get_child_bus(DEVICE(&s->soc.esdhc[i]), "sd-bus");
+        carddev = qdev_create(bus, TYPE_SD_CARD);
+        qdev_prop_set_drive(carddev, "drive", blk, &error_fatal);
+        object_property_set_bool(OBJECT(carddev), true,
+                                 "realized", &error_fatal);
+    }
+
     /*
      * We test explicitly for qtest here as it is not done (yet?) in
      * arm_load_kernel(). Without this the "make check" command would
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

i.MX25 supports two USB controllers. Let's wire them up.

With this patch, imx25-pdk can boot from both USB ports.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200310215146.19688-3-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx25.h |  9 +++++++++
 hw/arm/fsl-imx25.c         | 24 ++++++++++++++++++++++++
 2 files changed, 33 insertions(+)

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The Allwinner H3 is a System on Chip containing four ARM Cortex A7
processor cores. Features and specifications include DDR2/DDR3 memory,
SD/MMC storage cards, 10/100/1000Mbit Ethernet, USB 2.0, HDMI and
various I/O modules. This commit adds support for the Allwinner H3
System on Chip.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200311221854.30370-2-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs            |   1 +
 include/hw/arm/allwinner-h3.h   | 106 +++++++++++
 hw/arm/allwinner-h3.c           | 327 ++++++++++++++++++++++++++++++++
 MAINTAINERS                     |   7 +
 default-configs/arm-softmmu.mak |   1 +
 hw/arm/Kconfig                  |   8 +
 6 files changed, 450 insertions(+)
 create mode 100644 include/hw/arm/allwinner-h3.h
 create mode 100644 hw/arm/allwinner-h3.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_DIGIC) += digic.o
 obj-$(CONFIG_OMAP) += omap1.o omap2.o
 obj-$(CONFIG_STRONGARM) += strongarm.o
 obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
+obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
 obj-$(CONFIG_STM32F405_SOC) += stm32f405_soc.o
diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner H3 System on Chip emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/*
+ * The Allwinner H3 is a System on Chip containing four ARM Cortex A7
+ * processor cores. Features and specifications include DDR2/DDR3 memory,
+ * SD/MMC storage cards, 10/100/1000Mbit Ethernet, USB 2.0, HDMI and
+ * various I/O modules.
+ *
+ * This implementation is based on the following datasheet:
+ *
+ *   https://linux-sunxi.org/File:Allwinner_H3_Datasheet_V1.2.pdf
+ *
+ * The latest datasheet and more info can be found on the Linux Sunxi wiki:
+ *
+ *   https://linux-sunxi.org/H3
+ */
+
+#ifndef HW_ARM_ALLWINNER_H3_H
+#define HW_ARM_ALLWINNER_H3_H
+
+#include "qom/object.h"
+#include "hw/arm/boot.h"
+#include "hw/timer/allwinner-a10-pit.h"
+#include "hw/intc/arm_gic.h"
+#include "target/arm/cpu.h"
+
+/**
+ * Allwinner H3 device list
+ *
+ * This enumeration is can be used refer to a particular device in the
+ * Allwinner H3 SoC. For example, the physical memory base address for
+ * each device can be found in the AwH3State object in the memmap member
+ * using the device enum value as index.
+ *
+ * @see AwH3State
+ */
+enum {
+    AW_H3_SRAM_A1,
+    AW_H3_SRAM_A2,
+    AW_H3_SRAM_C,
+    AW_H3_PIT,
+    AW_H3_UART0,
+    AW_H3_UART1,
+    AW_H3_UART2,
+    AW_H3_UART3,
+    AW_H3_GIC_DIST,
+    AW_H3_GIC_CPU,
+    AW_H3_GIC_HYP,
+    AW_H3_GIC_VCPU,
+    AW_H3_SDRAM
+};
+
+/** Total number of CPU cores in the H3 SoC */
+#define AW_H3_NUM_CPUS      (4)
+
+/**
+ * Allwinner H3 object model
+ * @{
+ */
+
+/** Object type for the Allwinner H3 SoC */
+#define TYPE_AW_H3 "allwinner-h3"
+
+/** Convert input object to Allwinner H3 state object */
+#define AW_H3(obj) OBJECT_CHECK(AwH3State, (obj), TYPE_AW_H3)
+
+/** @} */
+
+/**
+ * Allwinner H3 object
+ *
+ * This struct contains the state of all the devices
+ * which are currently emulated by the H3 SoC code.
+ */
+typedef struct AwH3State {
+    /*< private >*/
+    DeviceState parent_obj;
+    /*< public >*/
+
+    ARMCPU cpus[AW_H3_NUM_CPUS];
+    const hwaddr *memmap;
+    AwA10PITState timer;
+    GICState gic;
+    MemoryRegion sram_a1;
+    MemoryRegion sram_a2;
+    MemoryRegion sram_c;
+} AwH3State;
+
+#endif /* HW_ARM_ALLWINNER_H3_H */
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner H3 System on Chip emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "exec/address-spaces.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "qemu/module.h"
+#include "qemu/units.h"
+#include "hw/qdev-core.h"
+#include "cpu.h"
+#include "hw/sysbus.h"
+#include "hw/char/serial.h"
+#include "hw/misc/unimp.h"
+#include "sysemu/sysemu.h"
+#include "hw/arm/allwinner-h3.h"
+
+/* Memory map */
+const hwaddr allwinner_h3_memmap[] = {
+    [AW_H3_SRAM_A1]    = 0x00000000,
+    [AW_H3_SRAM_A2]    = 0x00044000,
+    [AW_H3_SRAM_C]     = 0x00010000,
+    [AW_H3_PIT]        = 0x01c20c00,
+    [AW_H3_UART0]      = 0x01c28000,
+    [AW_H3_UART1]      = 0x01c28400,
+    [AW_H3_UART2]      = 0x01c28800,
+    [AW_H3_UART3]      = 0x01c28c00,
+    [AW_H3_GIC_DIST]   = 0x01c81000,
+    [AW_H3_GIC_CPU]    = 0x01c82000,
+    [AW_H3_GIC_HYP]    = 0x01c84000,
+    [AW_H3_GIC_VCPU]   = 0x01c86000,
+    [AW_H3_SDRAM]      = 0x40000000
+};
+
+/* List of unimplemented devices */
+struct AwH3Unimplemented {
+    const char *device_name;
+    hwaddr base;
+    hwaddr size;
+} unimplemented[] = {
+    { "d-engine",  0x01000000, 4 * MiB },
+    { "d-inter",   0x01400000, 128 * KiB },
+    { "syscon",    0x01c00000, 4 * KiB },
+    { "dma",       0x01c02000, 4 * KiB },
+    { "nfdc",      0x01c03000, 4 * KiB },
+    { "ts",        0x01c06000, 4 * KiB },
+    { "keymem",    0x01c0b000, 4 * KiB },
+    { "lcd0",      0x01c0c000, 4 * KiB },
+    { "lcd1",      0x01c0d000, 4 * KiB },
+    { "ve",        0x01c0e000, 4 * KiB },
+    { "mmc0",      0x01c0f000, 4 * KiB },
+    { "mmc1",      0x01c10000, 4 * KiB },
+    { "mmc2",      0x01c11000, 4 * KiB },
+    { "sid",       0x01c14000, 1 * KiB },
+    { "crypto",    0x01c15000, 4 * KiB },
+    { "msgbox",    0x01c17000, 4 * KiB },
+    { "spinlock",  0x01c18000, 4 * KiB },
+    { "usb0-otg",  0x01c19000, 4 * KiB },
+    { "usb0-phy",  0x01c1a000, 4 * KiB },
+    { "usb1-phy",  0x01c1b000, 4 * KiB },
+    { "usb2-phy",  0x01c1c000, 4 * KiB },
+    { "usb3-phy",  0x01c1d000, 4 * KiB },
+    { "smc",       0x01c1e000, 4 * KiB },
+    { "ccu",       0x01c20000, 1 * KiB },
+    { "pio",       0x01c20800, 1 * KiB },
+    { "owa",       0x01c21000, 1 * KiB },
+    { "pwm",       0x01c21400, 1 * KiB },
+    { "keyadc",    0x01c21800, 1 * KiB },
+    { "pcm0",      0x01c22000, 1 * KiB },
+    { "pcm1",      0x01c22400, 1 * KiB },
+    { "pcm2",      0x01c22800, 1 * KiB },
+    { "audio",     0x01c22c00, 2 * KiB },
+    { "smta",      0x01c23400, 1 * KiB },
+    { "ths",       0x01c25000, 1 * KiB },
+    { "uart0",     0x01c28000, 1 * KiB },
+    { "uart1",     0x01c28400, 1 * KiB },
+    { "uart2",     0x01c28800, 1 * KiB },
+    { "uart3",     0x01c28c00, 1 * KiB },
+    { "twi0",      0x01c2ac00, 1 * KiB },
+    { "twi1",      0x01c2b000, 1 * KiB },
+    { "twi2",      0x01c2b400, 1 * KiB },
+    { "scr",       0x01c2c400, 1 * KiB },
+    { "emac",      0x01c30000, 64 * KiB },
+    { "gpu",       0x01c40000, 64 * KiB },
+    { "hstmr",     0x01c60000, 4 * KiB },
+    { "dramcom",   0x01c62000, 4 * KiB },
+    { "dramctl0",  0x01c63000, 4 * KiB },
+    { "dramphy0",  0x01c65000, 4 * KiB },
+    { "spi0",      0x01c68000, 4 * KiB },
+    { "spi1",      0x01c69000, 4 * KiB },
+    { "csi",       0x01cb0000, 320 * KiB },
+    { "tve",       0x01e00000, 64 * KiB },
+    { "hdmi",      0x01ee0000, 128 * KiB },
+    { "rtc",       0x01f00000, 1 * KiB },
+    { "r_timer",   0x01f00800, 1 * KiB },
+    { "r_intc",    0x01f00c00, 1 * KiB },
+    { "r_wdog",    0x01f01000, 1 * KiB },
+    { "r_prcm",    0x01f01400, 1 * KiB },
+    { "r_twd",     0x01f01800, 1 * KiB },
+    { "r_cpucfg",  0x01f01c00, 1 * KiB },
+    { "r_cir-rx",  0x01f02000, 1 * KiB },
+    { "r_twi",     0x01f02400, 1 * KiB },
+    { "r_uart",    0x01f02800, 1 * KiB },
+    { "r_pio",     0x01f02c00, 1 * KiB },
+    { "r_pwm",     0x01f03800, 1 * KiB },
+    { "core-dbg",  0x3f500000, 128 * KiB },
+    { "tsgen-ro",  0x3f506000, 4 * KiB },
+    { "tsgen-ctl", 0x3f507000, 4 * KiB },
+    { "ddr-mem",   0x40000000, 2 * GiB },
+    { "n-brom",    0xffff0000, 32 * KiB },
+    { "s-brom",    0xffff0000, 64 * KiB }
+};
+
+/* Per Processor Interrupts */
+enum {
+    AW_H3_GIC_PPI_MAINT     =  9,
+    AW_H3_GIC_PPI_HYPTIMER  = 10,
+    AW_H3_GIC_PPI_VIRTTIMER = 11,
+    AW_H3_GIC_PPI_SECTIMER  = 13,
+    AW_H3_GIC_PPI_PHYSTIMER = 14
+};
+
+/* Shared Processor Interrupts */
+enum {
+    AW_H3_GIC_SPI_UART0     =  0,
+    AW_H3_GIC_SPI_UART1     =  1,
+    AW_H3_GIC_SPI_UART2     =  2,
+    AW_H3_GIC_SPI_UART3     =  3,
+    AW_H3_GIC_SPI_TIMER0    = 18,
+    AW_H3_GIC_SPI_TIMER1    = 19,
+};
+
+/* Allwinner H3 general constants */
+enum {
+    AW_H3_GIC_NUM_SPI       = 128
+};
+
+static void allwinner_h3_init(Object *obj)
+{
+    AwH3State *s = AW_H3(obj);
+
+    s->memmap = allwinner_h3_memmap;
+
+    for (int i = 0; i < AW_H3_NUM_CPUS; i++) {
+        object_initialize_child(obj, "cpu[*]", &s->cpus[i], sizeof(s->cpus[i]),
+                                ARM_CPU_TYPE_NAME("cortex-a7"),
+                                &error_abort, NULL);
+    }
+
+    sysbus_init_child_obj(obj, "gic", &s->gic, sizeof(s->gic),
+                          TYPE_ARM_GIC);
+
+    sysbus_init_child_obj(obj, "timer", &s->timer, sizeof(s->timer),
+                          TYPE_AW_A10_PIT);
+    object_property_add_alias(obj, "clk0-freq", OBJECT(&s->timer),
+                              "clk0-freq", &error_abort);
+    object_property_add_alias(obj, "clk1-freq", OBJECT(&s->timer),
+                              "clk1-freq", &error_abort);
+}
+
+static void allwinner_h3_realize(DeviceState *dev, Error **errp)
+{
+    AwH3State *s = AW_H3(dev);
+    unsigned i;
+
+    /* CPUs */
+    for (i = 0; i < AW_H3_NUM_CPUS; i++) {
+
+        /* Provide Power State Coordination Interface */
+        qdev_prop_set_int32(DEVICE(&s->cpus[i]), "psci-conduit",
+                            QEMU_PSCI_CONDUIT_HVC);
+
+        /* Disable secondary CPUs */
+        qdev_prop_set_bit(DEVICE(&s->cpus[i]), "start-powered-off",
+                          i > 0);
+
+        /* All exception levels required */
+        qdev_prop_set_bit(DEVICE(&s->cpus[i]), "has_el3", true);
+        qdev_prop_set_bit(DEVICE(&s->cpus[i]), "has_el2", true);
+
+        /* Mark realized */
+        qdev_init_nofail(DEVICE(&s->cpus[i]));
+    }
+
+    /* Generic Interrupt Controller */
+    qdev_prop_set_uint32(DEVICE(&s->gic), "num-irq", AW_H3_GIC_NUM_SPI +
+                                                     GIC_INTERNAL);
+    qdev_prop_set_uint32(DEVICE(&s->gic), "revision", 2);
+    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", AW_H3_NUM_CPUS);
+    qdev_prop_set_bit(DEVICE(&s->gic), "has-security-extensions", false);
+    qdev_prop_set_bit(DEVICE(&s->gic), "has-virtualization-extensions", true);
+    qdev_init_nofail(DEVICE(&s->gic));
+
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 0, s->memmap[AW_H3_GIC_DIST]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 1, s->memmap[AW_H3_GIC_CPU]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 2, s->memmap[AW_H3_GIC_HYP]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 3, s->memmap[AW_H3_GIC_VCPU]);
+
+    /*
+     * Wire the outputs from each CPU's generic timer and the GICv3
+     * maintenance interrupt signal to the appropriate GIC PPI inputs,
+     * and the GIC's IRQ/FIQ/VIRQ/VFIQ interrupt outputs to the CPU's inputs.
+     */
+    for (i = 0; i < AW_H3_NUM_CPUS; i++) {
+        DeviceState *cpudev = DEVICE(&s->cpus[i]);
+        int ppibase = AW_H3_GIC_NUM_SPI + i * GIC_INTERNAL + GIC_NR_SGIS;
+        int irq;
+        /*
+         * Mapping from the output timer irq lines from the CPU to the
+         * GIC PPI inputs used for this board.
+         */
+        const int timer_irq[] = {
+            [GTIMER_PHYS] = AW_H3_GIC_PPI_PHYSTIMER,
+            [GTIMER_VIRT] = AW_H3_GIC_PPI_VIRTTIMER,
+            [GTIMER_HYP]  = AW_H3_GIC_PPI_HYPTIMER,
+            [GTIMER_SEC]  = AW_H3_GIC_PPI_SECTIMER,
+        };
+
+        /* Connect CPU timer outputs to GIC PPI inputs */
+        for (irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {
+            qdev_connect_gpio_out(cpudev, irq,
+                                  qdev_get_gpio_in(DEVICE(&s->gic),
+                                                   ppibase + timer_irq[irq]));
+        }
+
+        /* Connect GIC outputs to CPU interrupt inputs */
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i,
+                           qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i + AW_H3_NUM_CPUS,
+                           qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i + (2 * AW_H3_NUM_CPUS),
+                           qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i + (3 * AW_H3_NUM_CPUS),
+                           qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
+
+        /* GIC maintenance signal */
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i + (4 * AW_H3_NUM_CPUS),
+                           qdev_get_gpio_in(DEVICE(&s->gic),
+                                            ppibase + AW_H3_GIC_PPI_MAINT));
+    }
+
+    /* Timer */
+    qdev_init_nofail(DEVICE(&s->timer));
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->timer), 0, s->memmap[AW_H3_PIT]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer), 0,
+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TIMER0));
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer), 1,
+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TIMER1));
+
+    /* SRAM */
+    memory_region_init_ram(&s->sram_a1, OBJECT(dev), "sram A1",
+                            64 * KiB, &error_abort);
+    memory_region_init_ram(&s->sram_a2, OBJECT(dev), "sram A2",
+                            32 * KiB, &error_abort);
+    memory_region_init_ram(&s->sram_c, OBJECT(dev), "sram C",
+                            44 * KiB, &error_abort);
+    memory_region_add_subregion(get_system_memory(), s->memmap[AW_H3_SRAM_A1],
+                                &s->sram_a1);
+    memory_region_add_subregion(get_system_memory(), s->memmap[AW_H3_SRAM_A2],
+                                &s->sram_a2);
+    memory_region_add_subregion(get_system_memory(), s->memmap[AW_H3_SRAM_C],
+                                &s->sram_c);
+
+    /* UART0. For future clocktree API: All UARTS are connected to APB2_CLK. */
+    serial_mm_init(get_system_memory(), s->memmap[AW_H3_UART0], 2,
+                   qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART0),
+                   115200, serial_hd(0), DEVICE_NATIVE_ENDIAN);
+    /* UART1 */
+    serial_mm_init(get_system_memory(), s->memmap[AW_H3_UART1], 2,
+                   qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART1),
+                   115200, serial_hd(1), DEVICE_NATIVE_ENDIAN);
+    /* UART2 */
+    serial_mm_init(get_system_memory(), s->memmap[AW_H3_UART2], 2,
+                   qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART2),
+                   115200, serial_hd(2), DEVICE_NATIVE_ENDIAN);
+    /* UART3 */
+    serial_mm_init(get_system_memory(), s->memmap[AW_H3_UART3], 2,
+                   qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART3),
+                   115200, serial_hd(3), DEVICE_NATIVE_ENDIAN);
+
+    /* Unimplemented devices */
+    for (i = 0; i < ARRAY_SIZE(unimplemented); i++) {
+        create_unimplemented_device(unimplemented[i].device_name,
+                                    unimplemented[i].base,
+                                    unimplemented[i].size);
+    }
+}
+
+static void allwinner_h3_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = allwinner_h3_realize;
+    /* Reason: uses serial_hd() in realize function */
+    dc->user_creatable = false;
+}
+
+static const TypeInfo allwinner_h3_type_info = {
+    .name = TYPE_AW_H3,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(AwH3State),
+    .instance_init = allwinner_h3_init,
+    .class_init = allwinner_h3_class_init,
+};
+
+static void allwinner_h3_register_types(void)
+{
+    type_register_static(&allwinner_h3_type_info);
+}
+
+type_init(allwinner_h3_register_types)
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/*/allwinner*
 F: include/hw/*/allwinner*
 F: hw/arm/cubieboard.c
 
+Allwinner-h3
+M: Niek Linnenbank <nieklinnenbank@gmail.com>
+L: qemu-arm@nongnu.org
+S: Maintained
+F: hw/*/allwinner-h3*
+F: include/hw/*/allwinner-h3*
+
 ARM PrimeCell and CMSDK devices
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_FSL_IMX25=y
 CONFIG_FSL_IMX7=y
 CONFIG_FSL_IMX6UL=y
 CONFIG_SEMIHOSTING=y
+CONFIG_ALLWINNER_H3=y
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
     select SERIAL
     select UNIMP
 
+config ALLWINNER_H3
+    bool
+    select ALLWINNER_A10_PIT
+    select SERIAL
+    select ARM_TIMER
+    select ARM_GIC
+    select UNIMP
+
 config RASPI
     bool
     select FRAMEBUFFER
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The Xunlong Orange Pi PC is an Allwinner H3 System on Chip
based embedded computer with mainline support in both U-Boot
and Linux. The board comes with a Quad Core Cortex A7 @ 1.3GHz,
1GiB RAM, 100Mbit ethernet, USB, SD/MMC, USB, HDMI and
various other I/O. This commit add support for the Xunlong
Orange Pi PC machine.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Tested-by: KONRAD Frederic <frederic.konrad@adacore.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20200311221854.30370-3-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs |  2 +-
 hw/arm/orangepi.c    | 92 ++++++++++++++++++++++++++++++++++++++++++++
 MAINTAINERS          |  1 +
 3 files changed, 94 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/orangepi.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_DIGIC) += digic.o
 obj-$(CONFIG_OMAP) += omap1.o omap2.o
 obj-$(CONFIG_STRONGARM) += strongarm.o
 obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3.o
+obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3.o orangepi.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
 obj-$(CONFIG_STM32F405_SOC) += stm32f405_soc.o
diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/orangepi.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Orange Pi emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "exec/address-spaces.h"
+#include "qapi/error.h"
+#include "cpu.h"
+#include "hw/sysbus.h"
+#include "hw/boards.h"
+#include "hw/qdev-properties.h"
+#include "hw/arm/allwinner-h3.h"
+#include "sysemu/sysemu.h"
+
+static struct arm_boot_info orangepi_binfo = {
+    .nb_cpus = AW_H3_NUM_CPUS,
+};
+
+static void orangepi_init(MachineState *machine)
+{
+    AwH3State *h3;
+
+    /* BIOS is not supported by this board */
+    if (bios_name) {
+        error_report("BIOS not supported for this machine");
+        exit(1);
+    }
+
+    /* This board has fixed size RAM */
+    if (machine->ram_size != 1 * GiB) {
+        error_report("This machine can only be used with 1GiB of RAM");
+        exit(1);
+    }
+
+    /* Only allow Cortex-A7 for this board */
+    if (strcmp(machine->cpu_type, ARM_CPU_TYPE_NAME("cortex-a7")) != 0) {
+        error_report("This board can only be used with cortex-a7 CPU");
+        exit(1);
+    }
+
+    h3 = AW_H3(object_new(TYPE_AW_H3));
+    object_property_add_child(OBJECT(machine), "soc", OBJECT(h3),
+                              &error_abort);
+    object_unref(OBJECT(h3));
+
+    /* Setup timer properties */
+    object_property_set_int(OBJECT(h3), 32768, "clk0-freq",
+                            &error_abort);
+    object_property_set_int(OBJECT(h3), 24 * 1000 * 1000, "clk1-freq",
+                            &error_abort);
+
+    /* Mark H3 object realized */
+    object_property_set_bool(OBJECT(h3), true, "realized", &error_abort);
+
+    /* SDRAM */
+    memory_region_add_subregion(get_system_memory(), h3->memmap[AW_H3_SDRAM],
+                                machine->ram);
+
+    orangepi_binfo.loader_start = h3->memmap[AW_H3_SDRAM];
+    orangepi_binfo.ram_size = machine->ram_size;
+    arm_load_kernel(ARM_CPU(first_cpu), machine, &orangepi_binfo);
+}
+
+static void orangepi_machine_init(MachineClass *mc)
+{
+    mc->desc = "Orange Pi PC";
+    mc->init = orangepi_init;
+    mc->min_cpus = AW_H3_NUM_CPUS;
+    mc->max_cpus = AW_H3_NUM_CPUS;
+    mc->default_cpus = AW_H3_NUM_CPUS;
+    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a7");
+    mc->default_ram_size = 1 * GiB;
+    mc->default_ram_id = "orangepi.ram";
+}
+
+DEFINE_MACHINE("orangepi-pc", orangepi_machine_init)
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/allwinner-h3*
 F: include/hw/*/allwinner-h3*
+F: hw/arm/orangepi.c
 
 ARM PrimeCell and CMSDK devices
 M: Peter Maydell <peter.maydell@linaro.org>
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The Clock Control Unit is responsible for clock signal generation,
configuration and distribution in the Allwinner H3 System on Chip.
This commit adds support for the Clock Control Unit which emulates
a simple read/write register interface.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200311221854.30370-4-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs              |   1 +
 include/hw/arm/allwinner-h3.h      |   3 +
 include/hw/misc/allwinner-h3-ccu.h |  66 ++++++++
 hw/arm/allwinner-h3.c              |   9 +-
 hw/misc/allwinner-h3-ccu.c         | 242 +++++++++++++++++++++++++++++
 5 files changed, 320 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/misc/allwinner-h3-ccu.h
 create mode 100644 hw/misc/allwinner-h3-ccu.c

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The Allwinner H3 System on Chip contains multiple USB 2.0 bus
connections which provide software access using the Enhanced
Host Controller Interface (EHCI) and Open Host Controller
Interface (OHCI) interfaces. This commit adds support for
both interfaces in the Allwinner H3 System on Chip.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200311221854.30370-5-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/hcd-ehci.h             |  1 +
 include/hw/arm/allwinner-h3.h |  8 +++++++
 hw/arm/allwinner-h3.c         | 44 +++++++++++++++++++++++++++++++++++
 hw/usb/hcd-ehci-sysbus.c      | 17 ++++++++++++++
 hw/arm/Kconfig                |  2 ++
 5 files changed, 72 insertions(+)

diff --git a/hw/usb/hcd-ehci.h b/hw/usb/hcd-ehci.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/hcd-ehci.h
+++ b/hw/usb/hcd-ehci.h
@@ -XXX,XX +XXX,XX @@ typedef struct EHCIPCIState {
 #define TYPE_SYS_BUS_EHCI "sysbus-ehci-usb"
 #define TYPE_PLATFORM_EHCI "platform-ehci-usb"
 #define TYPE_EXYNOS4210_EHCI "exynos4210-ehci-usb"
+#define TYPE_AW_H3_EHCI "aw-h3-ehci-usb"
 #define TYPE_TEGRA2_EHCI "tegra2-ehci-usb"
 #define TYPE_PPC4xx_EHCI "ppc4xx-ehci-usb"
 #define TYPE_FUSBH200_EHCI "fusbh200-ehci-usb"
diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-h3.h
+++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_SRAM_A1,
     AW_H3_SRAM_A2,
     AW_H3_SRAM_C,
+    AW_H3_EHCI0,
+    AW_H3_OHCI0,
+    AW_H3_EHCI1,
+    AW_H3_OHCI1,
+    AW_H3_EHCI2,
+    AW_H3_OHCI2,
+    AW_H3_EHCI3,
+    AW_H3_OHCI3,
     AW_H3_CCU,
     AW_H3_PIT,
     AW_H3_UART0,
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/char/serial.h"
 #include "hw/misc/unimp.h"
+#include "hw/usb/hcd-ehci.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/allwinner-h3.h"
 
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
     [AW_H3_SRAM_A1]    = 0x00000000,
     [AW_H3_SRAM_A2]    = 0x00044000,
     [AW_H3_SRAM_C]     = 0x00010000,
+    [AW_H3_EHCI0]      = 0x01c1a000,
+    [AW_H3_OHCI0]      = 0x01c1a400,
+    [AW_H3_EHCI1]      = 0x01c1b000,
+    [AW_H3_OHCI1]      = 0x01c1b400,
+    [AW_H3_EHCI2]      = 0x01c1c000,
+    [AW_H3_OHCI2]      = 0x01c1c400,
+    [AW_H3_EHCI3]      = 0x01c1d000,
+    [AW_H3_OHCI3]      = 0x01c1d400,
     [AW_H3_CCU]        = 0x01c20000,
     [AW_H3_PIT]        = 0x01c20c00,
     [AW_H3_UART0]      = 0x01c28000,
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_GIC_SPI_UART3     =  3,
     AW_H3_GIC_SPI_TIMER0    = 18,
     AW_H3_GIC_SPI_TIMER1    = 19,
+    AW_H3_GIC_SPI_EHCI0     = 72,
+    AW_H3_GIC_SPI_OHCI0     = 73,
+    AW_H3_GIC_SPI_EHCI1     = 74,
+    AW_H3_GIC_SPI_OHCI1     = 75,
+    AW_H3_GIC_SPI_EHCI2     = 76,
+    AW_H3_GIC_SPI_OHCI2     = 77,
+    AW_H3_GIC_SPI_EHCI3     = 78,
+    AW_H3_GIC_SPI_OHCI3     = 79,
 };
 
 /* Allwinner H3 general constants */
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
     qdev_init_nofail(DEVICE(&s->ccu));
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->ccu), 0, s->memmap[AW_H3_CCU]);
 
+    /* Universal Serial Bus */
+    sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI0],
+                         qdev_get_gpio_in(DEVICE(&s->gic),
+                                          AW_H3_GIC_SPI_EHCI0));
+    sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI1],
+                         qdev_get_gpio_in(DEVICE(&s->gic),
+                                          AW_H3_GIC_SPI_EHCI1));
+    sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI2],
+                         qdev_get_gpio_in(DEVICE(&s->gic),
+                                          AW_H3_GIC_SPI_EHCI2));
+    sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI3],
+                         qdev_get_gpio_in(DEVICE(&s->gic),
+                                          AW_H3_GIC_SPI_EHCI3));
+
+    sysbus_create_simple("sysbus-ohci", s->memmap[AW_H3_OHCI0],
+                         qdev_get_gpio_in(DEVICE(&s->gic),
+                                          AW_H3_GIC_SPI_OHCI0));
+    sysbus_create_simple("sysbus-ohci", s->memmap[AW_H3_OHCI1],
+                         qdev_get_gpio_in(DEVICE(&s->gic),
+                                          AW_H3_GIC_SPI_OHCI1));
+    sysbus_create_simple("sysbus-ohci", s->memmap[AW_H3_OHCI2],
+                         qdev_get_gpio_in(DEVICE(&s->gic),
+                                          AW_H3_GIC_SPI_OHCI2));
+    sysbus_create_simple("sysbus-ohci", s->memmap[AW_H3_OHCI3],
+                         qdev_get_gpio_in(DEVICE(&s->gic),
+                                          AW_H3_GIC_SPI_OHCI3));
+
     /* UART0. For future clocktree API: All UARTS are connected to APB2_CLK. */
     serial_mm_init(get_system_memory(), s->memmap[AW_H3_UART0], 2,
                    qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART0),
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo ehci_exynos4210_type_info = {
     .class_init    = ehci_exynos4210_class_init,
 };
 
+static void ehci_aw_h3_class_init(ObjectClass *oc, void *data)
+{
+    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    sec->capsbase = 0x0;
+    sec->opregbase = 0x10;
+    set_bit(DEVICE_CATEGORY_USB, dc->categories);
+}
+
+static const TypeInfo ehci_aw_h3_type_info = {
+    .name          = TYPE_AW_H3_EHCI,
+    .parent        = TYPE_SYS_BUS_EHCI,
+    .class_init    = ehci_aw_h3_class_init,
+};
+
 static void ehci_tegra2_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void ehci_sysbus_register_types(void)
     type_register_static(&ehci_type_info);
     type_register_static(&ehci_platform_type_info);
     type_register_static(&ehci_exynos4210_type_info);
+    type_register_static(&ehci_aw_h3_type_info);
     type_register_static(&ehci_tegra2_type_info);
     type_register_static(&ehci_ppc4xx_type_info);
     type_register_static(&ehci_fusbh200_type_info);
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
     select ARM_TIMER
     select ARM_GIC
     select UNIMP
+    select USB_OHCI
+    select USB_EHCI_SYSBUS
 
 config RASPI
     bool
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The Allwinner H3 System on Chip has an System Control
module that provides system wide generic controls and
device information. This commit adds support for the
Allwinner H3 System Control module.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200311221854.30370-6-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs                  |   1 +
 include/hw/arm/allwinner-h3.h          |   3 +
 include/hw/misc/allwinner-h3-sysctrl.h |  67 ++++++++++++
 hw/arm/allwinner-h3.c                  |   9 +-
 hw/misc/allwinner-h3-sysctrl.c         | 140 +++++++++++++++++++++++++
 5 files changed, 219 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/misc/allwinner-h3-sysctrl.h
 create mode 100644 hw/misc/allwinner-h3-sysctrl.c

From: Niek Linnenbank <nieklinnenbank@gmail.com>

Various Allwinner System on Chip designs contain multiple processors
that can be configured and reset using the generic CPU Configuration
module interface. This commit adds support for the Allwinner CPU
configuration interface which emulates the following features:

* CPU reset
 * CPU status

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-7-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs              |   1 +
 include/hw/arm/allwinner-h3.h      |   3 +
 include/hw/misc/allwinner-cpucfg.h |  52 ++++++
 hw/arm/allwinner-h3.c              |   9 +-
 hw/misc/allwinner-cpucfg.c         | 282 +++++++++++++++++++++++++++++
 hw/misc/trace-events               |   5 +
 6 files changed, 351 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/misc/allwinner-cpucfg.h
 create mode 100644 hw/misc/allwinner-cpucfg.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_MACIO) += macio/
 common-obj-$(CONFIG_IVSHMEM_DEVICE) += ivshmem.o
 
 common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-ccu.o
+obj-$(CONFIG_ALLWINNER_H3) += allwinner-cpucfg.o
 common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-sysctrl.o
 common-obj-$(CONFIG_REALVIEW) += arm_sysctl.o
 common-obj-$(CONFIG_NSERIES) += cbus.o
diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-h3.h
+++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/timer/allwinner-a10-pit.h"
 #include "hw/intc/arm_gic.h"
 #include "hw/misc/allwinner-h3-ccu.h"
+#include "hw/misc/allwinner-cpucfg.h"
 #include "hw/misc/allwinner-h3-sysctrl.h"
 #include "target/arm/cpu.h"
 
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_GIC_CPU,
     AW_H3_GIC_HYP,
     AW_H3_GIC_VCPU,
+    AW_H3_CPUCFG,
     AW_H3_SDRAM
 };
 
@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
     const hwaddr *memmap;
     AwA10PITState timer;
     AwH3ClockCtlState ccu;
+    AwCpuCfgState cpucfg;
     AwH3SysCtrlState sysctrl;
     GICState gic;
     MemoryRegion sram_a1;
diff --git a/include/hw/misc/allwinner-cpucfg.h b/include/hw/misc/allwinner-cpucfg.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/allwinner-cpucfg.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner CPU Configuration Module emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_MISC_ALLWINNER_CPUCFG_H
+#define HW_MISC_ALLWINNER_CPUCFG_H
+
+#include "qom/object.h"
+#include "hw/sysbus.h"
+
+/**
+ * Object model
+ * @{
+ */
+
+#define TYPE_AW_CPUCFG   "allwinner-cpucfg"
+#define AW_CPUCFG(obj) \
+    OBJECT_CHECK(AwCpuCfgState, (obj), TYPE_AW_CPUCFG)
+
+/** @} */
+
+/**
+ * Allwinner CPU Configuration Module instance state
+ */
+typedef struct AwCpuCfgState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
+    MemoryRegion iomem;
+    uint32_t gen_ctrl;
+    uint32_t super_standby;
+    uint32_t entry_addr;
+
+} AwCpuCfgState;
+
+#endif /* HW_MISC_ALLWINNER_CPUCFG_H */
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
     [AW_H3_GIC_CPU]    = 0x01c82000,
     [AW_H3_GIC_HYP]    = 0x01c84000,
     [AW_H3_GIC_VCPU]   = 0x01c86000,
+    [AW_H3_CPUCFG]     = 0x01f01c00,
     [AW_H3_SDRAM]      = 0x40000000
 };
 
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
     { "r_wdog",    0x01f01000, 1 * KiB },
     { "r_prcm",    0x01f01400, 1 * KiB },
     { "r_twd",     0x01f01800, 1 * KiB },
-    { "r_cpucfg",  0x01f01c00, 1 * KiB },
     { "r_cir-rx",  0x01f02000, 1 * KiB },
     { "r_twi",     0x01f02400, 1 * KiB },
     { "r_uart",    0x01f02800, 1 * KiB },
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
 
     sysbus_init_child_obj(obj, "sysctrl", &s->sysctrl, sizeof(s->sysctrl),
                           TYPE_AW_H3_SYSCTRL);
+
+    sysbus_init_child_obj(obj, "cpucfg", &s->cpucfg, sizeof(s->cpucfg),
+                          TYPE_AW_CPUCFG);
 }
 
 static void allwinner_h3_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
     qdev_init_nofail(DEVICE(&s->sysctrl));
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysctrl), 0, s->memmap[AW_H3_SYSCTRL]);
 
+    /* CPU Configuration */
+    qdev_init_nofail(DEVICE(&s->cpucfg));
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->cpucfg), 0, s->memmap[AW_H3_CPUCFG]);
+
     /* Universal Serial Bus */
     sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI0],
                          qdev_get_gpio_in(DEVICE(&s->gic),
diff --git a/hw/misc/allwinner-cpucfg.c b/hw/misc/allwinner-cpucfg.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/allwinner-cpucfg.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner CPU Configuration Module emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "hw/sysbus.h"
+#include "migration/vmstate.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/error-report.h"
+#include "qemu/timer.h"
+#include "hw/core/cpu.h"
+#include "target/arm/arm-powerctl.h"
+#include "target/arm/cpu.h"
+#include "hw/misc/allwinner-cpucfg.h"
+#include "trace.h"
+
+/* CPUCFG register offsets */
+enum {
+    REG_CPUS_RST_CTRL       = 0x0000, /* CPUs Reset Control */
+    REG_CPU0_RST_CTRL       = 0x0040, /* CPU#0 Reset Control */
+    REG_CPU0_CTRL           = 0x0044, /* CPU#0 Control */
+    REG_CPU0_STATUS         = 0x0048, /* CPU#0 Status */
+    REG_CPU1_RST_CTRL       = 0x0080, /* CPU#1 Reset Control */
+    REG_CPU1_CTRL           = 0x0084, /* CPU#1 Control */
+    REG_CPU1_STATUS         = 0x0088, /* CPU#1 Status */
+    REG_CPU2_RST_CTRL       = 0x00C0, /* CPU#2 Reset Control */
+    REG_CPU2_CTRL           = 0x00C4, /* CPU#2 Control */
+    REG_CPU2_STATUS         = 0x00C8, /* CPU#2 Status */
+    REG_CPU3_RST_CTRL       = 0x0100, /* CPU#3 Reset Control */
+    REG_CPU3_CTRL           = 0x0104, /* CPU#3 Control */
+    REG_CPU3_STATUS         = 0x0108, /* CPU#3 Status */
+    REG_CPU_SYS_RST         = 0x0140, /* CPU System Reset */
+    REG_CLK_GATING          = 0x0144, /* CPU Clock Gating */
+    REG_GEN_CTRL            = 0x0184, /* General Control */
+    REG_SUPER_STANDBY       = 0x01A0, /* Super Standby Flag */
+    REG_ENTRY_ADDR          = 0x01A4, /* Reset Entry Address */
+    REG_DBG_EXTERN          = 0x01E4, /* Debug External */
+    REG_CNT64_CTRL          = 0x0280, /* 64-bit Counter Control */
+    REG_CNT64_LOW           = 0x0284, /* 64-bit Counter Low */
+    REG_CNT64_HIGH          = 0x0288, /* 64-bit Counter High */
+};
+
+/* CPUCFG register flags */
+enum {
+    CPUX_RESET_RELEASED     = ((1 << 1) | (1 << 0)),
+    CPUX_STATUS_SMP         = (1 << 0),
+    CPU_SYS_RESET_RELEASED  = (1 << 0),
+    CLK_GATING_ENABLE       = ((1 << 8) | 0xF),
+};
+
+/* CPUCFG register reset values */
+enum {
+    REG_CLK_GATING_RST      = 0x0000010F,
+    REG_GEN_CTRL_RST        = 0x00000020,
+    REG_SUPER_STANDBY_RST   = 0x0,
+    REG_CNT64_CTRL_RST      = 0x0,
+};
+
+/* CPUCFG constants */
+enum {
+    CPU_EXCEPTION_LEVEL_ON_RESET = 3, /* EL3 */
+};
+
+static void allwinner_cpucfg_cpu_reset(AwCpuCfgState *s, uint8_t cpu_id)
+{
+    int ret;
+
+    trace_allwinner_cpucfg_cpu_reset(cpu_id, s->entry_addr);
+
+    ARMCPU *target_cpu = ARM_CPU(arm_get_cpu_by_id(cpu_id));
+    if (!target_cpu) {
+        /*
+         * Called with a bogus value for cpu_id. Guest error will
+         * already have been logged, we can simply return here.
+         */
+        return;
+    }
+    bool target_aa64 = arm_feature(&target_cpu->env, ARM_FEATURE_AARCH64);
+
+    ret = arm_set_cpu_on(cpu_id, s->entry_addr, 0,
+                         CPU_EXCEPTION_LEVEL_ON_RESET, target_aa64);
+    if (ret != QEMU_ARM_POWERCTL_RET_SUCCESS) {
+        error_report("%s: failed to bring up CPU %d: err %d",
+                     __func__, cpu_id, ret);
+        return;
+    }
+}
+
+static uint64_t allwinner_cpucfg_read(void *opaque, hwaddr offset,
+                                      unsigned size)
+{
+    const AwCpuCfgState *s = AW_CPUCFG(opaque);
+    uint64_t val = 0;
+
+    switch (offset) {
+    case REG_CPUS_RST_CTRL:     /* CPUs Reset Control */
+    case REG_CPU_SYS_RST:       /* CPU System Reset */
+        val = CPU_SYS_RESET_RELEASED;
+        break;
+    case REG_CPU0_RST_CTRL:     /* CPU#0 Reset Control */
+    case REG_CPU1_RST_CTRL:     /* CPU#1 Reset Control */
+    case REG_CPU2_RST_CTRL:     /* CPU#2 Reset Control */
+    case REG_CPU3_RST_CTRL:     /* CPU#3 Reset Control */
+        val = CPUX_RESET_RELEASED;
+        break;
+    case REG_CPU0_CTRL:         /* CPU#0 Control */
+    case REG_CPU1_CTRL:         /* CPU#1 Control */
+    case REG_CPU2_CTRL:         /* CPU#2 Control */
+    case REG_CPU3_CTRL:         /* CPU#3 Control */
+        val = 0;
+        break;
+    case REG_CPU0_STATUS:       /* CPU#0 Status */
+    case REG_CPU1_STATUS:       /* CPU#1 Status */
+    case REG_CPU2_STATUS:       /* CPU#2 Status */
+    case REG_CPU3_STATUS:       /* CPU#3 Status */
+        val = CPUX_STATUS_SMP;
+        break;
+    case REG_CLK_GATING:        /* CPU Clock Gating */
+        val = CLK_GATING_ENABLE;
+        break;
+    case REG_GEN_CTRL:          /* General Control */
+        val = s->gen_ctrl;
+        break;
+    case REG_SUPER_STANDBY:     /* Super Standby Flag */
+        val = s->super_standby;
+        break;
+    case REG_ENTRY_ADDR:        /* Reset Entry Address */
+        val = s->entry_addr;
+        break;
+    case REG_DBG_EXTERN:        /* Debug External */
+    case REG_CNT64_CTRL:        /* 64-bit Counter Control */
+    case REG_CNT64_LOW:         /* 64-bit Counter Low */
+    case REG_CNT64_HIGH:        /* 64-bit Counter High */
+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented register at 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        break;
+    }
+
+    trace_allwinner_cpucfg_read(offset, val, size);
+
+    return val;
+}
+
+static void allwinner_cpucfg_write(void *opaque, hwaddr offset,
+                                   uint64_t val, unsigned size)
+{
+    AwCpuCfgState *s = AW_CPUCFG(opaque);
+
+    trace_allwinner_cpucfg_write(offset, val, size);
+
+    switch (offset) {
+    case REG_CPUS_RST_CTRL:     /* CPUs Reset Control */
+    case REG_CPU_SYS_RST:       /* CPU System Reset */
+        break;
+    case REG_CPU0_RST_CTRL:     /* CPU#0 Reset Control */
+    case REG_CPU1_RST_CTRL:     /* CPU#1 Reset Control */
+    case REG_CPU2_RST_CTRL:     /* CPU#2 Reset Control */
+    case REG_CPU3_RST_CTRL:     /* CPU#3 Reset Control */
+        if (val) {
+            allwinner_cpucfg_cpu_reset(s, (offset - REG_CPU0_RST_CTRL) >> 6);
+        }
+        break;
+    case REG_CPU0_CTRL:         /* CPU#0 Control */
+    case REG_CPU1_CTRL:         /* CPU#1 Control */
+    case REG_CPU2_CTRL:         /* CPU#2 Control */
+    case REG_CPU3_CTRL:         /* CPU#3 Control */
+    case REG_CPU0_STATUS:       /* CPU#0 Status */
+    case REG_CPU1_STATUS:       /* CPU#1 Status */
+    case REG_CPU2_STATUS:       /* CPU#2 Status */
+    case REG_CPU3_STATUS:       /* CPU#3 Status */
+    case REG_CLK_GATING:        /* CPU Clock Gating */
+        break;
+    case REG_GEN_CTRL:          /* General Control */
+        s->gen_ctrl = val;
+        break;
+    case REG_SUPER_STANDBY:     /* Super Standby Flag */
+        s->super_standby = val;
+        break;
+    case REG_ENTRY_ADDR:        /* Reset Entry Address */
+        s->entry_addr = val;
+        break;
+    case REG_DBG_EXTERN:        /* Debug External */
+    case REG_CNT64_CTRL:        /* 64-bit Counter Control */
+    case REG_CNT64_LOW:         /* 64-bit Counter Low */
+    case REG_CNT64_HIGH:        /* 64-bit Counter High */
+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented register at 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps allwinner_cpucfg_ops = {
+    .read = allwinner_cpucfg_read,
+    .write = allwinner_cpucfg_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+    .impl.min_access_size = 4,
+};
+
+static void allwinner_cpucfg_reset(DeviceState *dev)
+{
+    AwCpuCfgState *s = AW_CPUCFG(dev);
+
+    /* Set default values for registers */
+    s->gen_ctrl = REG_GEN_CTRL_RST;
+    s->super_standby = REG_SUPER_STANDBY_RST;
+    s->entry_addr = 0;
+}
+
+static void allwinner_cpucfg_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    AwCpuCfgState *s = AW_CPUCFG(obj);
+
+    /* Memory mapping */
+    memory_region_init_io(&s->iomem, OBJECT(s), &allwinner_cpucfg_ops, s,
+                          TYPE_AW_CPUCFG, 1 * KiB);
+    sysbus_init_mmio(sbd, &s->iomem);
+}
+
+static const VMStateDescription allwinner_cpucfg_vmstate = {
+    .name = "allwinner-cpucfg",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(gen_ctrl, AwCpuCfgState),
+        VMSTATE_UINT32(super_standby, AwCpuCfgState),
+        VMSTATE_UINT32(entry_addr, AwCpuCfgState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void allwinner_cpucfg_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = allwinner_cpucfg_reset;
+    dc->vmsd = &allwinner_cpucfg_vmstate;
+}
+
+static const TypeInfo allwinner_cpucfg_info = {
+    .name          = TYPE_AW_CPUCFG,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_init = allwinner_cpucfg_init,
+    .instance_size = sizeof(AwCpuCfgState),
+    .class_init    = allwinner_cpucfg_class_init,
+};
+
+static void allwinner_cpucfg_register(void)
+{
+    type_register_static(&allwinner_cpucfg_info);
+}
+
+type_init(allwinner_cpucfg_register)
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@
 # See docs/devel/tracing.txt for syntax documentation.
 
+# allwinner-cpucfg.c
+allwinner_cpucfg_cpu_reset(uint8_t cpu_id, uint32_t reset_addr) "id %u, reset_addr 0x%" PRIu32
+allwinner_cpucfg_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
+allwinner_cpucfg_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
+
 # eccmemctl.c
 ecc_mem_writel_mer(uint32_t val) "Write memory enable 0x%08x"
 ecc_mem_writel_mdr(uint32_t val) "Write memory delay 0x%08x"
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The Security Identifier device found in various Allwinner System on Chip
designs gives applications a per-board unique identifier. This commit
adds support for the Allwinner Security Identifier using a 128-bit
UUID value as input.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-8-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs           |   1 +
 include/hw/arm/allwinner-h3.h   |   3 +
 include/hw/misc/allwinner-sid.h |  60 ++++++++++++
 hw/arm/allwinner-h3.c           |  11 ++-
 hw/arm/orangepi.c               |   8 ++
 hw/misc/allwinner-sid.c         | 168 ++++++++++++++++++++++++++++++++
 hw/misc/trace-events            |   4 +
 7 files changed, 254 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/misc/allwinner-sid.h
 create mode 100644 hw/misc/allwinner-sid.c

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The Allwinner System on Chip families sun4i and above contain
an integrated storage controller for Secure Digital (SD) and
Multi Media Card (MMC) interfaces. This commit adds support
for the Allwinner SD/MMC storage controller with the following
emulated features:

* DMA transfers
 * Direct FIFO I/O
 * Short/Long format command responses
 * Auto-Stop command (CMD12)
 * Insert & remove card detection

The following boards are extended with the SD host controller:

* Cubieboard (hw/arm/cubieboard.c)
 * Orange Pi PC (hw/arm/orangepi.c)

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200311221854.30370-9-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/Makefile.objs              |   1 +
 include/hw/arm/allwinner-a10.h   |   2 +
 include/hw/arm/allwinner-h3.h    |   3 +
 include/hw/sd/allwinner-sdhost.h | 135 +++++
 hw/arm/allwinner-a10.c           |  11 +
 hw/arm/allwinner-h3.c            |  15 +-
 hw/arm/cubieboard.c              |  15 +
 hw/arm/orangepi.c                |  16 +
 hw/sd/allwinner-sdhost.c         | 854 +++++++++++++++++++++++++++++++
 hw/arm/Kconfig                   |   1 +
 hw/sd/trace-events               |   7 +
 11 files changed, 1059 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/sd/allwinner-sdhost.h
 create mode 100644 hw/sd/allwinner-sdhost.c

diff --git a/hw/sd/Makefile.objs b/hw/sd/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/Makefile.objs
+++ b/hw/sd/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SD) += sd.o core.o sdmmc-internal.o
 common-obj-$(CONFIG_SDHCI) += sdhci.o
 common-obj-$(CONFIG_SDHCI_PCI) += sdhci-pci.o
 
+common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-sdhost.o
 common-obj-$(CONFIG_MILKYMIST) += milkymist-memcard.o
 common-obj-$(CONFIG_OMAP) += omap_mmc.o
 common-obj-$(CONFIG_PXA2XX) += pxa2xx_mmci.o
diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/timer/allwinner-a10-pit.h"
 #include "hw/intc/allwinner-a10-pic.h"
 #include "hw/net/allwinner_emac.h"
+#include "hw/sd/allwinner-sdhost.h"
 #include "hw/ide/ahci.h"
 #include "hw/usb/hcd-ohci.h"
 #include "hw/usb/hcd-ehci.h"
@@ -XXX,XX +XXX,XX @@ typedef struct AwA10State {
     AwA10PICState intc;
     AwEmacState emac;
     AllwinnerAHCIState sata;
+    AwSdHostState mmc0;
     MemoryRegion sram_a;
     EHCISysBusState ehci[AW_A10_NUM_USB];
     OHCISysBusState ohci[AW_A10_NUM_USB];
diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-h3.h
+++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/allwinner-cpucfg.h"
 #include "hw/misc/allwinner-h3-sysctrl.h"
 #include "hw/misc/allwinner-sid.h"
+#include "hw/sd/allwinner-sdhost.h"
 #include "target/arm/cpu.h"
 
 /**
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_SRAM_A2,
     AW_H3_SRAM_C,
     AW_H3_SYSCTRL,
+    AW_H3_MMC0,
     AW_H3_SID,
     AW_H3_EHCI0,
     AW_H3_OHCI0,
@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
     AwCpuCfgState cpucfg;
     AwH3SysCtrlState sysctrl;
     AwSidState sid;
+    AwSdHostState mmc0;
     GICState gic;
     MemoryRegion sram_a1;
     MemoryRegion sram_a2;
diff --git a/include/hw/sd/allwinner-sdhost.h b/include/hw/sd/allwinner-sdhost.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/sd/allwinner-sdhost.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner (sun4i and above) SD Host Controller emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_SD_ALLWINNER_SDHOST_H
+#define HW_SD_ALLWINNER_SDHOST_H
+
+#include "qom/object.h"
+#include "hw/sysbus.h"
+#include "hw/sd/sd.h"
+
+/**
+ * Object model types
+ * @{
+ */
+
+/** Generic Allwinner SD Host Controller (abstract) */
+#define TYPE_AW_SDHOST "allwinner-sdhost"
+
+/** Allwinner sun4i family (A10, A12) */
+#define TYPE_AW_SDHOST_SUN4I TYPE_AW_SDHOST "-sun4i"
+
+/** Allwinner sun5i family and newer (A13, H2+, H3, etc) */
+#define TYPE_AW_SDHOST_SUN5I TYPE_AW_SDHOST "-sun5i"
+
+/** @} */
+
+/**
+ * Object model macros
+ * @{
+ */
+
+#define AW_SDHOST(obj) \
+    OBJECT_CHECK(AwSdHostState, (obj), TYPE_AW_SDHOST)
+#define AW_SDHOST_CLASS(klass) \
+     OBJECT_CLASS_CHECK(AwSdHostClass, (klass), TYPE_AW_SDHOST)
+#define AW_SDHOST_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(AwSdHostClass, (obj), TYPE_AW_SDHOST)
+
+/** @} */
+
+/**
+ * Allwinner SD Host Controller object instance state.
+ */
+typedef struct AwSdHostState {
+    /*< private >*/
+    SysBusDevice busdev;
+    /*< public >*/
+
+    /** Secure Digital (SD) bus, which connects to SD card (if present) */
+    SDBus sdbus;
+
+    /** Maps I/O registers in physical memory */
+    MemoryRegion iomem;
+
+    /** Interrupt output signal to notify CPU */
+    qemu_irq irq;
+
+    /** Number of bytes left in current DMA transfer */
+    uint32_t transfer_cnt;
+
+    /**
+     * @name Hardware Registers
+     * @{
+     */
+
+    uint32_t global_ctl;        /**< Global Control */
+    uint32_t clock_ctl;         /**< Clock Control */
+    uint32_t timeout;           /**< Timeout */
+    uint32_t bus_width;         /**< Bus Width */
+    uint32_t block_size;        /**< Block Size */
+    uint32_t byte_count;        /**< Byte Count */
+
+    uint32_t command;           /**< Command */
+    uint32_t command_arg;       /**< Command Argument */
+    uint32_t response[4];       /**< Command Response */
+
+    uint32_t irq_mask;          /**< Interrupt Mask */
+    uint32_t irq_status;        /**< Raw Interrupt Status */
+    uint32_t status;            /**< Status */
+
+    uint32_t fifo_wlevel;       /**< FIFO Water Level */
+    uint32_t fifo_func_sel;     /**< FIFO Function Select */
+    uint32_t debug_enable;      /**< Debug Enable */
+    uint32_t auto12_arg;        /**< Auto Command 12 Argument */
+    uint32_t newtiming_set;     /**< SD New Timing Set */
+    uint32_t newtiming_debug;   /**< SD New Timing Debug */
+    uint32_t hardware_rst;      /**< Hardware Reset */
+    uint32_t dmac;              /**< Internal DMA Controller Control */
+    uint32_t desc_base;         /**< Descriptor List Base Address */
+    uint32_t dmac_status;       /**< Internal DMA Controller Status */
+    uint32_t dmac_irq;          /**< Internal DMA Controller IRQ Enable */
+    uint32_t card_threshold;    /**< Card Threshold Control */
+    uint32_t startbit_detect;   /**< eMMC DDR Start Bit Detection Control */
+    uint32_t response_crc;      /**< Response CRC */
+    uint32_t data_crc[8];       /**< Data CRC */
+    uint32_t status_crc;        /**< Status CRC */
+
+    /** @} */
+
+} AwSdHostState;
+
+/**
+ * Allwinner SD Host Controller class-level struct.
+ *
+ * This struct is filled by each sunxi device specific code
+ * such that the generic code can use this struct to support
+ * all devices.
+ */
+typedef struct AwSdHostClass {
+    /*< private >*/
+    SysBusDeviceClass parent_class;
+    /*< public >*/
+
+    /** Maximum buffer size in bytes per DMA descriptor */
+    size_t max_desc_size;
+
+} AwSdHostClass;
+
+#endif /* HW_SD_ALLWINNER_SDHOST_H */
diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "hw/usb/hcd-ohci.h"
 
+#define AW_A10_MMC0_BASE        0x01c0f000
 #define AW_A10_PIC_REG_BASE     0x01c20400
 #define AW_A10_PIT_REG_BASE     0x01c20c00
 #define AW_A10_UART0_REG_BASE   0x01c28000
@@ -XXX,XX +XXX,XX @@ static void aw_a10_init(Object *obj)
                                   sizeof(s->ohci[i]), TYPE_SYSBUS_OHCI);
         }
     }
+
+    sysbus_init_child_obj(obj, "mmc0", &s->mmc0, sizeof(s->mmc0),
+                          TYPE_AW_SDHOST_SUN4I);
 }
 
 static void aw_a10_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
                                qdev_get_gpio_in(dev, 64 + i));
         }
     }
+
+    /* SD/MMC */
+    qdev_init_nofail(DEVICE(&s->mmc0));
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->mmc0), 0, AW_A10_MMC0_BASE);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->mmc0), 0, qdev_get_gpio_in(dev, 32));
+    object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->mmc0),
+                              "sd-bus", &error_abort);
 }
 
 static void aw_a10_class_init(ObjectClass *oc, void *data)
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
     [AW_H3_SRAM_A2]    = 0x00044000,
     [AW_H3_SRAM_C]     = 0x00010000,
     [AW_H3_SYSCTRL]    = 0x01c00000,
+    [AW_H3_MMC0]       = 0x01c0f000,
     [AW_H3_SID]        = 0x01c14000,
     [AW_H3_EHCI0]      = 0x01c1a000,
     [AW_H3_OHCI0]      = 0x01c1a400,
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
     { "lcd0",      0x01c0c000, 4 * KiB },
     { "lcd1",      0x01c0d000, 4 * KiB },
     { "ve",        0x01c0e000, 4 * KiB },
-    { "mmc0",      0x01c0f000, 4 * KiB },
     { "mmc1",      0x01c10000, 4 * KiB },
     { "mmc2",      0x01c11000, 4 * KiB },
     { "crypto",    0x01c15000, 4 * KiB },
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_GIC_SPI_UART3     =  3,
     AW_H3_GIC_SPI_TIMER0    = 18,
     AW_H3_GIC_SPI_TIMER1    = 19,
+    AW_H3_GIC_SPI_MMC0      = 60,
     AW_H3_GIC_SPI_EHCI0     = 72,
     AW_H3_GIC_SPI_OHCI0     = 73,
     AW_H3_GIC_SPI_EHCI1     = 74,
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
                           TYPE_AW_SID);
     object_property_add_alias(obj, "identifier", OBJECT(&s->sid),
                               "identifier", &error_abort);
+
+    sysbus_init_child_obj(obj, "mmc0", &s->mmc0, sizeof(s->mmc0),
+                          TYPE_AW_SDHOST_SUN5I);
 }
 
 static void allwinner_h3_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
     qdev_init_nofail(DEVICE(&s->sid));
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sid), 0, s->memmap[AW_H3_SID]);
 
+    /* SD/MMC */
+    qdev_init_nofail(DEVICE(&s->mmc0));
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->mmc0), 0, s->memmap[AW_H3_MMC0]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->mmc0), 0,
+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_MMC0));
+
+    object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->mmc0),
+                              "sd-bus", &error_abort);
+
     /* Universal Serial Bus */
     sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI0],
                          qdev_get_gpio_in(DEVICE(&s->gic),
diff --git a/hw/arm/cubieboard.c b/hw/arm/cubieboard.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/cubieboard.c
+++ b/hw/arm/cubieboard.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
+#include "hw/qdev-properties.h"
 #include "hw/arm/allwinner-a10.h"
 
 static struct arm_boot_info cubieboard_binfo = {
@@ -XXX,XX +XXX,XX @@ static void cubieboard_init(MachineState *machine)
 {
     AwA10State *a10;
     Error *err = NULL;
+    DriveInfo *di;
+    BlockBackend *blk;
+    BusState *bus;
+    DeviceState *carddev;
 
     /* BIOS is not supported by this board */
     if (bios_name) {
@@ -XXX,XX +XXX,XX @@ static void cubieboard_init(MachineState *machine)
         exit(1);
     }
 
+    /* Retrieve SD bus */
+    di = drive_get_next(IF_SD);
+    blk = di ? blk_by_legacy_dinfo(di) : NULL;
+    bus = qdev_get_child_bus(DEVICE(a10), "sd-bus");
+
+    /* Plug in SD card */
+    carddev = qdev_create(bus, TYPE_SD_CARD);
+    qdev_prop_set_drive(carddev, "drive", blk, &error_fatal);
+    object_property_set_bool(OBJECT(carddev), true, "realized", &error_fatal);
+
     memory_region_add_subregion(get_system_memory(), AW_A10_SDRAM_BASE,
                                 machine->ram);
 
diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/orangepi.c
+++ b/hw/arm/orangepi.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info orangepi_binfo = {
 static void orangepi_init(MachineState *machine)
 {
     AwH3State *h3;
+    DriveInfo *di;
+    BlockBackend *blk;
+    BusState *bus;
+    DeviceState *carddev;
 
     /* BIOS is not supported by this board */
     if (bios_name) {
@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)
     /* Mark H3 object realized */
     object_property_set_bool(OBJECT(h3), true, "realized", &error_abort);
 
+    /* Retrieve SD bus */
+    di = drive_get_next(IF_SD);
+    blk = di ? blk_by_legacy_dinfo(di) : NULL;
+    bus = qdev_get_child_bus(DEVICE(h3), "sd-bus");
+
+    /* Plug in SD card */
+    carddev = qdev_create(bus, TYPE_SD_CARD);
+    qdev_prop_set_drive(carddev, "drive", blk, &error_fatal);
+    object_property_set_bool(OBJECT(carddev), true, "realized", &error_fatal);
+
     /* SDRAM */
     memory_region_add_subregion(get_system_memory(), h3->memmap[AW_H3_SDRAM],
                                 machine->ram);
@@ -XXX,XX +XXX,XX @@ static void orangepi_machine_init(MachineClass *mc)
 {
     mc->desc = "Orange Pi PC";
     mc->init = orangepi_init;
+    mc->block_default_type = IF_SD;
+    mc->units_per_default_bus = 1;
     mc->min_cpus = AW_H3_NUM_CPUS;
     mc->max_cpus = AW_H3_NUM_CPUS;
     mc->default_cpus = AW_H3_NUM_CPUS;
diff --git a/hw/sd/allwinner-sdhost.c b/hw/sd/allwinner-sdhost.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/sd/allwinner-sdhost.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner (sun4i and above) SD Host Controller emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/units.h"
+#include "sysemu/blockdev.h"
+#include "hw/irq.h"
+#include "hw/sd/allwinner-sdhost.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+
+#define TYPE_AW_SDHOST_BUS "allwinner-sdhost-bus"
+#define AW_SDHOST_BUS(obj) \
+    OBJECT_CHECK(SDBus, (obj), TYPE_AW_SDHOST_BUS)
+
+/* SD Host register offsets */
+enum {
+    REG_SD_GCTL       = 0x00,  /* Global Control */
+    REG_SD_CKCR       = 0x04,  /* Clock Control */
+    REG_SD_TMOR       = 0x08,  /* Timeout */
+    REG_SD_BWDR       = 0x0C,  /* Bus Width */
+    REG_SD_BKSR       = 0x10,  /* Block Size */
+    REG_SD_BYCR       = 0x14,  /* Byte Count */
+    REG_SD_CMDR       = 0x18,  /* Command */
+    REG_SD_CAGR       = 0x1C,  /* Command Argument */
+    REG_SD_RESP0      = 0x20,  /* Response Zero */
+    REG_SD_RESP1      = 0x24,  /* Response One */
+    REG_SD_RESP2      = 0x28,  /* Response Two */
+    REG_SD_RESP3      = 0x2C,  /* Response Three */
+    REG_SD_IMKR       = 0x30,  /* Interrupt Mask */
+    REG_SD_MISR       = 0x34,  /* Masked Interrupt Status */
+    REG_SD_RISR       = 0x38,  /* Raw Interrupt Status */
+    REG_SD_STAR       = 0x3C,  /* Status */
+    REG_SD_FWLR       = 0x40,  /* FIFO Water Level */
+    REG_SD_FUNS       = 0x44,  /* FIFO Function Select */
+    REG_SD_DBGC       = 0x50,  /* Debug Enable */
+    REG_SD_A12A       = 0x58,  /* Auto command 12 argument */
+    REG_SD_NTSR       = 0x5C,  /* SD NewTiming Set */
+    REG_SD_SDBG       = 0x60,  /* SD newTiming Set Debug */
+    REG_SD_HWRST      = 0x78,  /* Hardware Reset Register */
+    REG_SD_DMAC       = 0x80,  /* Internal DMA Controller Control */
+    REG_SD_DLBA       = 0x84,  /* Descriptor List Base Address */
+    REG_SD_IDST       = 0x88,  /* Internal DMA Controller Status */
+    REG_SD_IDIE       = 0x8C,  /* Internal DMA Controller IRQ Enable */
+    REG_SD_THLDC      = 0x100, /* Card Threshold Control */
+    REG_SD_DSBD       = 0x10C, /* eMMC DDR Start Bit Detection Control */
+    REG_SD_RES_CRC    = 0x110, /* Response CRC from card/eMMC */
+    REG_SD_DATA7_CRC  = 0x114, /* CRC Data 7 from card/eMMC */
+    REG_SD_DATA6_CRC  = 0x118, /* CRC Data 6 from card/eMMC */
+    REG_SD_DATA5_CRC  = 0x11C, /* CRC Data 5 from card/eMMC */
+    REG_SD_DATA4_CRC  = 0x120, /* CRC Data 4 from card/eMMC */
+    REG_SD_DATA3_CRC  = 0x124, /* CRC Data 3 from card/eMMC */
+    REG_SD_DATA2_CRC  = 0x128, /* CRC Data 2 from card/eMMC */
+    REG_SD_DATA1_CRC  = 0x12C, /* CRC Data 1 from card/eMMC */
+    REG_SD_DATA0_CRC  = 0x130, /* CRC Data 0 from card/eMMC */
+    REG_SD_CRC_STA    = 0x134, /* CRC status from card/eMMC during write */
+    REG_SD_FIFO       = 0x200, /* Read/Write FIFO */
+};
+
+/* SD Host register flags */
+enum {
+    SD_GCTL_FIFO_AC_MOD     = (1 << 31),
+    SD_GCTL_DDR_MOD_SEL     = (1 << 10),
+    SD_GCTL_CD_DBC_ENB      = (1 << 8),
+    SD_GCTL_DMA_ENB         = (1 << 5),
+    SD_GCTL_INT_ENB         = (1 << 4),
+    SD_GCTL_DMA_RST         = (1 << 2),
+    SD_GCTL_FIFO_RST        = (1 << 1),
+    SD_GCTL_SOFT_RST        = (1 << 0),
+};
+
+enum {
+    SD_CMDR_LOAD            = (1 << 31),
+    SD_CMDR_CLKCHANGE       = (1 << 21),
+    SD_CMDR_WRITE           = (1 << 10),
+    SD_CMDR_AUTOSTOP        = (1 << 12),
+    SD_CMDR_DATA            = (1 << 9),
+    SD_CMDR_RESPONSE_LONG   = (1 << 7),
+    SD_CMDR_RESPONSE        = (1 << 6),
+    SD_CMDR_CMDID_MASK      = (0x3f),
+};
+
+enum {
+    SD_RISR_CARD_REMOVE     = (1 << 31),
+    SD_RISR_CARD_INSERT     = (1 << 30),
+    SD_RISR_SDIO_INTR       = (1 << 16),
+    SD_RISR_AUTOCMD_DONE    = (1 << 14),
+    SD_RISR_DATA_COMPLETE   = (1 << 3),
+    SD_RISR_CMD_COMPLETE    = (1 << 2),
+    SD_RISR_NO_RESPONSE     = (1 << 1),
+};
+
+enum {
+    SD_STAR_CARD_PRESENT    = (1 << 8),
+};
+
+enum {
+    SD_IDST_INT_SUMMARY     = (1 << 8),
+    SD_IDST_RECEIVE_IRQ     = (1 << 1),
+    SD_IDST_TRANSMIT_IRQ    = (1 << 0),
+    SD_IDST_IRQ_MASK        = (1 << 1) | (1 << 0) | (1 << 8),
+    SD_IDST_WR_MASK         = (0x3ff),
+};
+
+/* SD Host register reset values */
+enum {
+    REG_SD_GCTL_RST         = 0x00000300,
+    REG_SD_CKCR_RST         = 0x0,
+    REG_SD_TMOR_RST         = 0xFFFFFF40,
+    REG_SD_BWDR_RST         = 0x0,
+    REG_SD_BKSR_RST         = 0x00000200,
+    REG_SD_BYCR_RST         = 0x00000200,
+    REG_SD_CMDR_RST         = 0x0,
+    REG_SD_CAGR_RST         = 0x0,
+    REG_SD_RESP_RST         = 0x0,
+    REG_SD_IMKR_RST         = 0x0,
+    REG_SD_MISR_RST         = 0x0,
+    REG_SD_RISR_RST         = 0x0,
+    REG_SD_STAR_RST         = 0x00000100,
+    REG_SD_FWLR_RST         = 0x000F0000,
+    REG_SD_FUNS_RST         = 0x0,
+    REG_SD_DBGC_RST         = 0x0,
+    REG_SD_A12A_RST         = 0x0000FFFF,
+    REG_SD_NTSR_RST         = 0x00000001,
+    REG_SD_SDBG_RST         = 0x0,
+    REG_SD_HWRST_RST        = 0x00000001,
+    REG_SD_DMAC_RST         = 0x0,
+    REG_SD_DLBA_RST         = 0x0,
+    REG_SD_IDST_RST         = 0x0,
+    REG_SD_IDIE_RST         = 0x0,
+    REG_SD_THLDC_RST        = 0x0,
+    REG_SD_DSBD_RST         = 0x0,
+    REG_SD_RES_CRC_RST      = 0x0,
+    REG_SD_DATA_CRC_RST     = 0x0,
+    REG_SD_CRC_STA_RST      = 0x0,
+    REG_SD_FIFO_RST         = 0x0,
+};
+
+/* Data transfer descriptor for DMA */
+typedef struct TransferDescriptor {
+    uint32_t status; /* Status flags */
+    uint32_t size;   /* Data buffer size */
+    uint32_t addr;   /* Data buffer address */
+    uint32_t next;   /* Physical address of next descriptor */
+} TransferDescriptor;
+
+/* Data transfer descriptor flags */
+enum {
+    DESC_STATUS_HOLD   = (1 << 31), /* Set when descriptor is in use by DMA */
+    DESC_STATUS_ERROR  = (1 << 30), /* Set when DMA transfer error occurred */
+    DESC_STATUS_CHAIN  = (1 << 4),  /* Indicates chained descriptor. */
+    DESC_STATUS_FIRST  = (1 << 3),  /* Set on the first descriptor */
+    DESC_STATUS_LAST   = (1 << 2),  /* Set on the last descriptor */
+    DESC_STATUS_NOIRQ  = (1 << 1),  /* Skip raising interrupt after transfer */
+    DESC_SIZE_MASK     = (0xfffffffc)
+};
+
+static void allwinner_sdhost_update_irq(AwSdHostState *s)
+{
+    uint32_t irq;
+
+    if (s->global_ctl & SD_GCTL_INT_ENB) {
+        irq = s->irq_status & s->irq_mask;
+    } else {
+        irq = 0;
+    }
+
+    trace_allwinner_sdhost_update_irq(irq);
+    qemu_set_irq(s->irq, irq);
+}
+
+static void allwinner_sdhost_update_transfer_cnt(AwSdHostState *s,
+                                                 uint32_t bytes)
+{
+    if (s->transfer_cnt > bytes) {
+        s->transfer_cnt -= bytes;
+    } else {
+        s->transfer_cnt = 0;
+    }
+
+    if (!s->transfer_cnt) {
+        s->irq_status |= SD_RISR_DATA_COMPLETE;
+    }
+}
+
+static void allwinner_sdhost_set_inserted(DeviceState *dev, bool inserted)
+{
+    AwSdHostState *s = AW_SDHOST(dev);
+
+    trace_allwinner_sdhost_set_inserted(inserted);
+
+    if (inserted) {
+        s->irq_status |= SD_RISR_CARD_INSERT;
+        s->irq_status &= ~SD_RISR_CARD_REMOVE;
+        s->status |= SD_STAR_CARD_PRESENT;
+    } else {
+        s->irq_status &= ~SD_RISR_CARD_INSERT;
+        s->irq_status |= SD_RISR_CARD_REMOVE;
+        s->status &= ~SD_STAR_CARD_PRESENT;
+    }
+
+    allwinner_sdhost_update_irq(s);
+}
+
+static void allwinner_sdhost_send_command(AwSdHostState *s)
+{
+    SDRequest request;
+    uint8_t resp[16];
+    int rlen;
+
+    /* Auto clear load flag */
+    s->command &= ~SD_CMDR_LOAD;
+
+    /* Clock change does not actually interact with the SD bus */
+    if (!(s->command & SD_CMDR_CLKCHANGE)) {
+
+        /* Prepare request */
+        request.cmd = s->command & SD_CMDR_CMDID_MASK;
+        request.arg = s->command_arg;
+
+        /* Send request to SD bus */
+        rlen = sdbus_do_command(&s->sdbus, &request, resp);
+        if (rlen < 0) {
+            goto error;
+        }
+
+        /* If the command has a response, store it in the response registers */
+        if ((s->command & SD_CMDR_RESPONSE)) {
+            if (rlen == 4 && !(s->command & SD_CMDR_RESPONSE_LONG)) {
+                s->response[0] = ldl_be_p(&resp[0]);
+                s->response[1] = s->response[2] = s->response[3] = 0;
+
+            } else if (rlen == 16 && (s->command & SD_CMDR_RESPONSE_LONG)) {
+                s->response[0] = ldl_be_p(&resp[12]);
+                s->response[1] = ldl_be_p(&resp[8]);
+                s->response[2] = ldl_be_p(&resp[4]);
+                s->response[3] = ldl_be_p(&resp[0]);
+            } else {
+                goto error;
+            }
+        }
+    }
+
+    /* Set interrupt status bits */
+    s->irq_status |= SD_RISR_CMD_COMPLETE;
+    return;
+
+error:
+    s->irq_status |= SD_RISR_NO_RESPONSE;
+}
+
+static void allwinner_sdhost_auto_stop(AwSdHostState *s)
+{
+    /*
+     * The stop command (CMD12) ensures the SD bus
+     * returns to the transfer state.
+     */
+    if ((s->command & SD_CMDR_AUTOSTOP) && (s->transfer_cnt == 0)) {
+        /* First save current command registers */
+        uint32_t saved_cmd = s->command;
+        uint32_t saved_arg = s->command_arg;
+
+        /* Prepare stop command (CMD12) */
+        s->command &= ~SD_CMDR_CMDID_MASK;
+        s->command |= 12; /* CMD12 */
+        s->command_arg = 0;
+
+        /* Put the command on SD bus */
+        allwinner_sdhost_send_command(s);
+
+        /* Restore command values */
+        s->command = saved_cmd;
+        s->command_arg = saved_arg;
+
+        /* Set IRQ status bit for automatic stop done */
+        s->irq_status |= SD_RISR_AUTOCMD_DONE;
+    }
+}
+
+static uint32_t allwinner_sdhost_process_desc(AwSdHostState *s,
+                                              hwaddr desc_addr,
+                                              TransferDescriptor *desc,
+                                              bool is_write, uint32_t max_bytes)
+{
+    AwSdHostClass *klass = AW_SDHOST_GET_CLASS(s);
+    uint32_t num_done = 0;
+    uint32_t num_bytes = max_bytes;
+    uint8_t buf[1024];
+
+    /* Read descriptor */
+    cpu_physical_memory_read(desc_addr, desc, sizeof(*desc));
+    if (desc->size == 0) {
+        desc->size = klass->max_desc_size;
+    } else if (desc->size > klass->max_desc_size) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA descriptor buffer size "
+                      " is out-of-bounds: %" PRIu32 " > %zu",
+                      __func__, desc->size, klass->max_desc_size);
+        desc->size = klass->max_desc_size;
+    }
+    if (desc->size < num_bytes) {
+        num_bytes = desc->size;
+    }
+
+    trace_allwinner_sdhost_process_desc(desc_addr, desc->size,
+                                        is_write, max_bytes);
+
+    while (num_done < num_bytes) {
+        /* Try to completely fill the local buffer */
+        uint32_t buf_bytes = num_bytes - num_done;
+        if (buf_bytes > sizeof(buf)) {
+            buf_bytes = sizeof(buf);
+        }
+
+        /* Write to SD bus */
+        if (is_write) {
+            cpu_physical_memory_read((desc->addr & DESC_SIZE_MASK) + num_done,
+                                      buf, buf_bytes);
+
+            for (uint32_t i = 0; i < buf_bytes; i++) {
+                sdbus_write_data(&s->sdbus, buf[i]);
+            }
+
+        /* Read from SD bus */
+        } else {
+            for (uint32_t i = 0; i < buf_bytes; i++) {
+                buf[i] = sdbus_read_data(&s->sdbus);
+            }
+            cpu_physical_memory_write((desc->addr & DESC_SIZE_MASK) + num_done,
+                                       buf, buf_bytes);
+        }
+        num_done += buf_bytes;
+    }
+
+    /* Clear hold flag and flush descriptor */
+    desc->status &= ~DESC_STATUS_HOLD;
+    cpu_physical_memory_write(desc_addr, desc, sizeof(*desc));
+
+    return num_done;
+}
+
+static void allwinner_sdhost_dma(AwSdHostState *s)
+{
+    TransferDescriptor desc;
+    hwaddr desc_addr = s->desc_base;
+    bool is_write = (s->command & SD_CMDR_WRITE);
+    uint32_t bytes_done = 0;
+
+    /* Check if DMA can be performed */
+    if (s->byte_count == 0 || s->block_size == 0 ||
+      !(s->global_ctl & SD_GCTL_DMA_ENB)) {
+        return;
+    }
+
+    /*
+     * For read operations, data must be available on the SD bus
+     * If not, it is an error and we should not act at all
+     */
+    if (!is_write && !sdbus_data_ready(&s->sdbus)) {
+        return;
+    }
+
+    /* Process the DMA descriptors until all data is copied */
+    while (s->byte_count > 0) {
+        bytes_done = allwinner_sdhost_process_desc(s, desc_addr, &desc,
+                                                   is_write, s->byte_count);
+        allwinner_sdhost_update_transfer_cnt(s, bytes_done);
+
+        if (bytes_done <= s->byte_count) {
+            s->byte_count -= bytes_done;
+        } else {
+            s->byte_count = 0;
+        }
+
+        if (desc.status & DESC_STATUS_LAST) {
+            break;
+        } else {
+            desc_addr = desc.next;
+        }
+    }
+
+    /* Raise IRQ to signal DMA is completed */
+    s->irq_status |= SD_RISR_DATA_COMPLETE | SD_RISR_SDIO_INTR;
+
+    /* Update DMAC bits */
+    s->dmac_status |= SD_IDST_INT_SUMMARY;
+
+    if (is_write) {
+        s->dmac_status |= SD_IDST_TRANSMIT_IRQ;
+    } else {
+        s->dmac_status |= SD_IDST_RECEIVE_IRQ;
+    }
+}
+
+static uint64_t allwinner_sdhost_read(void *opaque, hwaddr offset,
+                                      unsigned size)
+{
+    AwSdHostState *s = AW_SDHOST(opaque);
+    uint32_t res = 0;
+
+    switch (offset) {
+    case REG_SD_GCTL:      /* Global Control */
+        res = s->global_ctl;
+        break;
+    case REG_SD_CKCR:      /* Clock Control */
+        res = s->clock_ctl;
+        break;
+    case REG_SD_TMOR:      /* Timeout */
+        res = s->timeout;
+        break;
+    case REG_SD_BWDR:      /* Bus Width */
+        res = s->bus_width;
+        break;
+    case REG_SD_BKSR:      /* Block Size */
+        res = s->block_size;
+        break;
+    case REG_SD_BYCR:      /* Byte Count */
+        res = s->byte_count;
+        break;
+    case REG_SD_CMDR:      /* Command */
+        res = s->command;
+        break;
+    case REG_SD_CAGR:      /* Command Argument */
+        res = s->command_arg;
+        break;
+    case REG_SD_RESP0:     /* Response Zero */
+        res = s->response[0];
+        break;
+    case REG_SD_RESP1:     /* Response One */
+        res = s->response[1];
+        break;
+    case REG_SD_RESP2:     /* Response Two */
+        res = s->response[2];
+        break;
+    case REG_SD_RESP3:     /* Response Three */
+        res = s->response[3];
+        break;
+    case REG_SD_IMKR:      /* Interrupt Mask */
+        res = s->irq_mask;
+        break;
+    case REG_SD_MISR:      /* Masked Interrupt Status */
+        res = s->irq_status & s->irq_mask;
+        break;
+    case REG_SD_RISR:      /* Raw Interrupt Status */
+        res = s->irq_status;
+        break;
+    case REG_SD_STAR:      /* Status */
+        res = s->status;
+        break;
+    case REG_SD_FWLR:      /* FIFO Water Level */
+        res = s->fifo_wlevel;
+        break;
+    case REG_SD_FUNS:      /* FIFO Function Select */
+        res = s->fifo_func_sel;
+        break;
+    case REG_SD_DBGC:      /* Debug Enable */
+        res = s->debug_enable;
+        break;
+    case REG_SD_A12A:      /* Auto command 12 argument */
+        res = s->auto12_arg;
+        break;
+    case REG_SD_NTSR:      /* SD NewTiming Set */
+        res = s->newtiming_set;
+        break;
+    case REG_SD_SDBG:      /* SD newTiming Set Debug */
+        res = s->newtiming_debug;
+        break;
+    case REG_SD_HWRST:     /* Hardware Reset Register */
+        res = s->hardware_rst;
+        break;
+    case REG_SD_DMAC:      /* Internal DMA Controller Control */
+        res = s->dmac;
+        break;
+    case REG_SD_DLBA:      /* Descriptor List Base Address */
+        res = s->desc_base;
+        break;
+    case REG_SD_IDST:      /* Internal DMA Controller Status */
+        res = s->dmac_status;
+        break;
+    case REG_SD_IDIE:      /* Internal DMA Controller Interrupt Enable */
+        res = s->dmac_irq;
+        break;
+    case REG_SD_THLDC:     /* Card Threshold Control */
+        res = s->card_threshold;
+        break;
+    case REG_SD_DSBD:      /* eMMC DDR Start Bit Detection Control */
+        res = s->startbit_detect;
+        break;
+    case REG_SD_RES_CRC:   /* Response CRC from card/eMMC */
+        res = s->response_crc;
+        break;
+    case REG_SD_DATA7_CRC: /* CRC Data 7 from card/eMMC */
+    case REG_SD_DATA6_CRC: /* CRC Data 6 from card/eMMC */
+    case REG_SD_DATA5_CRC: /* CRC Data 5 from card/eMMC */
+    case REG_SD_DATA4_CRC: /* CRC Data 4 from card/eMMC */
+    case REG_SD_DATA3_CRC: /* CRC Data 3 from card/eMMC */
+    case REG_SD_DATA2_CRC: /* CRC Data 2 from card/eMMC */
+    case REG_SD_DATA1_CRC: /* CRC Data 1 from card/eMMC */
+    case REG_SD_DATA0_CRC: /* CRC Data 0 from card/eMMC */
+        res = s->data_crc[((offset - REG_SD_DATA7_CRC) / sizeof(uint32_t))];
+        break;
+    case REG_SD_CRC_STA:   /* CRC status from card/eMMC in write operation */
+        res = s->status_crc;
+        break;
+    case REG_SD_FIFO:      /* Read/Write FIFO */
+        if (sdbus_data_ready(&s->sdbus)) {
+            res = sdbus_read_data(&s->sdbus);
+            res |= sdbus_read_data(&s->sdbus) << 8;
+            res |= sdbus_read_data(&s->sdbus) << 16;
+            res |= sdbus_read_data(&s->sdbus) << 24;
+            allwinner_sdhost_update_transfer_cnt(s, sizeof(uint32_t));
+            allwinner_sdhost_auto_stop(s);
+            allwinner_sdhost_update_irq(s);
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: no data ready on SD bus\n",
+                          __func__);
+        }
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset %"
+                      HWADDR_PRIx"\n", __func__, offset);
+        res = 0;
+        break;
+    }
+
+    trace_allwinner_sdhost_read(offset, res, size);
+    return res;
+}
+
+static void allwinner_sdhost_write(void *opaque, hwaddr offset,
+                                   uint64_t value, unsigned size)
+{
+    AwSdHostState *s = AW_SDHOST(opaque);
+
+    trace_allwinner_sdhost_write(offset, value, size);
+
+    switch (offset) {
+    case REG_SD_GCTL:      /* Global Control */
+        s->global_ctl = value;
+        s->global_ctl &= ~(SD_GCTL_DMA_RST | SD_GCTL_FIFO_RST |
+                           SD_GCTL_SOFT_RST);
+        allwinner_sdhost_update_irq(s);
+        break;
+    case REG_SD_CKCR:      /* Clock Control */
+        s->clock_ctl = value;
+        break;
+    case REG_SD_TMOR:      /* Timeout */
+        s->timeout = value;
+        break;
+    case REG_SD_BWDR:      /* Bus Width */
+        s->bus_width = value;
+        break;
+    case REG_SD_BKSR:      /* Block Size */
+        s->block_size = value;
+        break;
+    case REG_SD_BYCR:      /* Byte Count */
+        s->byte_count = value;
+        s->transfer_cnt = value;
+        break;
+    case REG_SD_CMDR:      /* Command */
+        s->command = value;
+        if (value & SD_CMDR_LOAD) {
+            allwinner_sdhost_send_command(s);
+            allwinner_sdhost_dma(s);
+            allwinner_sdhost_auto_stop(s);
+        }
+        allwinner_sdhost_update_irq(s);
+        break;
+    case REG_SD_CAGR:      /* Command Argument */
+        s->command_arg = value;
+        break;
+    case REG_SD_RESP0:     /* Response Zero */
+        s->response[0] = value;
+        break;
+    case REG_SD_RESP1:     /* Response One */
+        s->response[1] = value;
+        break;
+    case REG_SD_RESP2:     /* Response Two */
+        s->response[2] = value;
+        break;
+    case REG_SD_RESP3:     /* Response Three */
+        s->response[3] = value;
+        break;
+    case REG_SD_IMKR:      /* Interrupt Mask */
+        s->irq_mask = value;
+        allwinner_sdhost_update_irq(s);
+        break;
+    case REG_SD_MISR:      /* Masked Interrupt Status */
+    case REG_SD_RISR:      /* Raw Interrupt Status */
+        s->irq_status &= ~value;
+        allwinner_sdhost_update_irq(s);
+        break;
+    case REG_SD_STAR:      /* Status */
+        s->status &= ~value;
+        allwinner_sdhost_update_irq(s);
+        break;
+    case REG_SD_FWLR:      /* FIFO Water Level */
+        s->fifo_wlevel = value;
+        break;
+    case REG_SD_FUNS:      /* FIFO Function Select */
+        s->fifo_func_sel = value;
+        break;
+    case REG_SD_DBGC:      /* Debug Enable */
+        s->debug_enable = value;
+        break;
+    case REG_SD_A12A:      /* Auto command 12 argument */
+        s->auto12_arg = value;
+        break;
+    case REG_SD_NTSR:      /* SD NewTiming Set */
+        s->newtiming_set = value;
+        break;
+    case REG_SD_SDBG:      /* SD newTiming Set Debug */
+        s->newtiming_debug = value;
+        break;
+    case REG_SD_HWRST:     /* Hardware Reset Register */
+        s->hardware_rst = value;
+        break;
+    case REG_SD_DMAC:      /* Internal DMA Controller Control */
+        s->dmac = value;
+        allwinner_sdhost_update_irq(s);
+        break;
+    case REG_SD_DLBA:      /* Descriptor List Base Address */
+        s->desc_base = value;
+        break;
+    case REG_SD_IDST:      /* Internal DMA Controller Status */
+        s->dmac_status &= (~SD_IDST_WR_MASK) | (~value & SD_IDST_WR_MASK);
+        allwinner_sdhost_update_irq(s);
+        break;
+    case REG_SD_IDIE:      /* Internal DMA Controller Interrupt Enable */
+        s->dmac_irq = value;
+        allwinner_sdhost_update_irq(s);
+        break;
+    case REG_SD_THLDC:     /* Card Threshold Control */
+        s->card_threshold = value;
+        break;
+    case REG_SD_DSBD:      /* eMMC DDR Start Bit Detection Control */
+        s->startbit_detect = value;
+        break;
+    case REG_SD_FIFO:      /* Read/Write FIFO */
+        sdbus_write_data(&s->sdbus, value & 0xff);
+        sdbus_write_data(&s->sdbus, (value >> 8) & 0xff);
+        sdbus_write_data(&s->sdbus, (value >> 16) & 0xff);
+        sdbus_write_data(&s->sdbus, (value >> 24) & 0xff);
+        allwinner_sdhost_update_transfer_cnt(s, sizeof(uint32_t));
+        allwinner_sdhost_auto_stop(s);
+        allwinner_sdhost_update_irq(s);
+        break;
+    case REG_SD_RES_CRC:   /* Response CRC from card/eMMC */
+    case REG_SD_DATA7_CRC: /* CRC Data 7 from card/eMMC */
+    case REG_SD_DATA6_CRC: /* CRC Data 6 from card/eMMC */
+    case REG_SD_DATA5_CRC: /* CRC Data 5 from card/eMMC */
+    case REG_SD_DATA4_CRC: /* CRC Data 4 from card/eMMC */
+    case REG_SD_DATA3_CRC: /* CRC Data 3 from card/eMMC */
+    case REG_SD_DATA2_CRC: /* CRC Data 2 from card/eMMC */
+    case REG_SD_DATA1_CRC: /* CRC Data 1 from card/eMMC */
+    case REG_SD_DATA0_CRC: /* CRC Data 0 from card/eMMC */
+    case REG_SD_CRC_STA:   /* CRC status from card/eMMC in write operation */
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset %"
+                      HWADDR_PRIx"\n", __func__, offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps allwinner_sdhost_ops = {
+    .read = allwinner_sdhost_read,
+    .write = allwinner_sdhost_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+    .impl.min_access_size = 4,
+};
+
+static const VMStateDescription vmstate_allwinner_sdhost = {
+    .name = "allwinner-sdhost",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(global_ctl, AwSdHostState),
+        VMSTATE_UINT32(clock_ctl, AwSdHostState),
+        VMSTATE_UINT32(timeout, AwSdHostState),
+        VMSTATE_UINT32(bus_width, AwSdHostState),
+        VMSTATE_UINT32(block_size, AwSdHostState),
+        VMSTATE_UINT32(byte_count, AwSdHostState),
+        VMSTATE_UINT32(transfer_cnt, AwSdHostState),
+        VMSTATE_UINT32(command, AwSdHostState),
+        VMSTATE_UINT32(command_arg, AwSdHostState),
+        VMSTATE_UINT32_ARRAY(response, AwSdHostState, 4),
+        VMSTATE_UINT32(irq_mask, AwSdHostState),
+        VMSTATE_UINT32(irq_status, AwSdHostState),
+        VMSTATE_UINT32(status, AwSdHostState),
+        VMSTATE_UINT32(fifo_wlevel, AwSdHostState),
+        VMSTATE_UINT32(fifo_func_sel, AwSdHostState),
+        VMSTATE_UINT32(debug_enable, AwSdHostState),
+        VMSTATE_UINT32(auto12_arg, AwSdHostState),
+        VMSTATE_UINT32(newtiming_set, AwSdHostState),
+        VMSTATE_UINT32(newtiming_debug, AwSdHostState),
+        VMSTATE_UINT32(hardware_rst, AwSdHostState),
+        VMSTATE_UINT32(dmac, AwSdHostState),
+        VMSTATE_UINT32(desc_base, AwSdHostState),
+        VMSTATE_UINT32(dmac_status, AwSdHostState),
+        VMSTATE_UINT32(dmac_irq, AwSdHostState),
+        VMSTATE_UINT32(card_threshold, AwSdHostState),
+        VMSTATE_UINT32(startbit_detect, AwSdHostState),
+        VMSTATE_UINT32(response_crc, AwSdHostState),
+        VMSTATE_UINT32_ARRAY(data_crc, AwSdHostState, 8),
+        VMSTATE_UINT32(status_crc, AwSdHostState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void allwinner_sdhost_init(Object *obj)
+{
+    AwSdHostState *s = AW_SDHOST(obj);
+
+    qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
+                         TYPE_AW_SDHOST_BUS, DEVICE(s), "sd-bus");
+
+    memory_region_init_io(&s->iomem, obj, &allwinner_sdhost_ops, s,
+                           TYPE_AW_SDHOST, 4 * KiB);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+    sysbus_init_irq(SYS_BUS_DEVICE(s), &s->irq);
+}
+
+static void allwinner_sdhost_reset(DeviceState *dev)
+{
+    AwSdHostState *s = AW_SDHOST(dev);
+
+    s->global_ctl = REG_SD_GCTL_RST;
+    s->clock_ctl = REG_SD_CKCR_RST;
+    s->timeout = REG_SD_TMOR_RST;
+    s->bus_width = REG_SD_BWDR_RST;
+    s->block_size = REG_SD_BKSR_RST;
+    s->byte_count = REG_SD_BYCR_RST;
+    s->transfer_cnt = 0;
+
+    s->command = REG_SD_CMDR_RST;
+    s->command_arg = REG_SD_CAGR_RST;
+
+    for (int i = 0; i < ARRAY_SIZE(s->response); i++) {
+        s->response[i] = REG_SD_RESP_RST;
+    }
+
+    s->irq_mask = REG_SD_IMKR_RST;
+    s->irq_status = REG_SD_RISR_RST;
+    s->status = REG_SD_STAR_RST;
+
+    s->fifo_wlevel = REG_SD_FWLR_RST;
+    s->fifo_func_sel = REG_SD_FUNS_RST;
+    s->debug_enable = REG_SD_DBGC_RST;
+    s->auto12_arg = REG_SD_A12A_RST;
+    s->newtiming_set = REG_SD_NTSR_RST;
+    s->newtiming_debug = REG_SD_SDBG_RST;
+    s->hardware_rst = REG_SD_HWRST_RST;
+    s->dmac = REG_SD_DMAC_RST;
+    s->desc_base = REG_SD_DLBA_RST;
+    s->dmac_status = REG_SD_IDST_RST;
+    s->dmac_irq = REG_SD_IDIE_RST;
+    s->card_threshold = REG_SD_THLDC_RST;
+    s->startbit_detect = REG_SD_DSBD_RST;
+    s->response_crc = REG_SD_RES_CRC_RST;
+
+    for (int i = 0; i < ARRAY_SIZE(s->data_crc); i++) {
+        s->data_crc[i] = REG_SD_DATA_CRC_RST;
+    }
+
+    s->status_crc = REG_SD_CRC_STA_RST;
+}
+
+static void allwinner_sdhost_bus_class_init(ObjectClass *klass, void *data)
+{
+    SDBusClass *sbc = SD_BUS_CLASS(klass);
+
+    sbc->set_inserted = allwinner_sdhost_set_inserted;
+}
+
+static void allwinner_sdhost_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = allwinner_sdhost_reset;
+    dc->vmsd = &vmstate_allwinner_sdhost;
+}
+
+static void allwinner_sdhost_sun4i_class_init(ObjectClass *klass, void *data)
+{
+    AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
+    sc->max_desc_size = 8 * KiB;
+}
+
+static void allwinner_sdhost_sun5i_class_init(ObjectClass *klass, void *data)
+{
+    AwSdHostClass *sc = AW_SDHOST_CLASS(klass);
+    sc->max_desc_size = 64 * KiB;
+}
+
+static TypeInfo allwinner_sdhost_info = {
+    .name          = TYPE_AW_SDHOST,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_init = allwinner_sdhost_init,
+    .instance_size = sizeof(AwSdHostState),
+    .class_init    = allwinner_sdhost_class_init,
+    .class_size    = sizeof(AwSdHostClass),
+    .abstract      = true,
+};
+
+static const TypeInfo allwinner_sdhost_sun4i_info = {
+    .name          = TYPE_AW_SDHOST_SUN4I,
+    .parent        = TYPE_AW_SDHOST,
+    .class_init    = allwinner_sdhost_sun4i_class_init,
+};
+
+static const TypeInfo allwinner_sdhost_sun5i_info = {
+    .name          = TYPE_AW_SDHOST_SUN5I,
+    .parent        = TYPE_AW_SDHOST,
+    .class_init    = allwinner_sdhost_sun5i_class_init,
+};
+
+static const TypeInfo allwinner_sdhost_bus_info = {
+    .name = TYPE_AW_SDHOST_BUS,
+    .parent = TYPE_SD_BUS,
+    .instance_size = sizeof(SDBus),
+    .class_init = allwinner_sdhost_bus_class_init,
+};
+
+static void allwinner_sdhost_register_types(void)
+{
+    type_register_static(&allwinner_sdhost_info);
+    type_register_static(&allwinner_sdhost_sun4i_info);
+    type_register_static(&allwinner_sdhost_sun5i_info);
+    type_register_static(&allwinner_sdhost_bus_info);
+}
+
+type_init(allwinner_sdhost_register_types)
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
     select UNIMP
     select USB_OHCI
     select USB_EHCI_SYSBUS
+    select SD
 
 config RASPI
     bool
diff --git a/hw/sd/trace-events b/hw/sd/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/trace-events
+++ b/hw/sd/trace-events
@@ -XXX,XX +XXX,XX @@
 # See docs/devel/tracing.txt for syntax documentation.
 
+# allwinner-sdhost.c
+allwinner_sdhost_set_inserted(bool inserted) "inserted %u"
+allwinner_sdhost_process_desc(uint64_t desc_addr, uint32_t desc_size, bool is_write, uint32_t max_bytes) "desc_addr 0x%" PRIx64 " desc_size %" PRIu32 " is_write %u max_bytes %" PRIu32
+allwinner_sdhost_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
+allwinner_sdhost_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
+allwinner_sdhost_update_irq(uint32_t irq) "IRQ bits 0x%" PRIx32
+
 # bcm2835_sdhost.c
 bcm2835_sdhost_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 bcm2835_sdhost_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The Allwinner Sun8i System on Chip family includes an Ethernet MAC (EMAC)
which provides 10M/100M/1000M Ethernet connectivity. This commit
adds support for the Allwinner EMAC from the Sun8i family (H2+, H3, A33, etc),
including emulation for the following functionality:

* DMA transfers
 * MII interface
 * Transmit CRC calculation

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-10-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/Makefile.objs                  |   1 +
 include/hw/arm/allwinner-h3.h         |   3 +
 include/hw/net/allwinner-sun8i-emac.h |  99 +++
 hw/arm/allwinner-h3.c                 |  16 +-
 hw/arm/orangepi.c                     |   3 +
 hw/net/allwinner-sun8i-emac.c         | 871 ++++++++++++++++++++++++++
 hw/arm/Kconfig                        |   1 +
 hw/net/Kconfig                        |   3 +
 hw/net/trace-events                   |  10 +
 9 files changed, 1006 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/net/allwinner-sun8i-emac.h
 create mode 100644 hw/net/allwinner-sun8i-emac.c

diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/Makefile.objs
+++ b/hw/net/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_XGMAC) += xgmac.o
 common-obj-$(CONFIG_MIPSNET) += mipsnet.o
 common-obj-$(CONFIG_XILINX_AXI) += xilinx_axienet.o
 common-obj-$(CONFIG_ALLWINNER_EMAC) += allwinner_emac.o
+common-obj-$(CONFIG_ALLWINNER_SUN8I_EMAC) += allwinner-sun8i-emac.o
 common-obj-$(CONFIG_IMX_FEC) += imx_fec.o
 
 common-obj-$(CONFIG_CADENCE) += cadence_gem.o
diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-h3.h
+++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/allwinner-h3-sysctrl.h"
 #include "hw/misc/allwinner-sid.h"
 #include "hw/sd/allwinner-sdhost.h"
+#include "hw/net/allwinner-sun8i-emac.h"
 #include "target/arm/cpu.h"
 
 /**
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_UART1,
     AW_H3_UART2,
     AW_H3_UART3,
+    AW_H3_EMAC,
     AW_H3_GIC_DIST,
     AW_H3_GIC_CPU,
     AW_H3_GIC_HYP,
@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
     AwH3SysCtrlState sysctrl;
     AwSidState sid;
     AwSdHostState mmc0;
+    AwSun8iEmacState emac;
     GICState gic;
     MemoryRegion sram_a1;
     MemoryRegion sram_a2;
diff --git a/include/hw/net/allwinner-sun8i-emac.h b/include/hw/net/allwinner-sun8i-emac.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/net/allwinner-sun8i-emac.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner Sun8i Ethernet MAC emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_NET_ALLWINNER_SUN8I_EMAC_H
+#define HW_NET_ALLWINNER_SUN8I_EMAC_H
+
+#include "qom/object.h"
+#include "net/net.h"
+#include "hw/sysbus.h"
+
+/**
+ * Object model
+ * @{
+ */
+
+#define TYPE_AW_SUN8I_EMAC "allwinner-sun8i-emac"
+#define AW_SUN8I_EMAC(obj) \
+    OBJECT_CHECK(AwSun8iEmacState, (obj), TYPE_AW_SUN8I_EMAC)
+
+/** @} */
+
+/**
+ * Allwinner Sun8i EMAC object instance state
+ */
+typedef struct AwSun8iEmacState {
+    /*< private >*/
+    SysBusDevice  parent_obj;
+    /*< public >*/
+
+    /** Maps I/O registers in physical memory */
+    MemoryRegion iomem;
+
+    /** Interrupt output signal to notify CPU */
+    qemu_irq     irq;
+
+    /** Generic Network Interface Controller (NIC) for networking API */
+    NICState     *nic;
+
+    /** Generic Network Interface Controller (NIC) configuration */
+    NICConf      conf;
+
+    /**
+     * @name Media Independent Interface (MII)
+     * @{
+     */
+
+    uint8_t      mii_phy_addr;  /**< PHY address */
+    uint32_t     mii_cr;        /**< Control */
+    uint32_t     mii_st;        /**< Status */
+    uint32_t     mii_adv;       /**< Advertised Abilities */
+
+    /** @} */
+
+    /**
+     * @name Hardware Registers
+     * @{
+     */
+
+    uint32_t     basic_ctl0;    /**< Basic Control 0 */
+    uint32_t     basic_ctl1;    /**< Basic Control 1 */
+    uint32_t     int_en;        /**< Interrupt Enable */
+    uint32_t     int_sta;       /**< Interrupt Status */
+    uint32_t     frm_flt;       /**< Receive Frame Filter */
+
+    uint32_t     rx_ctl0;       /**< Receive Control 0 */
+    uint32_t     rx_ctl1;       /**< Receive Control 1 */
+    uint32_t     rx_desc_head;  /**< Receive Descriptor List Address */
+    uint32_t     rx_desc_curr;  /**< Current Receive Descriptor Address */
+
+    uint32_t     tx_ctl0;       /**< Transmit Control 0 */
+    uint32_t     tx_ctl1;       /**< Transmit Control 1 */
+    uint32_t     tx_desc_head;  /**< Transmit Descriptor List Address */
+    uint32_t     tx_desc_curr;  /**< Current Transmit Descriptor Address */
+    uint32_t     tx_flowctl;    /**< Transmit Flow Control */
+
+    uint32_t     mii_cmd;       /**< Management Interface Command */
+    uint32_t     mii_data;      /**< Management Interface Data */
+
+    /** @} */
+
+} AwSun8iEmacState;
+
+#endif /* HW_NET_ALLWINNER_SUN8I_H */
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
     [AW_H3_UART1]      = 0x01c28400,
     [AW_H3_UART2]      = 0x01c28800,
     [AW_H3_UART3]      = 0x01c28c00,
+    [AW_H3_EMAC]       = 0x01c30000,
     [AW_H3_GIC_DIST]   = 0x01c81000,
     [AW_H3_GIC_CPU]    = 0x01c82000,
     [AW_H3_GIC_HYP]    = 0x01c84000,
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
     { "twi1",      0x01c2b000, 1 * KiB },
     { "twi2",      0x01c2b400, 1 * KiB },
     { "scr",       0x01c2c400, 1 * KiB },
-    { "emac",      0x01c30000, 64 * KiB },
     { "gpu",       0x01c40000, 64 * KiB },
     { "hstmr",     0x01c60000, 4 * KiB },
     { "dramcom",   0x01c62000, 4 * KiB },
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_GIC_SPI_OHCI2     = 77,
     AW_H3_GIC_SPI_EHCI3     = 78,
     AW_H3_GIC_SPI_OHCI3     = 79,
+    AW_H3_GIC_SPI_EMAC      = 82
 };
 
 /* Allwinner H3 general constants */
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
 
     sysbus_init_child_obj(obj, "mmc0", &s->mmc0, sizeof(s->mmc0),
                           TYPE_AW_SDHOST_SUN5I);
+
+    sysbus_init_child_obj(obj, "emac", &s->emac, sizeof(s->emac),
+                          TYPE_AW_SUN8I_EMAC);
 }
 
 static void allwinner_h3_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
     object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->mmc0),
                               "sd-bus", &error_abort);
 
+    /* EMAC */
+    if (nd_table[0].used) {
+        qemu_check_nic_model(&nd_table[0], TYPE_AW_SUN8I_EMAC);
+        qdev_set_nic_properties(DEVICE(&s->emac), &nd_table[0]);
+    }
+    qdev_init_nofail(DEVICE(&s->emac));
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->emac), 0, s->memmap[AW_H3_EMAC]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->emac), 0,
+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_EMAC));
+
     /* Universal Serial Bus */
     sysbus_create_simple(TYPE_AW_H3_EHCI, s->memmap[AW_H3_EHCI0],
                          qdev_get_gpio_in(DEVICE(&s->gic),
diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/orangepi.c
+++ b/hw/arm/orangepi.c
@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)
         warn_report("Security Identifier value does not include H3 prefix");
     }
 
+    /* Setup EMAC properties */
+    object_property_set_int(OBJECT(&h3->emac), 1, "phy-addr", &error_abort);
+
     /* Mark H3 object realized */
     object_property_set_bool(OBJECT(h3), true, "realized", &error_abort);
 
diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/net/allwinner-sun8i-emac.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner Sun8i Ethernet MAC emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "hw/sysbus.h"
+#include "migration/vmstate.h"
+#include "net/net.h"
+#include "hw/irq.h"
+#include "hw/qdev-properties.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "net/checksum.h"
+#include "qemu/module.h"
+#include "exec/cpu-common.h"
+#include "hw/net/allwinner-sun8i-emac.h"
+
+/* EMAC register offsets */
+enum {
+    REG_BASIC_CTL_0        = 0x0000, /* Basic Control 0 */
+    REG_BASIC_CTL_1        = 0x0004, /* Basic Control 1 */
+    REG_INT_STA            = 0x0008, /* Interrupt Status */
+    REG_INT_EN             = 0x000C, /* Interrupt Enable */
+    REG_TX_CTL_0           = 0x0010, /* Transmit Control 0 */
+    REG_TX_CTL_1           = 0x0014, /* Transmit Control 1 */
+    REG_TX_FLOW_CTL        = 0x001C, /* Transmit Flow Control */
+    REG_TX_DMA_DESC_LIST   = 0x0020, /* Transmit Descriptor List Address */
+    REG_RX_CTL_0           = 0x0024, /* Receive Control 0 */
+    REG_RX_CTL_1           = 0x0028, /* Receive Control 1 */
+    REG_RX_DMA_DESC_LIST   = 0x0034, /* Receive Descriptor List Address */
+    REG_FRM_FLT            = 0x0038, /* Receive Frame Filter */
+    REG_RX_HASH_0          = 0x0040, /* Receive Hash Table 0 */
+    REG_RX_HASH_1          = 0x0044, /* Receive Hash Table 1 */
+    REG_MII_CMD            = 0x0048, /* Management Interface Command */
+    REG_MII_DATA           = 0x004C, /* Management Interface Data */
+    REG_ADDR_HIGH          = 0x0050, /* MAC Address High */
+    REG_ADDR_LOW           = 0x0054, /* MAC Address Low */
+    REG_TX_DMA_STA         = 0x00B0, /* Transmit DMA Status */
+    REG_TX_CUR_DESC        = 0x00B4, /* Transmit Current Descriptor */
+    REG_TX_CUR_BUF         = 0x00B8, /* Transmit Current Buffer */
+    REG_RX_DMA_STA         = 0x00C0, /* Receive DMA Status */
+    REG_RX_CUR_DESC        = 0x00C4, /* Receive Current Descriptor */
+    REG_RX_CUR_BUF         = 0x00C8, /* Receive Current Buffer */
+    REG_RGMII_STA          = 0x00D0, /* RGMII Status */
+};
+
+/* EMAC register flags */
+enum {
+    BASIC_CTL0_100Mbps     = (0b11 << 2),
+    BASIC_CTL0_FD          = (1 << 0),
+    BASIC_CTL1_SOFTRST     = (1 << 0),
+};
+
+enum {
+    INT_STA_RGMII_LINK     = (1 << 16),
+    INT_STA_RX_EARLY       = (1 << 13),
+    INT_STA_RX_OVERFLOW    = (1 << 12),
+    INT_STA_RX_TIMEOUT     = (1 << 11),
+    INT_STA_RX_DMA_STOP    = (1 << 10),
+    INT_STA_RX_BUF_UA      = (1 << 9),
+    INT_STA_RX             = (1 << 8),
+    INT_STA_TX_EARLY       = (1 << 5),
+    INT_STA_TX_UNDERFLOW   = (1 << 4),
+    INT_STA_TX_TIMEOUT     = (1 << 3),
+    INT_STA_TX_BUF_UA      = (1 << 2),
+    INT_STA_TX_DMA_STOP    = (1 << 1),
+    INT_STA_TX             = (1 << 0),
+};
+
+enum {
+    INT_EN_RX_EARLY        = (1 << 13),
+    INT_EN_RX_OVERFLOW     = (1 << 12),
+    INT_EN_RX_TIMEOUT      = (1 << 11),
+    INT_EN_RX_DMA_STOP     = (1 << 10),
+    INT_EN_RX_BUF_UA       = (1 << 9),
+    INT_EN_RX              = (1 << 8),
+    INT_EN_TX_EARLY        = (1 << 5),
+    INT_EN_TX_UNDERFLOW    = (1 << 4),
+    INT_EN_TX_TIMEOUT      = (1 << 3),
+    INT_EN_TX_BUF_UA       = (1 << 2),
+    INT_EN_TX_DMA_STOP     = (1 << 1),
+    INT_EN_TX              = (1 << 0),
+};
+
+enum {
+    TX_CTL0_TX_EN          = (1 << 31),
+    TX_CTL1_TX_DMA_START   = (1 << 31),
+    TX_CTL1_TX_DMA_EN      = (1 << 30),
+    TX_CTL1_TX_FLUSH       = (1 << 0),
+};
+
+enum {
+    RX_CTL0_RX_EN          = (1 << 31),
+    RX_CTL0_STRIP_FCS      = (1 << 28),
+    RX_CTL0_CRC_IPV4       = (1 << 27),
+};
+
+enum {
+    RX_CTL1_RX_DMA_START   = (1 << 31),
+    RX_CTL1_RX_DMA_EN      = (1 << 30),
+    RX_CTL1_RX_MD          = (1 << 1),
+};
+
+enum {
+    RX_FRM_FLT_DIS_ADDR    = (1 << 31),
+};
+
+enum {
+    MII_CMD_PHY_ADDR_SHIFT = (12),
+    MII_CMD_PHY_ADDR_MASK  = (0xf000),
+    MII_CMD_PHY_REG_SHIFT  = (4),
+    MII_CMD_PHY_REG_MASK   = (0xf0),
+    MII_CMD_PHY_RW         = (1 << 1),
+    MII_CMD_PHY_BUSY       = (1 << 0),
+};
+
+enum {
+    TX_DMA_STA_STOP        = (0b000),
+    TX_DMA_STA_RUN_FETCH   = (0b001),
+    TX_DMA_STA_WAIT_STA    = (0b010),
+};
+
+enum {
+    RX_DMA_STA_STOP        = (0b000),
+    RX_DMA_STA_RUN_FETCH   = (0b001),
+    RX_DMA_STA_WAIT_FRM    = (0b011),
+};
+
+/* EMAC register reset values */
+enum {
+    REG_BASIC_CTL_1_RST    = 0x08000000,
+};
+
+/* EMAC constants */
+enum {
+    AW_SUN8I_EMAC_MIN_PKT_SZ  = 64
+};
+
+/* Transmit/receive frame descriptor */
+typedef struct FrameDescriptor {
+    uint32_t status;
+    uint32_t status2;
+    uint32_t addr;
+    uint32_t next;
+} FrameDescriptor;
+
+/* Frame descriptor flags */
+enum {
+    DESC_STATUS_CTL                 = (1 << 31),
+    DESC_STATUS2_BUF_SIZE_MASK      = (0x7ff),
+};
+
+/* Transmit frame descriptor flags */
+enum {
+    TX_DESC_STATUS_LENGTH_ERR       = (1 << 14),
+    TX_DESC_STATUS2_FIRST_DESC      = (1 << 29),
+    TX_DESC_STATUS2_LAST_DESC       = (1 << 30),
+    TX_DESC_STATUS2_CHECKSUM_MASK   = (0x3 << 27),
+};
+
+/* Receive frame descriptor flags */
+enum {
+    RX_DESC_STATUS_FIRST_DESC       = (1 << 9),
+    RX_DESC_STATUS_LAST_DESC        = (1 << 8),
+    RX_DESC_STATUS_FRM_LEN_MASK     = (0x3fff0000),
+    RX_DESC_STATUS_FRM_LEN_SHIFT    = (16),
+    RX_DESC_STATUS_NO_BUF           = (1 << 14),
+    RX_DESC_STATUS_HEADER_ERR       = (1 << 7),
+    RX_DESC_STATUS_LENGTH_ERR       = (1 << 4),
+    RX_DESC_STATUS_CRC_ERR          = (1 << 1),
+    RX_DESC_STATUS_PAYLOAD_ERR      = (1 << 0),
+    RX_DESC_STATUS2_RX_INT_CTL      = (1 << 31),
+};
+
+/* MII register offsets */
+enum {
+    MII_REG_CR                      = (0x0), /* Control */
+    MII_REG_ST                      = (0x1), /* Status */
+    MII_REG_ID_HIGH                 = (0x2), /* Identifier High */
+    MII_REG_ID_LOW                  = (0x3), /* Identifier Low */
+    MII_REG_ADV                     = (0x4), /* Advertised abilities */
+    MII_REG_LPA                     = (0x5), /* Link partner abilities */
+};
+
+/* MII register flags */
+enum {
+    MII_REG_CR_RESET                = (1 << 15),
+    MII_REG_CR_POWERDOWN            = (1 << 11),
+    MII_REG_CR_10Mbit               = (0),
+    MII_REG_CR_100Mbit              = (1 << 13),
+    MII_REG_CR_1000Mbit             = (1 << 6),
+    MII_REG_CR_AUTO_NEG             = (1 << 12),
+    MII_REG_CR_AUTO_NEG_RESTART     = (1 << 9),
+    MII_REG_CR_FULLDUPLEX           = (1 << 8),
+};
+
+enum {
+    MII_REG_ST_100BASE_T4           = (1 << 15),
+    MII_REG_ST_100BASE_X_FD         = (1 << 14),
+    MII_REG_ST_100BASE_X_HD         = (1 << 13),
+    MII_REG_ST_10_FD                = (1 << 12),
+    MII_REG_ST_10_HD                = (1 << 11),
+    MII_REG_ST_100BASE_T2_FD        = (1 << 10),
+    MII_REG_ST_100BASE_T2_HD        = (1 << 9),
+    MII_REG_ST_AUTONEG_COMPLETE     = (1 << 5),
+    MII_REG_ST_AUTONEG_AVAIL        = (1 << 3),
+    MII_REG_ST_LINK_UP              = (1 << 2),
+};
+
+enum {
+    MII_REG_LPA_10_HD               = (1 << 5),
+    MII_REG_LPA_10_FD               = (1 << 6),
+    MII_REG_LPA_100_HD              = (1 << 7),
+    MII_REG_LPA_100_FD              = (1 << 8),
+    MII_REG_LPA_PAUSE               = (1 << 10),
+    MII_REG_LPA_ASYMPAUSE           = (1 << 11),
+};
+
+/* MII constants */
+enum {
+    MII_PHY_ID_HIGH                 = 0x0044,
+    MII_PHY_ID_LOW                  = 0x1400,
+};
+
+static void allwinner_sun8i_emac_mii_set_link(AwSun8iEmacState *s,
+                                              bool link_active)
+{
+    if (link_active) {
+        s->mii_st |= MII_REG_ST_LINK_UP;
+    } else {
+        s->mii_st &= ~MII_REG_ST_LINK_UP;
+    }
+}
+
+static void allwinner_sun8i_emac_mii_reset(AwSun8iEmacState *s,
+                                           bool link_active)
+{
+    s->mii_cr = MII_REG_CR_100Mbit | MII_REG_CR_AUTO_NEG |
+                MII_REG_CR_FULLDUPLEX;
+    s->mii_st = MII_REG_ST_100BASE_T4 | MII_REG_ST_100BASE_X_FD |
+                MII_REG_ST_100BASE_X_HD | MII_REG_ST_10_FD | MII_REG_ST_10_HD |
+                MII_REG_ST_100BASE_T2_FD | MII_REG_ST_100BASE_T2_HD |
+                MII_REG_ST_AUTONEG_COMPLETE | MII_REG_ST_AUTONEG_AVAIL;
+    s->mii_adv = 0;
+
+    allwinner_sun8i_emac_mii_set_link(s, link_active);
+}
+
+static void allwinner_sun8i_emac_mii_cmd(AwSun8iEmacState *s)
+{
+    uint8_t addr, reg;
+
+    addr = (s->mii_cmd & MII_CMD_PHY_ADDR_MASK) >> MII_CMD_PHY_ADDR_SHIFT;
+    reg = (s->mii_cmd & MII_CMD_PHY_REG_MASK) >> MII_CMD_PHY_REG_SHIFT;
+
+    if (addr != s->mii_phy_addr) {
+        return;
+    }
+
+    /* Read or write a PHY register? */
+    if (s->mii_cmd & MII_CMD_PHY_RW) {
+        trace_allwinner_sun8i_emac_mii_write_reg(reg, s->mii_data);
+
+        switch (reg) {
+        case MII_REG_CR:
+            if (s->mii_data & MII_REG_CR_RESET) {
+                allwinner_sun8i_emac_mii_reset(s, s->mii_st &
+                                                  MII_REG_ST_LINK_UP);
+            } else {
+                s->mii_cr = s->mii_data & ~(MII_REG_CR_RESET |
+                                            MII_REG_CR_AUTO_NEG_RESTART);
+            }
+            break;
+        case MII_REG_ADV:
+            s->mii_adv = s->mii_data;
+            break;
+        case MII_REG_ID_HIGH:
+        case MII_REG_ID_LOW:
+        case MII_REG_LPA:
+            break;
+        default:
+            qemu_log_mask(LOG_UNIMP, "allwinner-h3-emac: write access to "
+                                     "unknown MII register 0x%x\n", reg);
+            break;
+        }
+    } else {
+        switch (reg) {
+        case MII_REG_CR:
+            s->mii_data = s->mii_cr;
+            break;
+        case MII_REG_ST:
+            s->mii_data = s->mii_st;
+            break;
+        case MII_REG_ID_HIGH:
+            s->mii_data = MII_PHY_ID_HIGH;
+            break;
+        case MII_REG_ID_LOW:
+            s->mii_data = MII_PHY_ID_LOW;
+            break;
+        case MII_REG_ADV:
+            s->mii_data = s->mii_adv;
+            break;
+        case MII_REG_LPA:
+            s->mii_data = MII_REG_LPA_10_HD | MII_REG_LPA_10_FD |
+                          MII_REG_LPA_100_HD | MII_REG_LPA_100_FD |
+                          MII_REG_LPA_PAUSE | MII_REG_LPA_ASYMPAUSE;
+            break;
+        default:
+            qemu_log_mask(LOG_UNIMP, "allwinner-h3-emac: read access to "
+                                     "unknown MII register 0x%x\n", reg);
+            s->mii_data = 0;
+            break;
+        }
+
+        trace_allwinner_sun8i_emac_mii_read_reg(reg, s->mii_data);
+    }
+}
+
+static void allwinner_sun8i_emac_update_irq(AwSun8iEmacState *s)
+{
+    qemu_set_irq(s->irq, (s->int_sta & s->int_en) != 0);
+}
+
+static uint32_t allwinner_sun8i_emac_next_desc(FrameDescriptor *desc,
+                                               size_t min_size)
+{
+    uint32_t paddr = desc->next;
+
+    cpu_physical_memory_read(paddr, desc, sizeof(*desc));
+
+    if ((desc->status & DESC_STATUS_CTL) &&
+        (desc->status2 & DESC_STATUS2_BUF_SIZE_MASK) >= min_size) {
+        return paddr;
+    } else {
+        return 0;
+    }
+}
+
+static uint32_t allwinner_sun8i_emac_get_desc(FrameDescriptor *desc,
+                                              uint32_t start_addr,
+                                              size_t min_size)
+{
+    uint32_t desc_addr = start_addr;
+
+    /* Note that the list is a cycle. Last entry points back to the head. */
+    while (desc_addr != 0) {
+        cpu_physical_memory_read(desc_addr, desc, sizeof(*desc));
+
+        if ((desc->status & DESC_STATUS_CTL) &&
+            (desc->status2 & DESC_STATUS2_BUF_SIZE_MASK) >= min_size) {
+            return desc_addr;
+        } else if (desc->next == start_addr) {
+            break;
+        } else {
+            desc_addr = desc->next;
+        }
+    }
+
+    return 0;
+}
+
+static uint32_t allwinner_sun8i_emac_rx_desc(AwSun8iEmacState *s,
+                                             FrameDescriptor *desc,
+                                             size_t min_size)
+{
+    return allwinner_sun8i_emac_get_desc(desc, s->rx_desc_curr, min_size);
+}
+
+static uint32_t allwinner_sun8i_emac_tx_desc(AwSun8iEmacState *s,
+                                             FrameDescriptor *desc,
+                                             size_t min_size)
+{
+    return allwinner_sun8i_emac_get_desc(desc, s->tx_desc_head, min_size);
+}
+
+static void allwinner_sun8i_emac_flush_desc(FrameDescriptor *desc,
+                                            uint32_t phys_addr)
+{
+    cpu_physical_memory_write(phys_addr, desc, sizeof(*desc));
+}
+
+static int allwinner_sun8i_emac_can_receive(NetClientState *nc)
+{
+    AwSun8iEmacState *s = qemu_get_nic_opaque(nc);
+    FrameDescriptor desc;
+
+    return (s->rx_ctl0 & RX_CTL0_RX_EN) &&
+           (allwinner_sun8i_emac_rx_desc(s, &desc, 0) != 0);
+}
+
+static ssize_t allwinner_sun8i_emac_receive(NetClientState *nc,
+                                            const uint8_t *buf,
+                                            size_t size)
+{
+    AwSun8iEmacState *s = qemu_get_nic_opaque(nc);
+    FrameDescriptor desc;
+    size_t bytes_left = size;
+    size_t desc_bytes = 0;
+    size_t pad_fcs_size = 4;
+    size_t padding = 0;
+
+    if (!(s->rx_ctl0 & RX_CTL0_RX_EN)) {
+        return -1;
+    }
+
+    s->rx_desc_curr = allwinner_sun8i_emac_rx_desc(s, &desc,
+                                                   AW_SUN8I_EMAC_MIN_PKT_SZ);
+    if (!s->rx_desc_curr) {
+        s->int_sta |= INT_STA_RX_BUF_UA;
+    }
+
+    /* Keep filling RX descriptors until the whole frame is written */
+    while (s->rx_desc_curr && bytes_left > 0) {
+        desc.status &= ~DESC_STATUS_CTL;
+        desc.status &= ~RX_DESC_STATUS_FRM_LEN_MASK;
+
+        if (bytes_left == size) {
+            desc.status |= RX_DESC_STATUS_FIRST_DESC;
+        }
+
+        if ((desc.status2 & DESC_STATUS2_BUF_SIZE_MASK) <
+            (bytes_left + pad_fcs_size)) {
+            desc_bytes = desc.status2 & DESC_STATUS2_BUF_SIZE_MASK;
+            desc.status |= desc_bytes << RX_DESC_STATUS_FRM_LEN_SHIFT;
+        } else {
+            padding = pad_fcs_size;
+            if (bytes_left < AW_SUN8I_EMAC_MIN_PKT_SZ) {
+                padding += (AW_SUN8I_EMAC_MIN_PKT_SZ - bytes_left);
+            }
+
+            desc_bytes = (bytes_left);
+            desc.status |= RX_DESC_STATUS_LAST_DESC;
+            desc.status |= (bytes_left + padding)
+                            << RX_DESC_STATUS_FRM_LEN_SHIFT;
+        }
+
+        cpu_physical_memory_write(desc.addr, buf, desc_bytes);
+        allwinner_sun8i_emac_flush_desc(&desc, s->rx_desc_curr);
+        trace_allwinner_sun8i_emac_receive(s->rx_desc_curr, desc.addr,
+                                           desc_bytes);
+
+        /* Check if frame needs to raise the receive interrupt */
+        if (!(desc.status2 & RX_DESC_STATUS2_RX_INT_CTL)) {
+            s->int_sta |= INT_STA_RX;
+        }
+
+        /* Increment variables */
+        buf += desc_bytes;
+        bytes_left -= desc_bytes;
+
+        /* Move to the next descriptor */
+        s->rx_desc_curr = allwinner_sun8i_emac_next_desc(&desc, 64);
+        if (!s->rx_desc_curr) {
+            /* Not enough buffer space available */
+            s->int_sta |= INT_STA_RX_BUF_UA;
+            s->rx_desc_curr = s->rx_desc_head;
+            break;
+        }
+    }
+
+    /* Report receive DMA is finished */
+    s->rx_ctl1 &= ~RX_CTL1_RX_DMA_START;
+    allwinner_sun8i_emac_update_irq(s);
+
+    return size;
+}
+
+static void allwinner_sun8i_emac_transmit(AwSun8iEmacState *s)
+{
+    NetClientState *nc = qemu_get_queue(s->nic);
+    FrameDescriptor desc;
+    size_t bytes = 0;
+    size_t packet_bytes = 0;
+    size_t transmitted = 0;
+    static uint8_t packet_buf[2048];
+
+    s->tx_desc_curr = allwinner_sun8i_emac_tx_desc(s, &desc, 0);
+
+    /* Read all transmit descriptors */
+    while (s->tx_desc_curr != 0) {
+
+        /* Read from physical memory into packet buffer */
+        bytes = desc.status2 & DESC_STATUS2_BUF_SIZE_MASK;
+        if (bytes + packet_bytes > sizeof(packet_buf)) {
+            desc.status |= TX_DESC_STATUS_LENGTH_ERR;
+            break;
+        }
+        cpu_physical_memory_read(desc.addr, packet_buf + packet_bytes, bytes);
+        packet_bytes += bytes;
+        desc.status &= ~DESC_STATUS_CTL;
+        allwinner_sun8i_emac_flush_desc(&desc, s->tx_desc_curr);
+
+        /* After the last descriptor, send the packet */
+        if (desc.status2 & TX_DESC_STATUS2_LAST_DESC) {
+            if (desc.status2 & TX_DESC_STATUS2_CHECKSUM_MASK) {
+                net_checksum_calculate(packet_buf, packet_bytes);
+            }
+
+            qemu_send_packet(nc, packet_buf, packet_bytes);
+            trace_allwinner_sun8i_emac_transmit(s->tx_desc_curr, desc.addr,
+                                                bytes);
+
+            packet_bytes = 0;
+            transmitted++;
+        }
+        s->tx_desc_curr = allwinner_sun8i_emac_next_desc(&desc, 0);
+    }
+
+    /* Raise transmit completed interrupt */
+    if (transmitted > 0) {
+        s->int_sta |= INT_STA_TX;
+        s->tx_ctl1 &= ~TX_CTL1_TX_DMA_START;
+        allwinner_sun8i_emac_update_irq(s);
+    }
+}
+
+static void allwinner_sun8i_emac_reset(DeviceState *dev)
+{
+    AwSun8iEmacState *s = AW_SUN8I_EMAC(dev);
+    NetClientState *nc = qemu_get_queue(s->nic);
+
+    trace_allwinner_sun8i_emac_reset();
+
+    s->mii_cmd = 0;
+    s->mii_data = 0;
+    s->basic_ctl0 = 0;
+    s->basic_ctl1 = REG_BASIC_CTL_1_RST;
+    s->int_en = 0;
+    s->int_sta = 0;
+    s->frm_flt = 0;
+    s->rx_ctl0 = 0;
+    s->rx_ctl1 = RX_CTL1_RX_MD;
+    s->rx_desc_head = 0;
+    s->rx_desc_curr = 0;
+    s->tx_ctl0 = 0;
+    s->tx_ctl1 = 0;
+    s->tx_desc_head = 0;
+    s->tx_desc_curr = 0;
+    s->tx_flowctl = 0;
+
+    allwinner_sun8i_emac_mii_reset(s, !nc->link_down);
+}
+
+static uint64_t allwinner_sun8i_emac_read(void *opaque, hwaddr offset,
+                                          unsigned size)
+{
+    AwSun8iEmacState *s = AW_SUN8I_EMAC(opaque);
+    uint64_t value = 0;
+    FrameDescriptor desc;
+
+    switch (offset) {
+    case REG_BASIC_CTL_0:       /* Basic Control 0 */
+        value = s->basic_ctl0;
+        break;
+    case REG_BASIC_CTL_1:       /* Basic Control 1 */
+        value = s->basic_ctl1;
+        break;
+    case REG_INT_STA:           /* Interrupt Status */
+        value = s->int_sta;
+        break;
+    case REG_INT_EN:            /* Interupt Enable */
+        value = s->int_en;
+        break;
+    case REG_TX_CTL_0:          /* Transmit Control 0 */
+        value = s->tx_ctl0;
+        break;
+    case REG_TX_CTL_1:          /* Transmit Control 1 */
+        value = s->tx_ctl1;
+        break;
+    case REG_TX_FLOW_CTL:       /* Transmit Flow Control */
+        value = s->tx_flowctl;
+        break;
+    case REG_TX_DMA_DESC_LIST:  /* Transmit Descriptor List Address */
+        value = s->tx_desc_head;
+        break;
+    case REG_RX_CTL_0:          /* Receive Control 0 */
+        value = s->rx_ctl0;
+        break;
+    case REG_RX_CTL_1:          /* Receive Control 1 */
+        value = s->rx_ctl1;
+        break;
+    case REG_RX_DMA_DESC_LIST:  /* Receive Descriptor List Address */
+        value = s->rx_desc_head;
+        break;
+    case REG_FRM_FLT:           /* Receive Frame Filter */
+        value = s->frm_flt;
+        break;
+    case REG_RX_HASH_0:         /* Receive Hash Table 0 */
+    case REG_RX_HASH_1:         /* Receive Hash Table 1 */
+        break;
+    case REG_MII_CMD:           /* Management Interface Command */
+        value = s->mii_cmd;
+        break;
+    case REG_MII_DATA:          /* Management Interface Data */
+        value = s->mii_data;
+        break;
+    case REG_ADDR_HIGH:         /* MAC Address High */
+        value = *(((uint32_t *) (s->conf.macaddr.a)) + 1);
+        break;
+    case REG_ADDR_LOW:          /* MAC Address Low */
+        value = *(uint32_t *) (s->conf.macaddr.a);
+        break;
+    case REG_TX_DMA_STA:        /* Transmit DMA Status */
+        break;
+    case REG_TX_CUR_DESC:       /* Transmit Current Descriptor */
+        value = s->tx_desc_curr;
+        break;
+    case REG_TX_CUR_BUF:        /* Transmit Current Buffer */
+        if (s->tx_desc_curr != 0) {
+            cpu_physical_memory_read(s->tx_desc_curr, &desc, sizeof(desc));
+            value = desc.addr;
+        } else {
+            value = 0;
+        }
+        break;
+    case REG_RX_DMA_STA:        /* Receive DMA Status */
+        break;
+    case REG_RX_CUR_DESC:       /* Receive Current Descriptor */
+        value = s->rx_desc_curr;
+        break;
+    case REG_RX_CUR_BUF:        /* Receive Current Buffer */
+        if (s->rx_desc_curr != 0) {
+            cpu_physical_memory_read(s->rx_desc_curr, &desc, sizeof(desc));
+            value = desc.addr;
+        } else {
+            value = 0;
+        }
+        break;
+    case REG_RGMII_STA:         /* RGMII Status */
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "allwinner-h3-emac: read access to unknown "
+                                 "EMAC register 0x" TARGET_FMT_plx "\n",
+                                  offset);
+    }
+
+    trace_allwinner_sun8i_emac_read(offset, value);
+    return value;
+}
+
+static void allwinner_sun8i_emac_write(void *opaque, hwaddr offset,
+                                       uint64_t value, unsigned size)
+{
+    AwSun8iEmacState *s = AW_SUN8I_EMAC(opaque);
+    NetClientState *nc = qemu_get_queue(s->nic);
+
+    trace_allwinner_sun8i_emac_write(offset, value);
+
+    switch (offset) {
+    case REG_BASIC_CTL_0:       /* Basic Control 0 */
+        s->basic_ctl0 = value;
+        break;
+    case REG_BASIC_CTL_1:       /* Basic Control 1 */
+        if (value & BASIC_CTL1_SOFTRST) {
+            allwinner_sun8i_emac_reset(DEVICE(s));
+            value &= ~BASIC_CTL1_SOFTRST;
+        }
+        s->basic_ctl1 = value;
+        if (allwinner_sun8i_emac_can_receive(nc)) {
+            qemu_flush_queued_packets(nc);
+        }
+        break;
+    case REG_INT_STA:           /* Interrupt Status */
+        s->int_sta &= ~value;
+        allwinner_sun8i_emac_update_irq(s);
+        break;
+    case REG_INT_EN:            /* Interrupt Enable */
+        s->int_en = value;
+        allwinner_sun8i_emac_update_irq(s);
+        break;
+    case REG_TX_CTL_0:          /* Transmit Control 0 */
+        s->tx_ctl0 = value;
+        break;
+    case REG_TX_CTL_1:          /* Transmit Control 1 */
+        s->tx_ctl1 = value;
+        if (value & TX_CTL1_TX_DMA_EN) {
+            allwinner_sun8i_emac_transmit(s);
+        }
+        break;
+    case REG_TX_FLOW_CTL:       /* Transmit Flow Control */
+        s->tx_flowctl = value;
+        break;
+    case REG_TX_DMA_DESC_LIST:  /* Transmit Descriptor List Address */
+        s->tx_desc_head = value;
+        s->tx_desc_curr = value;
+        break;
+    case REG_RX_CTL_0:          /* Receive Control 0 */
+        s->rx_ctl0 = value;
+        break;
+    case REG_RX_CTL_1:          /* Receive Control 1 */
+        s->rx_ctl1 = value | RX_CTL1_RX_MD;
+        if ((value & RX_CTL1_RX_DMA_EN) &&
+             allwinner_sun8i_emac_can_receive(nc)) {
+            qemu_flush_queued_packets(nc);
+        }
+        break;
+    case REG_RX_DMA_DESC_LIST:  /* Receive Descriptor List Address */
+        s->rx_desc_head = value;
+        s->rx_desc_curr = value;
+        break;
+    case REG_FRM_FLT:           /* Receive Frame Filter */
+        s->frm_flt = value;
+        break;
+    case REG_RX_HASH_0:         /* Receive Hash Table 0 */
+    case REG_RX_HASH_1:         /* Receive Hash Table 1 */
+        break;
+    case REG_MII_CMD:           /* Management Interface Command */
+        s->mii_cmd = value & ~MII_CMD_PHY_BUSY;
+        allwinner_sun8i_emac_mii_cmd(s);
+        break;
+    case REG_MII_DATA:          /* Management Interface Data */
+        s->mii_data = value;
+        break;
+    case REG_ADDR_HIGH:         /* MAC Address High */
+        s->conf.macaddr.a[4] = (value & 0xff);
+        s->conf.macaddr.a[5] = (value & 0xff00) >> 8;
+        break;
+    case REG_ADDR_LOW:          /* MAC Address Low */
+        s->conf.macaddr.a[0] = (value & 0xff);
+        s->conf.macaddr.a[1] = (value & 0xff00) >> 8;
+        s->conf.macaddr.a[2] = (value & 0xff0000) >> 16;
+        s->conf.macaddr.a[3] = (value & 0xff000000) >> 24;
+        break;
+    case REG_TX_DMA_STA:        /* Transmit DMA Status */
+    case REG_TX_CUR_DESC:       /* Transmit Current Descriptor */
+    case REG_TX_CUR_BUF:        /* Transmit Current Buffer */
+    case REG_RX_DMA_STA:        /* Receive DMA Status */
+    case REG_RX_CUR_DESC:       /* Receive Current Descriptor */
+    case REG_RX_CUR_BUF:        /* Receive Current Buffer */
+    case REG_RGMII_STA:         /* RGMII Status */
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "allwinner-h3-emac: write access to unknown "
+                                 "EMAC register 0x" TARGET_FMT_plx "\n",
+                                  offset);
+    }
+}
+
+static void allwinner_sun8i_emac_set_link(NetClientState *nc)
+{
+    AwSun8iEmacState *s = qemu_get_nic_opaque(nc);
+
+    trace_allwinner_sun8i_emac_set_link(!nc->link_down);
+    allwinner_sun8i_emac_mii_set_link(s, !nc->link_down);
+}
+
+static const MemoryRegionOps allwinner_sun8i_emac_mem_ops = {
+    .read = allwinner_sun8i_emac_read,
+    .write = allwinner_sun8i_emac_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+    .impl.min_access_size = 4,
+};
+
+static NetClientInfo net_allwinner_sun8i_emac_info = {
+    .type = NET_CLIENT_DRIVER_NIC,
+    .size = sizeof(NICState),
+    .can_receive = allwinner_sun8i_emac_can_receive,
+    .receive = allwinner_sun8i_emac_receive,
+    .link_status_changed = allwinner_sun8i_emac_set_link,
+};
+
+static void allwinner_sun8i_emac_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    AwSun8iEmacState *s = AW_SUN8I_EMAC(obj);
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &allwinner_sun8i_emac_mem_ops,
+                           s, TYPE_AW_SUN8I_EMAC, 64 * KiB);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+}
+
+static void allwinner_sun8i_emac_realize(DeviceState *dev, Error **errp)
+{
+    AwSun8iEmacState *s = AW_SUN8I_EMAC(dev);
+
+    qemu_macaddr_default_if_unset(&s->conf.macaddr);
+    s->nic = qemu_new_nic(&net_allwinner_sun8i_emac_info, &s->conf,
+                           object_get_typename(OBJECT(dev)), dev->id, s);
+    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
+}
+
+static Property allwinner_sun8i_emac_properties[] = {
+    DEFINE_NIC_PROPERTIES(AwSun8iEmacState, conf),
+    DEFINE_PROP_UINT8("phy-addr", AwSun8iEmacState, mii_phy_addr, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static int allwinner_sun8i_emac_post_load(void *opaque, int version_id)
+{
+    AwSun8iEmacState *s = opaque;
+
+    allwinner_sun8i_emac_set_link(qemu_get_queue(s->nic));
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_aw_emac = {
+    .name = "allwinner-sun8i-emac",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .post_load = allwinner_sun8i_emac_post_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(mii_phy_addr, AwSun8iEmacState),
+        VMSTATE_UINT32(mii_cmd, AwSun8iEmacState),
+        VMSTATE_UINT32(mii_data, AwSun8iEmacState),
+        VMSTATE_UINT32(mii_cr, AwSun8iEmacState),
+        VMSTATE_UINT32(mii_st, AwSun8iEmacState),
+        VMSTATE_UINT32(mii_adv, AwSun8iEmacState),
+        VMSTATE_UINT32(basic_ctl0, AwSun8iEmacState),
+        VMSTATE_UINT32(basic_ctl1, AwSun8iEmacState),
+        VMSTATE_UINT32(int_en, AwSun8iEmacState),
+        VMSTATE_UINT32(int_sta, AwSun8iEmacState),
+        VMSTATE_UINT32(frm_flt, AwSun8iEmacState),
+        VMSTATE_UINT32(rx_ctl0, AwSun8iEmacState),
+        VMSTATE_UINT32(rx_ctl1, AwSun8iEmacState),
+        VMSTATE_UINT32(rx_desc_head, AwSun8iEmacState),
+        VMSTATE_UINT32(rx_desc_curr, AwSun8iEmacState),
+        VMSTATE_UINT32(tx_ctl0, AwSun8iEmacState),
+        VMSTATE_UINT32(tx_ctl1, AwSun8iEmacState),
+        VMSTATE_UINT32(tx_desc_head, AwSun8iEmacState),
+        VMSTATE_UINT32(tx_desc_curr, AwSun8iEmacState),
+        VMSTATE_UINT32(tx_flowctl, AwSun8iEmacState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void allwinner_sun8i_emac_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = allwinner_sun8i_emac_realize;
+    dc->reset = allwinner_sun8i_emac_reset;
+    dc->vmsd = &vmstate_aw_emac;
+    device_class_set_props(dc, allwinner_sun8i_emac_properties);
+}
+
+static const TypeInfo allwinner_sun8i_emac_info = {
+    .name           = TYPE_AW_SUN8I_EMAC,
+    .parent         = TYPE_SYS_BUS_DEVICE,
+    .instance_size  = sizeof(AwSun8iEmacState),
+    .instance_init  = allwinner_sun8i_emac_init,
+    .class_init     = allwinner_sun8i_emac_class_init,
+};
+
+static void allwinner_sun8i_emac_register_types(void)
+{
+    type_register_static(&allwinner_sun8i_emac_info);
+}
+
+type_init(allwinner_sun8i_emac_register_types)
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
 config ALLWINNER_H3
     bool
     select ALLWINNER_A10_PIT
+    select ALLWINNER_SUN8I_EMAC
     select SERIAL
     select ARM_TIMER
     select ARM_GIC
diff --git a/hw/net/Kconfig b/hw/net/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/Kconfig
+++ b/hw/net/Kconfig
@@ -XXX,XX +XXX,XX @@ config MIPSNET
 config ALLWINNER_EMAC
     bool
 
+config ALLWINNER_SUN8I_EMAC
+    bool
+
 config IMX_FEC
     bool
 
diff --git a/hw/net/trace-events b/hw/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@
 # See docs/devel/tracing.txt for syntax documentation.
 
+# allwinner-sun8i-emac.c
+allwinner_sun8i_emac_mii_write_reg(uint32_t reg, uint32_t value) "MII write: reg=0x%" PRIx32 " value=0x%" PRIx32
+allwinner_sun8i_emac_mii_read_reg(uint32_t reg, uint32_t value) "MII read: reg=0x%" PRIx32 " value=0x%" PRIx32
+allwinner_sun8i_emac_receive(uint32_t desc, uint32_t paddr, uint32_t bytes) "RX packet: desc=0x%" PRIx32 " paddr=0x%" PRIx32 " bytes=%" PRIu32
+allwinner_sun8i_emac_transmit(uint32_t desc, uint32_t paddr, uint32_t bytes) "TX packet: desc=0x%" PRIx32 " paddr=0x%" PRIx32 " bytes=%" PRIu32
+allwinner_sun8i_emac_reset(void) "HW reset"
+allwinner_sun8i_emac_set_link(bool active) "Set link: active=%u"
+allwinner_sun8i_emac_read(uint64_t offset, uint64_t val) "MMIO read: offset=0x%" PRIx64 " value=0x%" PRIx64
+allwinner_sun8i_emac_write(uint64_t offset, uint64_t val) "MMIO write: offset=0x%" PRIx64 " value=0x%" PRIx64
+
 # etraxfs_eth.c
 mdio_phy_read(int regnum, uint16_t value) "read phy_reg:%d value:0x%04x"
 mdio_phy_write(int regnum, uint16_t value) "write phy_reg:%d value:0x%04x"
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

A real Allwinner H3 SoC contains a Boot ROM which is the
first code that runs right after the SoC is powered on.
The Boot ROM is responsible for loading user code (e.g. a bootloader)
from any of the supported external devices and writing the downloaded
code to internal SRAM. After loading the SoC begins executing the code
written to SRAM.

This commits adds emulation of the Boot ROM firmware setup functionality
by loading user code from SD card in the A1 SRAM. While the A1 SRAM is
64KiB, we limit the size to 32KiB because the real H3 Boot ROM also rejects
sizes larger than 32KiB. For reference, this behaviour is documented
by the Linux Sunxi project wiki at:

https://linux-sunxi.org/BROM#U-Boot_SPL_limitations

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-11-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/allwinner-h3.h | 21 +++++++++++++++++++++
 hw/arm/allwinner-h3.c         | 17 +++++++++++++++++
 hw/arm/orangepi.c             |  5 +++++
 3 files changed, 43 insertions(+)

diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-h3.h
+++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sd/allwinner-sdhost.h"
 #include "hw/net/allwinner-sun8i-emac.h"
 #include "target/arm/cpu.h"
+#include "sysemu/block-backend.h"
 
 /**
  * Allwinner H3 device list
@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
     MemoryRegion sram_c;
 } AwH3State;
 
+/**
+ * Emulate Boot ROM firmware setup functionality.
+ *
+ * A real Allwinner H3 SoC contains a Boot ROM
+ * which is the first code that runs right after
+ * the SoC is powered on. The Boot ROM is responsible
+ * for loading user code (e.g. a bootloader) from any
+ * of the supported external devices and writing the
+ * downloaded code to internal SRAM. After loading the SoC
+ * begins executing the code written to SRAM.
+ *
+ * This function emulates the Boot ROM by copying 32 KiB
+ * of data from the given block device and writes it to
+ * the start of the first internal SRAM memory.
+ *
+ * @s: Allwinner H3 state object pointer
+ * @blk: Block backend device object pointer
+ */
+void allwinner_h3_bootrom_setup(AwH3State *s, BlockBackend *blk);
+
 #endif /* HW_ARM_ALLWINNER_H3_H */
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/char/serial.h"
 #include "hw/misc/unimp.h"
 #include "hw/usb/hcd-ehci.h"
+#include "hw/loader.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/allwinner-h3.h"
 
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_GIC_NUM_SPI       = 128
 };
 
+void allwinner_h3_bootrom_setup(AwH3State *s, BlockBackend *blk)
+{
+    const int64_t rom_size = 32 * KiB;
+    g_autofree uint8_t *buffer = g_new0(uint8_t, rom_size);
+
+    if (blk_pread(blk, 8 * KiB, buffer, rom_size) < 0) {
+        error_setg(&error_fatal, "%s: failed to read BlockBackend data",
+                   __func__);
+        return;
+    }
+
+    rom_add_blob("allwinner-h3.bootrom", buffer, rom_size,
+                  rom_size, s->memmap[AW_H3_SRAM_A1],
+                  NULL, NULL, NULL, NULL, false);
+}
+
 static void allwinner_h3_init(Object *obj)
 {
     AwH3State *s = AW_H3(obj);
diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/orangepi.c
+++ b/hw/arm/orangepi.c
@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)
     memory_region_add_subregion(get_system_memory(), h3->memmap[AW_H3_SDRAM],
                                 machine->ram);
 
+    /* Load target kernel or start using BootROM */
+    if (!machine->kernel_filename && blk_is_available(blk)) {
+        /* Use Boot ROM to copy data from SD card to SRAM */
+        allwinner_h3_bootrom_setup(h3, blk);
+    }
     orangepi_binfo.loader_start = h3->memmap[AW_H3_SDRAM];
     orangepi_binfo.ram_size = machine->ram_size;
     arm_load_kernel(ARM_CPU(first_cpu), machine, &orangepi_binfo);
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

In the Allwinner H3 SoC the SDRAM controller is responsible
for interfacing with the external Synchronous Dynamic Random
Access Memory (SDRAM). Types of memory that the SDRAM controller
supports are DDR2/DDR3 and capacities of up to 2GiB. This commit
adds emulation support of the Allwinner H3 SDRAM controller.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-12-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs                |   1 +
 include/hw/arm/allwinner-h3.h        |   5 +
 include/hw/misc/allwinner-h3-dramc.h | 106 ++++++++
 hw/arm/allwinner-h3.c                |  19 +-
 hw/arm/orangepi.c                    |   6 +
 hw/misc/allwinner-h3-dramc.c         | 358 +++++++++++++++++++++++++++
 hw/misc/trace-events                 |  10 +
 7 files changed, 502 insertions(+), 3 deletions(-)
 create mode 100644 include/hw/misc/allwinner-h3-dramc.h
 create mode 100644 hw/misc/allwinner-h3-dramc.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_IVSHMEM_DEVICE) += ivshmem.o
 
 common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-ccu.o
 obj-$(CONFIG_ALLWINNER_H3) += allwinner-cpucfg.o
+common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-dramc.o
 common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-h3-sysctrl.o
 common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-sid.o
 common-obj-$(CONFIG_REALVIEW) += arm_sysctl.o
diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-h3.h
+++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/arm_gic.h"
 #include "hw/misc/allwinner-h3-ccu.h"
 #include "hw/misc/allwinner-cpucfg.h"
+#include "hw/misc/allwinner-h3-dramc.h"
 #include "hw/misc/allwinner-h3-sysctrl.h"
 #include "hw/misc/allwinner-sid.h"
 #include "hw/sd/allwinner-sdhost.h"
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_UART2,
     AW_H3_UART3,
     AW_H3_EMAC,
+    AW_H3_DRAMCOM,
+    AW_H3_DRAMCTL,
+    AW_H3_DRAMPHY,
     AW_H3_GIC_DIST,
     AW_H3_GIC_CPU,
     AW_H3_GIC_HYP,
@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
     AwA10PITState timer;
     AwH3ClockCtlState ccu;
     AwCpuCfgState cpucfg;
+    AwH3DramCtlState dramc;
     AwH3SysCtrlState sysctrl;
     AwSidState sid;
     AwSdHostState mmc0;
diff --git a/include/hw/misc/allwinner-h3-dramc.h b/include/hw/misc/allwinner-h3-dramc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/allwinner-h3-dramc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner H3 SDRAM Controller emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_MISC_ALLWINNER_H3_DRAMC_H
+#define HW_MISC_ALLWINNER_H3_DRAMC_H
+
+#include "qom/object.h"
+#include "hw/sysbus.h"
+#include "exec/hwaddr.h"
+
+/**
+ * Constants
+ * @{
+ */
+
+/** Highest register address used by DRAMCOM module */
+#define AW_H3_DRAMCOM_REGS_MAXADDR  (0x804)
+
+/** Total number of known DRAMCOM registers */
+#define AW_H3_DRAMCOM_REGS_NUM      (AW_H3_DRAMCOM_REGS_MAXADDR / \
+                                     sizeof(uint32_t))
+
+/** Highest register address used by DRAMCTL module */
+#define AW_H3_DRAMCTL_REGS_MAXADDR  (0x88c)
+
+/** Total number of known DRAMCTL registers */
+#define AW_H3_DRAMCTL_REGS_NUM      (AW_H3_DRAMCTL_REGS_MAXADDR / \
+                                     sizeof(uint32_t))
+
+/** Highest register address used by DRAMPHY module */
+#define AW_H3_DRAMPHY_REGS_MAXADDR  (0x4)
+
+/** Total number of known DRAMPHY registers */
+#define AW_H3_DRAMPHY_REGS_NUM      (AW_H3_DRAMPHY_REGS_MAXADDR / \
+                                     sizeof(uint32_t))
+
+/** @} */
+
+/**
+ * Object model
+ * @{
+ */
+
+#define TYPE_AW_H3_DRAMC "allwinner-h3-dramc"
+#define AW_H3_DRAMC(obj) \
+    OBJECT_CHECK(AwH3DramCtlState, (obj), TYPE_AW_H3_DRAMC)
+
+/** @} */
+
+/**
+ * Allwinner H3 SDRAM Controller object instance state.
+ */
+typedef struct AwH3DramCtlState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
+    /** Physical base address for start of RAM */
+    hwaddr ram_addr;
+
+    /** Total RAM size in megabytes */
+    uint32_t ram_size;
+
+    /**
+     * @name Memory Regions
+     * @{
+     */
+
+    MemoryRegion row_mirror;       /**< Simulates rows for RAM size detection */
+    MemoryRegion row_mirror_alias; /**< Alias of the row which is mirrored */
+    MemoryRegion dramcom_iomem;    /**< DRAMCOM module I/O registers */
+    MemoryRegion dramctl_iomem;    /**< DRAMCTL module I/O registers */
+    MemoryRegion dramphy_iomem;    /**< DRAMPHY module I/O registers */
+
+    /** @} */
+
+    /**
+     * @name Hardware Registers
+     * @{
+     */
+
+    uint32_t dramcom[AW_H3_DRAMCOM_REGS_NUM]; /**< Array of DRAMCOM registers */
+    uint32_t dramctl[AW_H3_DRAMCTL_REGS_NUM]; /**< Array of DRAMCTL registers */
+    uint32_t dramphy[AW_H3_DRAMPHY_REGS_NUM] ;/**< Array of DRAMPHY registers */
+
+    /** @} */
+
+} AwH3DramCtlState;
+
+#endif /* HW_MISC_ALLWINNER_H3_DRAMC_H */
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
     [AW_H3_UART2]      = 0x01c28800,
     [AW_H3_UART3]      = 0x01c28c00,
     [AW_H3_EMAC]       = 0x01c30000,
+    [AW_H3_DRAMCOM]    = 0x01c62000,
+    [AW_H3_DRAMCTL]    = 0x01c63000,
+    [AW_H3_DRAMPHY]    = 0x01c65000,
     [AW_H3_GIC_DIST]   = 0x01c81000,
     [AW_H3_GIC_CPU]    = 0x01c82000,
     [AW_H3_GIC_HYP]    = 0x01c84000,
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
     { "scr",       0x01c2c400, 1 * KiB },
     { "gpu",       0x01c40000, 64 * KiB },
     { "hstmr",     0x01c60000, 4 * KiB },
-    { "dramcom",   0x01c62000, 4 * KiB },
-    { "dramctl0",  0x01c63000, 4 * KiB },
-    { "dramphy0",  0x01c65000, 4 * KiB },
     { "spi0",      0x01c68000, 4 * KiB },
     { "spi1",      0x01c69000, 4 * KiB },
     { "csi",       0x01cb0000, 320 * KiB },
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
 
     sysbus_init_child_obj(obj, "emac", &s->emac, sizeof(s->emac),
                           TYPE_AW_SUN8I_EMAC);
+
+    sysbus_init_child_obj(obj, "dramc", &s->dramc, sizeof(s->dramc),
+                          TYPE_AW_H3_DRAMC);
+    object_property_add_alias(obj, "ram-addr", OBJECT(&s->dramc),
+                             "ram-addr", &error_abort);
+    object_property_add_alias(obj, "ram-size", OBJECT(&s->dramc),
+                              "ram-size", &error_abort);
 }
 
 static void allwinner_h3_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
                    qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_UART3),
                    115200, serial_hd(3), DEVICE_NATIVE_ENDIAN);
 
+    /* DRAMC */
+    qdev_init_nofail(DEVICE(&s->dramc));
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->dramc), 0, s->memmap[AW_H3_DRAMCOM]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->dramc), 1, s->memmap[AW_H3_DRAMCTL]);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->dramc), 2, s->memmap[AW_H3_DRAMPHY]);
+
     /* Unimplemented devices */
     for (i = 0; i < ARRAY_SIZE(unimplemented); i++) {
         create_unimplemented_device(unimplemented[i].device_name,
diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/orangepi.c
+++ b/hw/arm/orangepi.c
@@ -XXX,XX +XXX,XX @@ static void orangepi_init(MachineState *machine)
     /* Setup EMAC properties */
     object_property_set_int(OBJECT(&h3->emac), 1, "phy-addr", &error_abort);
 
+    /* DRAMC */
+    object_property_set_uint(OBJECT(h3), h3->memmap[AW_H3_SDRAM],
+                             "ram-addr", &error_abort);
+    object_property_set_int(OBJECT(h3), machine->ram_size / MiB, "ram-size",
+                            &error_abort);
+
     /* Mark H3 object realized */
     object_property_set_bool(OBJECT(h3), true, "realized", &error_abort);
 
diff --git a/hw/misc/allwinner-h3-dramc.c b/hw/misc/allwinner-h3-dramc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/allwinner-h3-dramc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner H3 SDRAM Controller emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qemu/error-report.h"
+#include "hw/sysbus.h"
+#include "migration/vmstate.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "exec/address-spaces.h"
+#include "hw/qdev-properties.h"
+#include "qapi/error.h"
+#include "hw/misc/allwinner-h3-dramc.h"
+#include "trace.h"
+
+#define REG_INDEX(offset)    (offset / sizeof(uint32_t))
+
+/* DRAMCOM register offsets */
+enum {
+    REG_DRAMCOM_CR    = 0x0000, /* Control Register */
+};
+
+/* DRAMCTL register offsets */
+enum {
+    REG_DRAMCTL_PIR   = 0x0000, /* PHY Initialization Register */
+    REG_DRAMCTL_PGSR  = 0x0010, /* PHY General Status Register */
+    REG_DRAMCTL_STATR = 0x0018, /* Status Register */
+};
+
+/* DRAMCTL register flags */
+enum {
+    REG_DRAMCTL_PGSR_INITDONE = (1 << 0),
+};
+
+enum {
+    REG_DRAMCTL_STATR_ACTIVE  = (1 << 0),
+};
+
+static void allwinner_h3_dramc_map_rows(AwH3DramCtlState *s, uint8_t row_bits,
+                                        uint8_t bank_bits, uint16_t page_size)
+{
+    /*
+     * This function simulates row addressing behavior when bootloader
+     * software attempts to detect the amount of available SDRAM. In U-Boot
+     * the controller is configured with the widest row addressing available.
+     * Then a pattern is written to RAM at an offset on the row boundary size.
+     * If the value read back equals the value read back from the
+     * start of RAM, the bootloader knows the amount of row bits.
+     *
+     * This function inserts a mirrored memory region when the configured row
+     * bits are not matching the actual emulated memory, to simulate the
+     * same behavior on hardware as expected by the bootloader.
+     */
+    uint8_t row_bits_actual = 0;
+
+    /* Calculate the actual row bits using the ram_size property */
+    for (uint8_t i = 8; i < 12; i++) {
+        if (1 << i == s->ram_size) {
+            row_bits_actual = i + 3;
+            break;
+        }
+    }
+
+    if (s->ram_size == (1 << (row_bits - 3))) {
+        /* When row bits is the expected value, remove the mirror */
+        memory_region_set_enabled(&s->row_mirror_alias, false);
+        trace_allwinner_h3_dramc_rowmirror_disable();
+
+    } else if (row_bits_actual) {
+        /* Row bits not matching ram_size, install the rows mirror */
+        hwaddr row_mirror = s->ram_addr + ((1 << (row_bits_actual +
+                                                  bank_bits)) * page_size);
+
+        memory_region_set_enabled(&s->row_mirror_alias, true);
+        memory_region_set_address(&s->row_mirror_alias, row_mirror);
+
+        trace_allwinner_h3_dramc_rowmirror_enable(row_mirror);
+    }
+}
+
+static uint64_t allwinner_h3_dramcom_read(void *opaque, hwaddr offset,
+                                          unsigned size)
+{
+    const AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
+    const uint32_t idx = REG_INDEX(offset);
+
+    if (idx >= AW_H3_DRAMCOM_REGS_NUM) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        return 0;
+    }
+
+    trace_allwinner_h3_dramcom_read(offset, s->dramcom[idx], size);
+
+    return s->dramcom[idx];
+}
+
+static void allwinner_h3_dramcom_write(void *opaque, hwaddr offset,
+                                       uint64_t val, unsigned size)
+{
+    AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
+    const uint32_t idx = REG_INDEX(offset);
+
+    trace_allwinner_h3_dramcom_write(offset, val, size);
+
+    if (idx >= AW_H3_DRAMCOM_REGS_NUM) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        return;
+    }
+
+    switch (offset) {
+    case REG_DRAMCOM_CR:   /* Control Register */
+        allwinner_h3_dramc_map_rows(s, ((val >> 4) & 0xf) + 1,
+                                       ((val >> 2) & 0x1) + 2,
+                                       1 << (((val >> 8) & 0xf) + 3));
+        break;
+    default:
+        break;
+    };
+
+    s->dramcom[idx] = (uint32_t) val;
+}
+
+static uint64_t allwinner_h3_dramctl_read(void *opaque, hwaddr offset,
+                                          unsigned size)
+{
+    const AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
+    const uint32_t idx = REG_INDEX(offset);
+
+    if (idx >= AW_H3_DRAMCTL_REGS_NUM) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        return 0;
+    }
+
+    trace_allwinner_h3_dramctl_read(offset, s->dramctl[idx], size);
+
+    return s->dramctl[idx];
+}
+
+static void allwinner_h3_dramctl_write(void *opaque, hwaddr offset,
+                                       uint64_t val, unsigned size)
+{
+    AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
+    const uint32_t idx = REG_INDEX(offset);
+
+    trace_allwinner_h3_dramctl_write(offset, val, size);
+
+    if (idx >= AW_H3_DRAMCTL_REGS_NUM) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        return;
+    }
+
+    switch (offset) {
+    case REG_DRAMCTL_PIR:    /* PHY Initialization Register */
+        s->dramctl[REG_INDEX(REG_DRAMCTL_PGSR)] |= REG_DRAMCTL_PGSR_INITDONE;
+        s->dramctl[REG_INDEX(REG_DRAMCTL_STATR)] |= REG_DRAMCTL_STATR_ACTIVE;
+        break;
+    default:
+        break;
+    }
+
+    s->dramctl[idx] = (uint32_t) val;
+}
+
+static uint64_t allwinner_h3_dramphy_read(void *opaque, hwaddr offset,
+                                          unsigned size)
+{
+    const AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
+    const uint32_t idx = REG_INDEX(offset);
+
+    if (idx >= AW_H3_DRAMPHY_REGS_NUM) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        return 0;
+    }
+
+    trace_allwinner_h3_dramphy_read(offset, s->dramphy[idx], size);
+
+    return s->dramphy[idx];
+}
+
+static void allwinner_h3_dramphy_write(void *opaque, hwaddr offset,
+                                       uint64_t val, unsigned size)
+{
+    AwH3DramCtlState *s = AW_H3_DRAMC(opaque);
+    const uint32_t idx = REG_INDEX(offset);
+
+    trace_allwinner_h3_dramphy_write(offset, val, size);
+
+    if (idx >= AW_H3_DRAMPHY_REGS_NUM) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        return;
+    }
+
+    s->dramphy[idx] = (uint32_t) val;
+}
+
+static const MemoryRegionOps allwinner_h3_dramcom_ops = {
+    .read = allwinner_h3_dramcom_read,
+    .write = allwinner_h3_dramcom_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+    .impl.min_access_size = 4,
+};
+
+static const MemoryRegionOps allwinner_h3_dramctl_ops = {
+    .read = allwinner_h3_dramctl_read,
+    .write = allwinner_h3_dramctl_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+    .impl.min_access_size = 4,
+};
+
+static const MemoryRegionOps allwinner_h3_dramphy_ops = {
+    .read = allwinner_h3_dramphy_read,
+    .write = allwinner_h3_dramphy_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+    .impl.min_access_size = 4,
+};
+
+static void allwinner_h3_dramc_reset(DeviceState *dev)
+{
+    AwH3DramCtlState *s = AW_H3_DRAMC(dev);
+
+    /* Set default values for registers */
+    memset(&s->dramcom, 0, sizeof(s->dramcom));
+    memset(&s->dramctl, 0, sizeof(s->dramctl));
+    memset(&s->dramphy, 0, sizeof(s->dramphy));
+}
+
+static void allwinner_h3_dramc_realize(DeviceState *dev, Error **errp)
+{
+    AwH3DramCtlState *s = AW_H3_DRAMC(dev);
+
+    /* Only power of 2 RAM sizes from 256MiB up to 2048MiB are supported */
+    for (uint8_t i = 8; i < 13; i++) {
+        if (1 << i == s->ram_size) {
+            break;
+        } else if (i == 12) {
+            error_report("%s: ram-size %u MiB is not supported",
+                          __func__, s->ram_size);
+            exit(1);
+        }
+    }
+
+    /* Setup row mirror mappings */
+    memory_region_init_ram(&s->row_mirror, OBJECT(s),
+                           "allwinner-h3-dramc.row-mirror",
+                            4 * KiB, &error_abort);
+    memory_region_add_subregion_overlap(get_system_memory(), s->ram_addr,
+                                       &s->row_mirror, 10);
+
+    memory_region_init_alias(&s->row_mirror_alias, OBJECT(s),
+                            "allwinner-h3-dramc.row-mirror-alias",
+                            &s->row_mirror, 0, 4 * KiB);
+    memory_region_add_subregion_overlap(get_system_memory(),
+                                        s->ram_addr + 1 * MiB,
+                                       &s->row_mirror_alias, 10);
+    memory_region_set_enabled(&s->row_mirror_alias, false);
+}
+
+static void allwinner_h3_dramc_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    AwH3DramCtlState *s = AW_H3_DRAMC(obj);
+
+    /* DRAMCOM registers */
+    memory_region_init_io(&s->dramcom_iomem, OBJECT(s),
+                          &allwinner_h3_dramcom_ops, s,
+                           TYPE_AW_H3_DRAMC, 4 * KiB);
+    sysbus_init_mmio(sbd, &s->dramcom_iomem);
+
+    /* DRAMCTL registers */
+    memory_region_init_io(&s->dramctl_iomem, OBJECT(s),
+                          &allwinner_h3_dramctl_ops, s,
+                           TYPE_AW_H3_DRAMC, 4 * KiB);
+    sysbus_init_mmio(sbd, &s->dramctl_iomem);
+
+    /* DRAMPHY registers */
+    memory_region_init_io(&s->dramphy_iomem, OBJECT(s),
+                          &allwinner_h3_dramphy_ops, s,
+                          TYPE_AW_H3_DRAMC, 4 * KiB);
+    sysbus_init_mmio(sbd, &s->dramphy_iomem);
+}
+
+static Property allwinner_h3_dramc_properties[] = {
+    DEFINE_PROP_UINT64("ram-addr", AwH3DramCtlState, ram_addr, 0x0),
+    DEFINE_PROP_UINT32("ram-size", AwH3DramCtlState, ram_size, 256 * MiB),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static const VMStateDescription allwinner_h3_dramc_vmstate = {
+    .name = "allwinner-h3-dramc",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(dramcom, AwH3DramCtlState, AW_H3_DRAMCOM_REGS_NUM),
+        VMSTATE_UINT32_ARRAY(dramctl, AwH3DramCtlState, AW_H3_DRAMCTL_REGS_NUM),
+        VMSTATE_UINT32_ARRAY(dramphy, AwH3DramCtlState, AW_H3_DRAMPHY_REGS_NUM),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void allwinner_h3_dramc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = allwinner_h3_dramc_reset;
+    dc->vmsd = &allwinner_h3_dramc_vmstate;
+    dc->realize = allwinner_h3_dramc_realize;
+    device_class_set_props(dc, allwinner_h3_dramc_properties);
+}
+
+static const TypeInfo allwinner_h3_dramc_info = {
+    .name          = TYPE_AW_H3_DRAMC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_init = allwinner_h3_dramc_init,
+    .instance_size = sizeof(AwH3DramCtlState),
+    .class_init    = allwinner_h3_dramc_class_init,
+};
+
+static void allwinner_h3_dramc_register(void)
+{
+    type_register_static(&allwinner_h3_dramc_info);
+}
+
+type_init(allwinner_h3_dramc_register)
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ allwinner_cpucfg_cpu_reset(uint8_t cpu_id, uint32_t reset_addr) "id %u, reset_ad
 allwinner_cpucfg_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 allwinner_cpucfg_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 
+# allwinner-h3-dramc.c
+allwinner_h3_dramc_rowmirror_disable(void) "Disable row mirror"
+allwinner_h3_dramc_rowmirror_enable(uint64_t addr) "Enable row mirror: addr 0x%" PRIx64
+allwinner_h3_dramcom_read(uint64_t offset, uint64_t data, unsigned size) "Read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
+allwinner_h3_dramcom_write(uint64_t offset, uint64_t data, unsigned size) "Write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
+allwinner_h3_dramctl_read(uint64_t offset, uint64_t data, unsigned size) "Read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
+allwinner_h3_dramctl_write(uint64_t offset, uint64_t data, unsigned size) "Write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
+allwinner_h3_dramphy_read(uint64_t offset, uint64_t data, unsigned size) "Read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
+allwinner_h3_dramphy_write(uint64_t offset, uint64_t data, unsigned size) "write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
+
 # allwinner-sid.c
 allwinner_sid_read(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
 allwinner_sid_write(uint64_t offset, uint64_t data, unsigned size) "offset 0x%" PRIx64 " data 0x%" PRIx64 " size %" PRIu32
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

Allwinner System-on-Chips usually contain a Real Time Clock (RTC)
for non-volatile system date and time keeping. This commit adds a generic
Allwinner RTC device that supports the RTC devices found in Allwinner SoC
family sun4i (A10), sun7i (A20) and sun6i and newer (A31, H2+, H3, etc).
The following RTC functionality and features are implemented:

* Year-Month-Day read/write
 * Hour-Minute-Second read/write
 * General Purpose storage

The following boards are extended with the RTC device:

* Cubieboard (hw/arm/cubieboard.c)
 * Orange Pi PC (hw/arm/orangepi.c)

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-13-nieklinnenbank@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/rtc/Makefile.objs           |   1 +
 include/hw/arm/allwinner-a10.h |   2 +
 include/hw/arm/allwinner-h3.h  |   3 +
 include/hw/rtc/allwinner-rtc.h | 134 +++++++++++
 hw/arm/allwinner-a10.c         |   8 +
 hw/arm/allwinner-h3.c          |   9 +-
 hw/rtc/allwinner-rtc.c         | 411 +++++++++++++++++++++++++++++++++
 hw/rtc/trace-events            |   4 +
 8 files changed, 571 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/rtc/allwinner-rtc.h
 create mode 100644 hw/rtc/allwinner-rtc.c

diff --git a/hw/rtc/Makefile.objs b/hw/rtc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/Makefile.objs
+++ b/hw/rtc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MC146818RTC) += mc146818rtc.o
 common-obj-$(CONFIG_SUN4V_RTC) += sun4v-rtc.o
 common-obj-$(CONFIG_ASPEED_SOC) += aspeed_rtc.o
 common-obj-$(CONFIG_GOLDFISH_RTC) += goldfish_rtc.o
+common-obj-$(CONFIG_ALLWINNER_H3) += allwinner-rtc.o
diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/ide/ahci.h"
 #include "hw/usb/hcd-ohci.h"
 #include "hw/usb/hcd-ehci.h"
+#include "hw/rtc/allwinner-rtc.h"
 
 #include "target/arm/cpu.h"
 
@@ -XXX,XX +XXX,XX @@ typedef struct AwA10State {
     AwEmacState emac;
     AllwinnerAHCIState sata;
     AwSdHostState mmc0;
+    AwRtcState rtc;
     MemoryRegion sram_a;
     EHCISysBusState ehci[AW_A10_NUM_USB];
     OHCISysBusState ohci[AW_A10_NUM_USB];
diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-h3.h
+++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/allwinner-sid.h"
 #include "hw/sd/allwinner-sdhost.h"
 #include "hw/net/allwinner-sun8i-emac.h"
+#include "hw/rtc/allwinner-rtc.h"
 #include "target/arm/cpu.h"
 #include "sysemu/block-backend.h"
 
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_GIC_CPU,
     AW_H3_GIC_HYP,
     AW_H3_GIC_VCPU,
+    AW_H3_RTC,
     AW_H3_CPUCFG,
     AW_H3_SDRAM
 };
@@ -XXX,XX +XXX,XX @@ typedef struct AwH3State {
     AwSidState sid;
     AwSdHostState mmc0;
     AwSun8iEmacState emac;
+    AwRtcState rtc;
     GICState gic;
     MemoryRegion sram_a1;
     MemoryRegion sram_a2;
diff --git a/include/hw/rtc/allwinner-rtc.h b/include/hw/rtc/allwinner-rtc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/rtc/allwinner-rtc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner Real Time Clock emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_MISC_ALLWINNER_RTC_H
+#define HW_MISC_ALLWINNER_RTC_H
+
+#include "qom/object.h"
+#include "hw/sysbus.h"
+
+/**
+ * Constants
+ * @{
+ */
+
+/** Highest register address used by RTC device */
+#define AW_RTC_REGS_MAXADDR     (0x200)
+
+/** Total number of known registers */
+#define AW_RTC_REGS_NUM         (AW_RTC_REGS_MAXADDR / sizeof(uint32_t))
+
+/** @} */
+
+/**
+ * Object model types
+ * @{
+ */
+
+/** Generic Allwinner RTC device (abstract) */
+#define TYPE_AW_RTC          "allwinner-rtc"
+
+/** Allwinner RTC sun4i family (A10, A12) */
+#define TYPE_AW_RTC_SUN4I    TYPE_AW_RTC "-sun4i"
+
+/** Allwinner RTC sun6i family and newer (A31, H2+, H3, etc) */
+#define TYPE_AW_RTC_SUN6I    TYPE_AW_RTC "-sun6i"
+
+/** Allwinner RTC sun7i family (A20) */
+#define TYPE_AW_RTC_SUN7I    TYPE_AW_RTC "-sun7i"
+
+/** @} */
+
+/**
+ * Object model macros
+ * @{
+ */
+
+#define AW_RTC(obj) \
+    OBJECT_CHECK(AwRtcState, (obj), TYPE_AW_RTC)
+#define AW_RTC_CLASS(klass) \
+     OBJECT_CLASS_CHECK(AwRtcClass, (klass), TYPE_AW_RTC)
+#define AW_RTC_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(AwRtcClass, (obj), TYPE_AW_RTC)
+
+/** @} */
+
+/**
+ * Allwinner RTC per-object instance state.
+ */
+typedef struct AwRtcState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
+    /**
+     * Actual year represented by the device when year counter is zero
+     *
+     * Can be overridden by the user using the corresponding 'base-year'
+     * property. The base year used by the target OS driver can vary, for
+     * example the Linux driver for sun6i uses 1970 while NetBSD uses 2000.
+     */
+    int base_year;
+
+    /** Maps I/O registers in physical memory */
+    MemoryRegion iomem;
+
+    /** Array of hardware registers */
+    uint32_t regs[AW_RTC_REGS_NUM];
+
+} AwRtcState;
+
+/**
+ * Allwinner RTC class-level struct.
+ *
+ * This struct is filled by each sunxi device specific code
+ * such that the generic code can use this struct to support
+ * all devices.
+ */
+typedef struct AwRtcClass {
+    /*< private >*/
+    SysBusDeviceClass parent_class;
+    /*< public >*/
+
+    /** Defines device specific register map */
+    const uint8_t *regmap;
+
+    /** Size of the regmap in bytes */
+    size_t regmap_size;
+
+    /**
+     * Read device specific register
+     *
+     * @offset: register offset to read
+     * @return true if register read successful, false otherwise
+     */
+    bool (*read)(AwRtcState *s, uint32_t offset);
+
+    /**
+     * Write device specific register
+     *
+     * @offset: register offset to write
+     * @data: value to set in register
+     * @return true if register write successful, false otherwise
+     */
+    bool (*write)(AwRtcState *s, uint32_t offset, uint32_t data);
+
+} AwRtcClass;
+
+#endif /* HW_MISC_ALLWINNER_RTC_H */
diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -XXX,XX +XXX,XX @@
 #define AW_A10_EHCI_BASE        0x01c14000
 #define AW_A10_OHCI_BASE        0x01c14400
 #define AW_A10_SATA_BASE        0x01c18000
+#define AW_A10_RTC_BASE         0x01c20d00
 
 static void aw_a10_init(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_init(Object *obj)
 
     sysbus_init_child_obj(obj, "mmc0", &s->mmc0, sizeof(s->mmc0),
                           TYPE_AW_SDHOST_SUN4I);
+
+    sysbus_init_child_obj(obj, "rtc", &s->rtc, sizeof(s->rtc),
+                          TYPE_AW_RTC_SUN4I);
 }
 
 static void aw_a10_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->mmc0), 0, qdev_get_gpio_in(dev, 32));
     object_property_add_alias(OBJECT(s), "sd-bus", OBJECT(&s->mmc0),
                               "sd-bus", &error_abort);
+
+    /* RTC */
+    qdev_init_nofail(DEVICE(&s->rtc));
+    sysbus_mmio_map_overlap(SYS_BUS_DEVICE(&s->rtc), 0, AW_A10_RTC_BASE, 10);
 }
 
 static void aw_a10_class_init(ObjectClass *oc, void *data)
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
     [AW_H3_GIC_CPU]    = 0x01c82000,
     [AW_H3_GIC_HYP]    = 0x01c84000,
     [AW_H3_GIC_VCPU]   = 0x01c86000,
+    [AW_H3_RTC]        = 0x01f00000,
     [AW_H3_CPUCFG]     = 0x01f01c00,
     [AW_H3_SDRAM]      = 0x40000000
 };
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
     { "csi",       0x01cb0000, 320 * KiB },
     { "tve",       0x01e00000, 64 * KiB },
     { "hdmi",      0x01ee0000, 128 * KiB },
-    { "rtc",       0x01f00000, 1 * KiB },
     { "r_timer",   0x01f00800, 1 * KiB },
     { "r_intc",    0x01f00c00, 1 * KiB },
     { "r_wdog",    0x01f01000, 1 * KiB },
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
                              "ram-addr", &error_abort);
     object_property_add_alias(obj, "ram-size", OBJECT(&s->dramc),
                               "ram-size", &error_abort);
+
+    sysbus_init_child_obj(obj, "rtc", &s->rtc, sizeof(s->rtc),
+                          TYPE_AW_RTC_SUN6I);
 }
 
 static void allwinner_h3_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->dramc), 1, s->memmap[AW_H3_DRAMCTL]);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->dramc), 2, s->memmap[AW_H3_DRAMPHY]);
 
+    /* RTC */
+    qdev_init_nofail(DEVICE(&s->rtc));
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, s->memmap[AW_H3_RTC]);
+
     /* Unimplemented devices */
     for (i = 0; i < ARRAY_SIZE(unimplemented); i++) {
         create_unimplemented_device(unimplemented[i].device_name,
diff --git a/hw/rtc/allwinner-rtc.c b/hw/rtc/allwinner-rtc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/rtc/allwinner-rtc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Allwinner Real Time Clock emulation
+ *
+ * Copyright (C) 2019 Niek Linnenbank <nieklinnenbank@gmail.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "hw/sysbus.h"
+#include "migration/vmstate.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu-common.h"
+#include "hw/qdev-properties.h"
+#include "hw/rtc/allwinner-rtc.h"
+#include "trace.h"
+
+/* RTC registers */
+enum {
+    REG_LOSC = 1,        /* Low Oscillator Control */
+    REG_YYMMDD,          /* RTC Year-Month-Day */
+    REG_HHMMSS,          /* RTC Hour-Minute-Second */
+    REG_ALARM1_WKHHMMSS, /* Alarm1 Week Hour-Minute-Second */
+    REG_ALARM1_EN,       /* Alarm1 Enable */
+    REG_ALARM1_IRQ_EN,   /* Alarm1 IRQ Enable */
+    REG_ALARM1_IRQ_STA,  /* Alarm1 IRQ Status */
+    REG_GP0,             /* General Purpose Register 0 */
+    REG_GP1,             /* General Purpose Register 1 */
+    REG_GP2,             /* General Purpose Register 2 */
+    REG_GP3,             /* General Purpose Register 3 */
+
+    /* sun4i registers */
+    REG_ALARM1_DDHHMMSS, /* Alarm1 Day Hour-Minute-Second */
+    REG_CPUCFG,          /* CPU Configuration Register */
+
+    /* sun6i registers */
+    REG_LOSC_AUTOSTA,    /* LOSC Auto Switch Status */
+    REG_INT_OSC_PRE,     /* Internal OSC Clock Prescaler */
+    REG_ALARM0_COUNTER,  /* Alarm0 Counter */
+    REG_ALARM0_CUR_VLU,  /* Alarm0 Counter Current Value */
+    REG_ALARM0_ENABLE,   /* Alarm0 Enable */
+    REG_ALARM0_IRQ_EN,   /* Alarm0 IRQ Enable */
+    REG_ALARM0_IRQ_STA,  /* Alarm0 IRQ Status */
+    REG_ALARM_CONFIG,    /* Alarm Config */
+    REG_LOSC_OUT_GATING, /* LOSC Output Gating Register */
+    REG_GP4,             /* General Purpose Register 4 */
+    REG_GP5,             /* General Purpose Register 5 */
+    REG_GP6,             /* General Purpose Register 6 */
+    REG_GP7,             /* General Purpose Register 7 */
+    REG_RTC_DBG,         /* RTC Debug Register */
+    REG_GPL_HOLD_OUT,    /* GPL Hold Output Register */
+    REG_VDD_RTC,         /* VDD RTC Regulate Register */
+    REG_IC_CHARA,        /* IC Characteristics Register */
+};
+
+/* RTC register flags */
+enum {
+    REG_LOSC_YMD   = (1 << 7),
+    REG_LOSC_HMS   = (1 << 8),
+};
+
+/* RTC sun4i register map (offset to name) */
+const uint8_t allwinner_rtc_sun4i_regmap[] = {
+    [0x0000] = REG_LOSC,
+    [0x0004] = REG_YYMMDD,
+    [0x0008] = REG_HHMMSS,
+    [0x000C] = REG_ALARM1_DDHHMMSS,
+    [0x0010] = REG_ALARM1_WKHHMMSS,
+    [0x0014] = REG_ALARM1_EN,
+    [0x0018] = REG_ALARM1_IRQ_EN,
+    [0x001C] = REG_ALARM1_IRQ_STA,
+    [0x0020] = REG_GP0,
+    [0x0024] = REG_GP1,
+    [0x0028] = REG_GP2,
+    [0x002C] = REG_GP3,
+    [0x003C] = REG_CPUCFG,
+};
+
+/* RTC sun6i register map (offset to name) */
+const uint8_t allwinner_rtc_sun6i_regmap[] = {
+    [0x0000] = REG_LOSC,
+    [0x0004] = REG_LOSC_AUTOSTA,
+    [0x0008] = REG_INT_OSC_PRE,
+    [0x0010] = REG_YYMMDD,
+    [0x0014] = REG_HHMMSS,
+    [0x0020] = REG_ALARM0_COUNTER,
+    [0x0024] = REG_ALARM0_CUR_VLU,
+    [0x0028] = REG_ALARM0_ENABLE,
+    [0x002C] = REG_ALARM0_IRQ_EN,
+    [0x0030] = REG_ALARM0_IRQ_STA,
+    [0x0040] = REG_ALARM1_WKHHMMSS,
+    [0x0044] = REG_ALARM1_EN,
+    [0x0048] = REG_ALARM1_IRQ_EN,
+    [0x004C] = REG_ALARM1_IRQ_STA,
+    [0x0050] = REG_ALARM_CONFIG,
+    [0x0060] = REG_LOSC_OUT_GATING,
+    [0x0100] = REG_GP0,
+    [0x0104] = REG_GP1,
+    [0x0108] = REG_GP2,
+    [0x010C] = REG_GP3,
+    [0x0110] = REG_GP4,
+    [0x0114] = REG_GP5,
+    [0x0118] = REG_GP6,
+    [0x011C] = REG_GP7,
+    [0x0170] = REG_RTC_DBG,
+    [0x0180] = REG_GPL_HOLD_OUT,
+    [0x0190] = REG_VDD_RTC,
+    [0x01F0] = REG_IC_CHARA,
+};
+
+static bool allwinner_rtc_sun4i_read(AwRtcState *s, uint32_t offset)
+{
+    /* no sun4i specific registers currently implemented */
+    return false;
+}
+
+static bool allwinner_rtc_sun4i_write(AwRtcState *s, uint32_t offset,
+                                      uint32_t data)
+{
+    /* no sun4i specific registers currently implemented */
+    return false;
+}
+
+static bool allwinner_rtc_sun6i_read(AwRtcState *s, uint32_t offset)
+{
+    const AwRtcClass *c = AW_RTC_GET_CLASS(s);
+
+    switch (c->regmap[offset]) {
+    case REG_GP4:             /* General Purpose Register 4 */
+    case REG_GP5:             /* General Purpose Register 5 */
+    case REG_GP6:             /* General Purpose Register 6 */
+    case REG_GP7:             /* General Purpose Register 7 */
+        return true;
+    default:
+        break;
+    }
+    return false;
+}
+
+static bool allwinner_rtc_sun6i_write(AwRtcState *s, uint32_t offset,
+                                      uint32_t data)
+{
+    const AwRtcClass *c = AW_RTC_GET_CLASS(s);
+
+    switch (c->regmap[offset]) {
+    case REG_GP4:             /* General Purpose Register 4 */
+    case REG_GP5:             /* General Purpose Register 5 */
+    case REG_GP6:             /* General Purpose Register 6 */
+    case REG_GP7:             /* General Purpose Register 7 */
+        return true;
+    default:
+        break;
+    }
+    return false;
+}
+
+static uint64_t allwinner_rtc_read(void *opaque, hwaddr offset,
+                                   unsigned size)
+{
+    AwRtcState *s = AW_RTC(opaque);
+    const AwRtcClass *c = AW_RTC_GET_CLASS(s);
+    uint64_t val = 0;
+
+    if (offset >= c->regmap_size) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        return 0;
+    }
+
+    if (!c->regmap[offset]) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid register 0x%04x\n",
+                          __func__, (uint32_t)offset);
+        return 0;
+    }
+
+    switch (c->regmap[offset]) {
+    case REG_LOSC:       /* Low Oscillator Control */
+        val = s->regs[REG_LOSC];
+        s->regs[REG_LOSC] &= ~(REG_LOSC_YMD | REG_LOSC_HMS);
+        break;
+    case REG_YYMMDD:     /* RTC Year-Month-Day */
+    case REG_HHMMSS:     /* RTC Hour-Minute-Second */
+    case REG_GP0:        /* General Purpose Register 0 */
+    case REG_GP1:        /* General Purpose Register 1 */
+    case REG_GP2:        /* General Purpose Register 2 */
+    case REG_GP3:        /* General Purpose Register 3 */
+        val = s->regs[c->regmap[offset]];
+        break;
+    default:
+        if (!c->read(s, offset)) {
+            qemu_log_mask(LOG_UNIMP, "%s: unimplemented register 0x%04x\n",
+                          __func__, (uint32_t)offset);
+        }
+        val = s->regs[c->regmap[offset]];
+        break;
+    }
+
+    trace_allwinner_rtc_read(offset, val);
+    return val;
+}
+
+static void allwinner_rtc_write(void *opaque, hwaddr offset,
+                                uint64_t val, unsigned size)
+{
+    AwRtcState *s = AW_RTC(opaque);
+    const AwRtcClass *c = AW_RTC_GET_CLASS(s);
+
+    if (offset >= c->regmap_size) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: out-of-bounds offset 0x%04x\n",
+                      __func__, (uint32_t)offset);
+        return;
+    }
+
+    if (!c->regmap[offset]) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid register 0x%04x\n",
+                          __func__, (uint32_t)offset);
+        return;
+    }
+
+    trace_allwinner_rtc_write(offset, val);
+
+    switch (c->regmap[offset]) {
+    case REG_YYMMDD:     /* RTC Year-Month-Day */
+        s->regs[REG_YYMMDD] = val;
+        s->regs[REG_LOSC]  |= REG_LOSC_YMD;
+        break;
+    case REG_HHMMSS:     /* RTC Hour-Minute-Second */
+        s->regs[REG_HHMMSS] = val;
+        s->regs[REG_LOSC]  |= REG_LOSC_HMS;
+        break;
+    case REG_GP0:        /* General Purpose Register 0 */
+    case REG_GP1:        /* General Purpose Register 1 */
+    case REG_GP2:        /* General Purpose Register 2 */
+    case REG_GP3:        /* General Purpose Register 3 */
+        s->regs[c->regmap[offset]] = val;
+        break;
+    default:
+        if (!c->write(s, offset, val)) {
+            qemu_log_mask(LOG_UNIMP, "%s: unimplemented register 0x%04x\n",
+                          __func__, (uint32_t)offset);
+        }
+        break;
+    }
+}
+
+static const MemoryRegionOps allwinner_rtc_ops = {
+    .read = allwinner_rtc_read,
+    .write = allwinner_rtc_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+    .impl.min_access_size = 4,
+};
+
+static void allwinner_rtc_reset(DeviceState *dev)
+{
+    AwRtcState *s = AW_RTC(dev);
+    struct tm now;
+
+    /* Clear registers */
+    memset(s->regs, 0, sizeof(s->regs));
+
+    /* Get current datetime */
+    qemu_get_timedate(&now, 0);
+
+    /* Set RTC with current datetime */
+    if (s->base_year > 1900) {
+        s->regs[REG_YYMMDD] =  ((now.tm_year + 1900 - s->base_year) << 16) |
+                               ((now.tm_mon + 1) << 8) |
+                                 now.tm_mday;
+        s->regs[REG_HHMMSS] = (((now.tm_wday + 6) % 7) << 29) |
+                                  (now.tm_hour << 16) |
+                                  (now.tm_min << 8) |
+                                   now.tm_sec;
+    }
+}
+
+static void allwinner_rtc_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    AwRtcState *s = AW_RTC(obj);
+
+    /* Memory mapping */
+    memory_region_init_io(&s->iomem, OBJECT(s), &allwinner_rtc_ops, s,
+                          TYPE_AW_RTC, 1 * KiB);
+    sysbus_init_mmio(sbd, &s->iomem);
+}
+
+static const VMStateDescription allwinner_rtc_vmstate = {
+    .name = "allwinner-rtc",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, AwRtcState, AW_RTC_REGS_NUM),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property allwinner_rtc_properties[] = {
+    DEFINE_PROP_INT32("base-year", AwRtcState, base_year, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void allwinner_rtc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = allwinner_rtc_reset;
+    dc->vmsd = &allwinner_rtc_vmstate;
+    device_class_set_props(dc, allwinner_rtc_properties);
+}
+
+static void allwinner_rtc_sun4i_init(Object *obj)
+{
+    AwRtcState *s = AW_RTC(obj);
+    s->base_year = 2010;
+}
+
+static void allwinner_rtc_sun4i_class_init(ObjectClass *klass, void *data)
+{
+    AwRtcClass *arc = AW_RTC_CLASS(klass);
+
+    arc->regmap = allwinner_rtc_sun4i_regmap;
+    arc->regmap_size = sizeof(allwinner_rtc_sun4i_regmap);
+    arc->read = allwinner_rtc_sun4i_read;
+    arc->write = allwinner_rtc_sun4i_write;
+}
+
+static void allwinner_rtc_sun6i_init(Object *obj)
+{
+    AwRtcState *s = AW_RTC(obj);
+    s->base_year = 1970;
+}
+
+static void allwinner_rtc_sun6i_class_init(ObjectClass *klass, void *data)
+{
+    AwRtcClass *arc = AW_RTC_CLASS(klass);
+
+    arc->regmap = allwinner_rtc_sun6i_regmap;
+    arc->regmap_size = sizeof(allwinner_rtc_sun6i_regmap);
+    arc->read = allwinner_rtc_sun6i_read;
+    arc->write = allwinner_rtc_sun6i_write;
+}
+
+static void allwinner_rtc_sun7i_init(Object *obj)
+{
+    AwRtcState *s = AW_RTC(obj);
+    s->base_year = 1970;
+}
+
+static void allwinner_rtc_sun7i_class_init(ObjectClass *klass, void *data)
+{
+    AwRtcClass *arc = AW_RTC_CLASS(klass);
+    allwinner_rtc_sun4i_class_init(klass, arc);
+}
+
+static const TypeInfo allwinner_rtc_info = {
+    .name          = TYPE_AW_RTC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_init = allwinner_rtc_init,
+    .instance_size = sizeof(AwRtcState),
+    .class_init    = allwinner_rtc_class_init,
+    .class_size    = sizeof(AwRtcClass),
+    .abstract      = true,
+};
+
+static const TypeInfo allwinner_rtc_sun4i_info = {
+    .name          = TYPE_AW_RTC_SUN4I,
+    .parent        = TYPE_AW_RTC,
+    .class_init    = allwinner_rtc_sun4i_class_init,
+    .instance_init = allwinner_rtc_sun4i_init,
+};
+
+static const TypeInfo allwinner_rtc_sun6i_info = {
+    .name          = TYPE_AW_RTC_SUN6I,
+    .parent        = TYPE_AW_RTC,
+    .class_init    = allwinner_rtc_sun6i_class_init,
+    .instance_init = allwinner_rtc_sun6i_init,
+};
+
+static const TypeInfo allwinner_rtc_sun7i_info = {
+    .name          = TYPE_AW_RTC_SUN7I,
+    .parent        = TYPE_AW_RTC,
+    .class_init    = allwinner_rtc_sun7i_class_init,
+    .instance_init = allwinner_rtc_sun7i_init,
+};
+
+static void allwinner_rtc_register(void)
+{
+    type_register_static(&allwinner_rtc_info);
+    type_register_static(&allwinner_rtc_sun4i_info);
+    type_register_static(&allwinner_rtc_sun6i_info);
+    type_register_static(&allwinner_rtc_sun7i_info);
+}
+
+type_init(allwinner_rtc_register)
diff --git a/hw/rtc/trace-events b/hw/rtc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/trace-events
+++ b/hw/rtc/trace-events
@@ -XXX,XX +XXX,XX @@
 # See docs/devel/tracing.txt for syntax documentation.
 
+# allwinner-rtc.c
+allwinner_rtc_read(uint64_t addr, uint64_t value) "addr 0x%" PRIx64 " value 0x%" PRIx64
+allwinner_rtc_write(uint64_t addr, uint64_t value) "addr 0x%" PRIx64 " value 0x%" PRIx64
+
 # sun4v-rtc.c
 sun4v_rtc_read(uint64_t addr, uint64_t value) "read: addr 0x%" PRIx64 " value 0x%" PRIx64
 sun4v_rtc_write(uint64_t addr, uint64_t value) "write: addr 0x%" PRIx64 " value 0x%" PRIx64
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

This test boots a Linux kernel on a OrangePi PC board and verify
the serial output is working.

The kernel image and DeviceTree blob are built by the Armbian
project (based on Debian):
https://www.armbian.com/orange-pi-pc/

If ARM is a target being built, "make check-acceptance" will
automatically include this test by the use of the "arch:arm" tags.

Alternatively, this test can be run using:

$ make check-venv
  $ ./tests/venv/bin/avocado --show=console,app run -t machine:orangepi-pc tests/acceptance/boot_linux_console.py
  JOB ID     : 2e4d15eceb13c33672af406f08171e6e9de1414a
  JOB LOG    : ~/job-results/job-2019-12-17T05.46-2e4d15e/job.log
  (1/1) tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_orangepi:
  console: Uncompressing Linux... done, booting the kernel.
  console: Booting Linux on physical CPU 0x0
  console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
  console: CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
  console: CPU: div instructions available: patching division code
  console: CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
  console: OF: fdt: Machine model: Xunlong Orange Pi PC
  console: Memory policy: Data cache writealloc
  console: OF: reserved mem: failed to allocate memory for node 'cma@4a000000'
  console: cma: Failed to reserve 128 MiB
  console: psci: probing for conduit method from DT.
  console: psci: PSCIv0.2 detected in firmware.
  console: psci: Using standard PSCI v0.2 function IDs
  console: psci: Trusted OS migration not required
  console: random: get_random_bytes called from start_kernel+0x8d/0x3c2 with crng_init=0
  console: percpu: Embedded 18 pages/cpu @(ptrval) s41228 r8192 d24308 u73728
  console: Built 1 zonelists, mobility grouping on.  Total pages: 32480
  console: Kernel command line: printk.time=0 console=ttyS0,115200
  PASS (8.59 s)
  JOB TIME   : 8.81 s

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-14-nieklinnenbank@gmail.com
[NL: rename in commit message Raspbian to Armbian, remove vm.set_machine()]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

This test boots a Linux kernel on a OrangePi PC board and verify
the serial output is working.

The kernel image and DeviceTree blob are built by the Armbian
project (based on Debian):
https://www.armbian.com/orange-pi-pc/

The cpio image used comes from the linux-build-test project:
https://github.com/groeck/linux-build-test

If ARM is a target being built, "make check-acceptance" will
automatically include this test by the use of the "arch:arm" tags.

Alternatively, this test can be run using:

$ avocado --show=console run -t machine:orangepi-pc tests/acceptance/boot_linux_console.py
  console: Uncompressing Linux... done, booting the kernel.
  console: Booting Linux on physical CPU 0x0
  console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
  console: CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
  console: CPU: div instructions available: patching division code
  console: CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
  console: OF: fdt: Machine model: Xunlong Orange Pi PC
  [...]
  console: Trying to unpack rootfs image as initramfs...
  console: Freeing initrd memory: 3256K
  console: Freeing unused kernel memory: 1024K
  console: Run /init as init process
  console: mount: mounting devtmpfs on /dev failed: Device or resource busy
  console: Starting logging: OK
  console: Initializing random number generator... random: dd: uninitialized urandom read (512 bytes read)
  console: done.
  console: Starting network: OK
  console: Found console ttyS0
  console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
  console: Boot successful.
  console: cat /proc/cpuinfo
  console: / # cat /proc/cpuinfo
  console: processor      : 0
  console: model name     : ARMv7 Processor rev 5 (v7l)
  console: BogoMIPS       : 125.00
  console: Features       : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
  console: CPU implementer        : 0x41
  console: CPU architecture: 7
  console: CPU variant    : 0x0
  console: CPU part       : 0xc07
  console: CPU revision   : 5
  [...]
  console: processor      : 3
  console: model name     : ARMv7 Processor rev 5 (v7l)
  console: BogoMIPS       : 125.00
  console: Features       : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
  console: CPU implementer        : 0x41
  console: CPU architecture: 7
  console: CPU variant    : 0x0
  console: CPU part       : 0xc07
  console: CPU revision   : 5
  console: Hardware       : Allwinner sun8i Family
  console: Revision       : 0000
  console: Serial         : 0000000000000000
  console: cat /proc/iomem
  console: / # cat /proc/iomem
  console: 01000000-010fffff : clock@1000000
  console: 01c00000-01c00fff : system-control@1c00000
  console: 01c02000-01c02fff : dma-controller@1c02000
  [...]
  console: reboot
  console: / # reboot
  console: / # Found console ttyS0
  console: Stopping network: OK
  console: hrtimer: interrupt took 21852064 ns
  console: Saving random seed... random: dd: uninitialized urandom read (512 bytes read)
  console: done.
  console: Stopping logging: OK
  console: umount: devtmpfs busy - remounted read-only
  console: umount: can't unmount /: Invalid argument
  console: The system is going down NOW!
  console: Sent SIGTERM to all processes
  console: Sent SIGKILL to all processes
  console: Requesting system reboot
  console: reboot: Restarting system
  PASS (48.32 s)
  JOB TIME   : 49.16 s

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-15-nieklinnenbank@gmail.com
[NL: rename in commit message Raspbian to Armbian, remove vm.set_machine()]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 40 ++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The kernel image and DeviceTree blob are built by the Armbian
project (based on Debian):
https://www.armbian.com/orange-pi-pc/

The SD image is from the kernelci.org project:
https://kernelci.org/faq/#the-code

If ARM is a target being built, "make check-acceptance" will
automatically include this test by the use of the "arch:arm" tags.

Alternatively, this test can be run using:

$ avocado --show=console run -t machine:orangepi-pc tests/acceptance/boot_linux_console.py
  console: Uncompressing Linux... done, booting the kernel.
  console: Booting Linux on physical CPU 0x0
  console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
  console: CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
  [...]
  console: sunxi-wdt 1c20ca0.watchdog: Watchdog enabled (timeout=16 sec, nowayout=0)
  console: sunxi-mmc 1c0f000.mmc: Linked as a consumer to regulator.2
  console: sunxi-mmc 1c0f000.mmc: Got CD GPIO
  console: ledtrig-cpu: registered to indicate activity on CPUs
  console: hidraw: raw HID events driver (C) Jiri Kosina
  console: usbcore: registered new interface driver usbhid
  console: usbhid: USB HID core driver
  console: Initializing XFRM netlink socket
  console: sunxi-mmc 1c0f000.mmc: initialized, max. request size: 16384 KB
  console: NET: Registered protocol family 10
  console: mmc0: host does not support reading read-only switch, assuming write-enable
  console: mmc0: Problem switching card into high-speed mode!
  console: mmc0: new SD card at address 4567
  console: mmcblk0: mmc0:4567 QEMU! 60.0 MiB
  [...]
  console: EXT4-fs (mmcblk0): mounting ext2 file system using the ext4 subsystem
  console: EXT4-fs (mmcblk0): mounted filesystem without journal. Opts: (null)
  console: VFS: Mounted root (ext2 filesystem) on device 179:0.
  console: Run /sbin/init as init process
  console: EXT4-fs (mmcblk0): re-mounted. Opts: block_validity,barrier,user_xattr,acl
  console: Starting syslogd: OK
  console: Starting klogd: OK
  console: Populating /dev using udev: udevd[203]: starting version 3.2.7
  console: /bin/sh: can't access tty; job control turned off
  console: cat /proc/partitions
  console: / # cat /proc/partitions
  console: major minor  #blocks  name
  console: 1        0       4096 ram0
  console: 1        1       4096 ram1
  console: 1        2       4096 ram2
  console: 1        3       4096 ram3
  console: 179        0      61440 mmcblk0
  console: reboot
  console: / # reboot
  console: umount: devtmpfs busy - remounted read-only
  console: EXT4-fs (mmcblk0): re-mounted. Opts: (null)
  console: The system is going down NOW!
  console: Sent SIGTERM to all processes
  console: Sent SIGKILL to all processes
  console: Requesting system reboot
  console: reboot: Restarting system
  JOB TIME   : 68.64 s

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-16-nieklinnenbank@gmail.com
[NL: rename in commit message Raspbian to Armbian, remove vm.set_machine()]
[NL: extend test with ethernet device checks]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 47 ++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

This test boots Ubuntu Bionic on a OrangePi PC board.

As it requires 1GB of storage, and is slow, this test is disabled
on automatic CI testing.

It is useful for workstation testing. Currently Avocado timeouts too
quickly, so we can't run userland commands.

The kernel image and DeviceTree blob are built by the Armbian
project (based on Debian):
https://www.armbian.com/orange-pi-pc/

The Ubuntu image is downloaded from:
https://dl.armbian.com/orangepipc/Bionic_current

This test can be run using:

$ AVOCADO_ALLOW_LARGE_STORAGE=yes \
    avocado --show=app,console run -t machine:orangepi-pc \
      tests/acceptance/boot_linux_console.py
  console: U-Boot SPL 2019.04-armbian (Nov 18 2019 - 23:08:35 +0100)
  console: DRAM: 1024 MiB
  console: Failed to set core voltage! Can't set CPU frequency
  console: Trying to boot from MMC1
  console: U-Boot 2019.04-armbian (Nov 18 2019 - 23:08:35 +0100) Allwinner Technology
  console: CPU:   Allwinner H3 (SUN8I 0000)
  console: Model: Xunlong Orange Pi PC
  console: DRAM:  1 GiB
  console: MMC:   mmc@1c0f000: 0
  [...]
  console: Uncompressing Linux... done, booting the kernel.
  console: Booting Linux on physical CPU 0x0
  console: Linux version 5.3.9-sunxi (root@builder) (gcc version 8.3.0 (GNU Toolchain for the A-profile Architecture 8.3-2019.03 (arm-rel-8.36))) #19.11.3 SMP Mon Nov 18 18:49:43 CET 2019
  console: CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=50c5387d
  console: CPU: div instructions available: patching division code
  console: CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
  console: OF: fdt: Machine model: Xunlong Orange Pi PC
  [...]
  console: EXT4-fs (mmcblk0p1): mounted filesystem with writeback data mode. Opts: (null)
  console: done.
  console: Begin: Running /scripts/local-bottom ... done.
  console: Begin: Running /scripts/init-bottom ... done.
  console: systemd[1]: systemd 237 running in system mode. (...)
  console: systemd[1]: Detected architecture arm.
  console: Welcome to Ubuntu 18.04.3 LTS!
  console: systemd[1]: Set hostname to <orangepipc>.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-17-nieklinnenbank@gmail.com
[NL: rename in commit message Raspbian to Armbian, remove vm.set_machine()]
[NL: changed test to boot from SD card via BootROM, added check for 7z]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 48 ++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

This test boots U-Boot then NetBSD (stored on a SD card) on
a OrangePi PC board.

As it requires ~1.3GB of storage, it is disabled by default.

U-Boot is built by the Debian project [1], and the SD card image
is provided by the NetBSD organization [2].

Once the compressed SD card image is downloaded (304MB) and
extracted, this test is fast:

$ AVOCADO_ALLOW_LARGE_STORAGE=yes \
    avocado --show=app,console run -t machine:orangepi-pc \
      tests/acceptance/boot_linux_console.py
  console: U-Boot SPL 2020.01+dfsg-1 (Jan 08 2020 - 08:19:44 +0000)
  console: DRAM: 1024 MiB
  console: U-Boot 2020.01+dfsg-1 (Jan 08 2020 - 08:19:44 +0000) Allwinner Technology
  console: CPU:   Allwinner H3 (SUN8I 0000)
  console: scanning bus usb@1c1b000 for devices... 1 USB Device(s) found
  console: scanning bus usb@1c1d000 for devices... 1 USB Device(s) found
  console: scanning usb for storage devices... 0 Storage Device(s) found
  console: Hit any key to stop autoboot:  0
  console: => setenv bootargs root=ld0a
  console: => setenv kernel netbsd-GENERIC.ub
  console: => setenv fdtfile dtb/sun8i-h3-orangepi-pc.dtb
  console: => boot
  console: ## Booting kernel from Legacy Image at 42000000 ...
  console: Image Name:   NetBSD/earmv7hf 9.0_RC1
  console: Image Type:   ARM Linux Kernel Image (no loading done) (uncompressed)
  console: XIP Kernel Image (no loading done)
  console: Loading Device Tree to 49ff6000, end 49fffe01 ... OK
  console: Starting kernel ...
  console: [   1.0000000] NetBSD/evbarm (fdt) booting ...
  console: [   1.0000000] NetBSD 9.0 (GENERIC) #0: Fri Feb 14 00:06:28 UTC 2020
  console: [   1.0000000]         mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/evbarm/compile/GENERIC
  console: [   1.0000000] total memory = 1024 MB
  console: [   1.0000000] avail memory = 1003 MB
  console: [   1.0000000] armfdt0 (root)
  console: [   1.0000000] simplebus0 at armfdt0: Xunlong Orange Pi PC
  console: [   1.0000000] cpu0 at cpus0: Cortex-A7 r0p5 (Cortex V7A core)
  console: [   1.0000000] cpu0: DC enabled IC enabled WB enabled LABT branch prediction enabled
  console: [   1.0000000] cpu0: 32KB/64B 2-way L1 VIPT Instruction cache
  console: [   1.0000000] cpu0: 32KB/64B 2-way write-back-locking-C L1 PIPT Data cache
  console: [   1.0000000] cpu0: 2304KB/64B 16-way write-through L2 PIPT Unified cache
  console: [   1.0000000] vfp0 at cpu0: NEON MPE (VFP 3.0+), rounding, NaN propagation, denormals
  ...
  console: [   2.3812082] sdmmc0: SD card status: 4-bit, C0
  console: [   2.3812082] ld0 at sdmmc0: <0xaa:0x5859:QEMU!:0x01:0xdeadbeef:0x062>
  console: [   2.4012856] ld0: 1226 MB, 622 cyl, 64 head, 63 sec, 512 bytes/sect x 2511872 sectors
  console: [   2.5321222] ld0: 4-bit width, High-Speed/SDR25, 50.000 MHz
  console: [   3.1068718] WARNING: 4 errors while detecting hardware; check system log.
  console: [   3.1179868] boot device: ld0
  console: [   3.1470623] root on ld0a dumps on ld0b
  console: [   3.2464436] root file system type: ffs
  console: [   3.2897123] kern.module.path=/stand/evbarm/9.0/modules
  console: Mon Feb 17 20:33:35 UTC 2020
  console: Starting root file system check:
  PASS (35.96 s)
  RESULTS    : PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0
  JOB TIME   : 36.09 s

Note, this test only took ~65 seconds to run on Travis-CI, see: [3].

This test is based on a description from Niek Linnenbank from [4].

[1] https://wiki.debian.org/InstallingDebianOn/Allwinner#Creating_a_bootable_SD_Card_with_u-boot
[2] https://wiki.netbsd.org/ports/evbarm/allwinner/
[3] https://travis-ci.org/philmd/qemu/jobs/638823612#L3778
[4] https://www.mail-archive.com/qemu-devel@nongnu.org/msg669347.html

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-18-nieklinnenbank@gmail.com
[NL: changed test to use NetBSD 9.0 final release and -global allwinner-rtc.base-year]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 70 ++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)

diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -XXX,XX +XXX,XX @@ import shutil
 from avocado import skipUnless
 from avocado_qemu import Test
 from avocado_qemu import exec_command_and_wait_for_pattern
+from avocado_qemu import interrupt_interactive_console_until_pattern
 from avocado_qemu import wait_for_console_pattern
 from avocado.utils import process
 from avocado.utils import archive
@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
                                       'to <orangepipc>')
         self.wait_for_console_pattern('Starting Load Kernel Modules...')
 
+    @skipUnless(os.getenv('AVOCADO_ALLOW_LARGE_STORAGE'), 'storage limited')
+    def test_arm_orangepi_uboot_netbsd9(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:orangepi-pc
+        """
+        # This test download a 304MB compressed image and expand it to 1.3GB...
+        deb_url = ('http://snapshot.debian.org/archive/debian/'
+                   '20200108T145233Z/pool/main/u/u-boot/'
+                   'u-boot-sunxi_2020.01%2Bdfsg-1_armhf.deb')
+        deb_hash = 'f67f404a80753ca3d1258f13e38f2b060e13db99'
+        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+        # We use the common OrangePi PC 'plus' build of U-Boot for our secondary
+        # program loader (SPL). We will then set the path to the more specific
+        # OrangePi "PC" device tree blob with 'setenv fdtfile' in U-Boot prompt,
+        # before to boot NetBSD.
+        uboot_path = '/usr/lib/u-boot/orangepi_plus/u-boot-sunxi-with-spl.bin'
+        uboot_path = self.extract_from_deb(deb_path, uboot_path)
+        image_url = ('https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0/'
+                     'evbarm-earmv7hf/binary/gzimg/armv7.img.gz')
+        image_hash = '2babb29d36d8360adcb39c09e31060945259917a'
+        image_path_gz = self.fetch_asset(image_url, asset_hash=image_hash)
+        image_path = os.path.join(self.workdir, 'armv7.img')
+        image_drive_args = 'if=sd,format=raw,snapshot=on,file=' + image_path
+        archive.gzip_uncompress(image_path_gz, image_path)
+
+        # dd if=u-boot-sunxi-with-spl.bin of=armv7.img bs=1K seek=8 conv=notrunc
+        with open(uboot_path, 'rb') as f_in:
+            with open(image_path, 'r+b') as f_out:
+                f_out.seek(8 * 1024)
+                shutil.copyfileobj(f_in, f_out)
+
+                # Extend image, to avoid that NetBSD thinks the partition
+                # inside the image is larger than device size itself
+                f_out.seek(0, 2)
+                f_out.seek(64 * 1024 * 1024, 1)
+                f_out.write(bytearray([0x00]))
+
+        self.vm.set_console()
+        self.vm.add_args('-nic', 'user',
+                         '-drive', image_drive_args,
+                         '-global', 'allwinner-rtc.base-year=2000',
+                         '-no-reboot')
+        self.vm.launch()
+        wait_for_console_pattern(self, 'U-Boot 2020.01+dfsg-1')
+        interrupt_interactive_console_until_pattern(self,
+                                       'Hit any key to stop autoboot:',
+                                       'switch to partitions #0, OK')
+
+        exec_command_and_wait_for_pattern(self, '', '=>')
+        cmd = 'setenv bootargs root=ld0a'
+        exec_command_and_wait_for_pattern(self, cmd, '=>')
+        cmd = 'setenv kernel netbsd-GENERIC.ub'
+        exec_command_and_wait_for_pattern(self, cmd, '=>')
+        cmd = 'setenv fdtfile dtb/sun8i-h3-orangepi-pc.dtb'
+        exec_command_and_wait_for_pattern(self, cmd, '=>')
+        cmd = ("setenv bootcmd 'fatload mmc 0:1 ${kernel_addr_r} ${kernel}; "
+               "fatload mmc 0:1 ${fdt_addr_r} ${fdtfile}; "
+               "fdt addr ${fdt_addr_r}; "
+               "bootm ${kernel_addr_r} - ${fdt_addr_r}'")
+        exec_command_and_wait_for_pattern(self, cmd, '=>')
+
+        exec_command_and_wait_for_pattern(self, 'boot',
+                                          'Booting kernel from Legacy Image')
+        wait_for_console_pattern(self, 'Starting kernel ...')
+        wait_for_console_pattern(self, 'NetBSD 9.0 (GENERIC)')
+        # Wait for user-space
+        wait_for_console_pattern(self, 'Starting root file system check')
+
     def test_s390x_s390_ccw_virtio(self):
         """
         :avocado: tags=arch:s390x
-- 
2.20.1

From: Niek Linnenbank <nieklinnenbank@gmail.com>

The Xunlong Orange Pi PC machine is a functional ARM machine
based on the Allwinner H3 System-on-Chip. It supports mainline
Linux, U-Boot, NetBSD and is covered by acceptance tests.

This commit adds a documentation text file with a description
of the machine and instructions for the user.

Signed-off-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200311221854.30370-19-nieklinnenbank@gmail.com
[PMM: moved file into docs/system/arm to match the reorg
of the arm target part of the docs; tweaked heading to
match other boards]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                  |   1 +
 docs/system/arm/orangepi.rst | 253 +++++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst   |   2 +
 3 files changed, 256 insertions(+)
 create mode 100644 docs/system/arm/orangepi.rst

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ S: Maintained
 F: hw/*/allwinner-h3*
 F: include/hw/*/allwinner-h3*
 F: hw/arm/orangepi.c
+F: docs/system/orangepi.rst
 
 ARM PrimeCell and CMSDK devices
 M: Peter Maydell <peter.maydell@linaro.org>
diff --git a/docs/system/arm/orangepi.rst b/docs/system/arm/orangepi.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/orangepi.rst
@@ -XXX,XX +XXX,XX @@
+Orange Pi PC (``orangepi-pc``)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The Xunlong Orange Pi PC is an Allwinner H3 System on Chip
+based embedded computer with mainline support in both U-Boot
+and Linux. The board comes with a Quad Core Cortex-A7 @ 1.3GHz,
+1GiB RAM, 100Mbit ethernet, USB, SD/MMC, USB, HDMI and
+various other I/O.
+
+Supported devices
+"""""""""""""""""
+
+The Orange Pi PC machine supports the following devices:
+
+ * SMP (Quad Core Cortex-A7)
+ * Generic Interrupt Controller configuration
+ * SRAM mappings
+ * SDRAM controller
+ * Real Time Clock
+ * Timer device (re-used from Allwinner A10)
+ * UART
+ * SD/MMC storage controller
+ * EMAC ethernet
+ * USB 2.0 interfaces
+ * Clock Control Unit
+ * System Control module
+ * Security Identifier device
+
+Limitations
+"""""""""""
+
+Currently, Orange Pi PC does *not* support the following features:
+
+- Graphical output via HDMI, GPU and/or the Display Engine
+- Audio output
+- Hardware Watchdog
+
+Also see the 'unimplemented' array in the Allwinner H3 SoC module
+for a complete list of unimplemented I/O devices: ``./hw/arm/allwinner-h3.c``
+
+Boot options
+""""""""""""
+
+The Orange Pi PC machine can start using the standard -kernel functionality
+for loading a Linux kernel or ELF executable. Additionally, the Orange Pi PC
+machine can also emulate the BootROM which is present on an actual Allwinner H3
+based SoC, which loads the bootloader from a SD card, specified via the -sd argument
+to qemu-system-arm.
+
+Machine-specific options
+""""""""""""""""""""""""
+
+The following machine-specific options are supported:
+
+- allwinner-rtc.base-year=YYYY
+
+  The Allwinner RTC device is automatically created by the Orange Pi PC machine
+  and uses a default base year value which can be overridden using the 'base-year' property.
+  The base year is the actual represented year when the RTC year value is zero.
+  This option can be used in case the target operating system driver uses a different
+  base year value. The minimum value for the base year is 1900.
+
+- allwinner-sid.identifier=abcd1122-a000-b000-c000-12345678ffff
+
+  The Security Identifier value can be read by the guest.
+  For example, U-Boot uses it to determine a unique MAC address.
+
+The above machine-specific options can be specified in qemu-system-arm
+via the '-global' argument, for example:
+
+.. code-block:: bash
+
+  $ qemu-system-arm -M orangepi-pc -sd mycard.img \
+       -global allwinner-rtc.base-year=2000
+
+Running mainline Linux
+""""""""""""""""""""""
+
+Mainline Linux kernels from 4.19 up to latest master are known to work.
+To build a Linux mainline kernel that can be booted by the Orange Pi PC machine,
+simply configure the kernel using the sunxi_defconfig configuration:
+
+.. code-block:: bash
+
+  $ ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- make mrproper
+  $ ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- make sunxi_defconfig
+
+To be able to use USB storage, you need to manually enable the corresponding
+configuration item. Start the kconfig configuration tool:
+
+.. code-block:: bash
+
+  $ ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- make menuconfig
+
+Navigate to the following item, enable it and save your configuration:
+
+  Device Drivers > USB support > USB Mass Storage support
+
+Build the Linux kernel with:
+
+.. code-block:: bash
+
+  $ ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- make
+
+To boot the newly build linux kernel in QEMU with the Orange Pi PC machine, use:
+
+.. code-block:: bash
+
+  $ qemu-system-arm -M orangepi-pc -nic user -nographic \
+      -kernel /path/to/linux/arch/arm/boot/zImage \
+      -append 'console=ttyS0,115200' \
+      -dtb /path/to/linux/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dtb
+
+Orange Pi PC images
+"""""""""""""""""""
+
+Note that the mainline kernel does not have a root filesystem. You may provide it
+with an official Orange Pi PC image from the official website:
+
+  http://www.orangepi.org/downloadresources/
+
+Another possibility is to run an Armbian image for Orange Pi PC which
+can be downloaded from:
+
+   https://www.armbian.com/orange-pi-pc/
+
+Alternatively, you can also choose to build you own image with buildroot
+using the orangepi_pc_defconfig. Also see https://buildroot.org for more information.
+
+You can choose to attach the selected image either as an SD card or as USB mass storage.
+For example, to boot using the Orange Pi PC Debian image on SD card, simply add the -sd
+argument and provide the proper root= kernel parameter:
+
+.. code-block:: bash
+
+  $ qemu-system-arm -M orangepi-pc -nic user -nographic \
+      -kernel /path/to/linux/arch/arm/boot/zImage \
+      -append 'console=ttyS0,115200 root=/dev/mmcblk0p2' \
+      -dtb /path/to/linux/arch/arm/boot/dts/sun8i-h3-orangepi-pc.dtb \
+      -sd OrangePi_pc_debian_stretch_server_linux5.3.5_v1.0.img
+
+To attach the image as an USB mass storage device to the machine,
+simply append to the command:
+
+.. code-block:: bash
+
+  -drive if=none,id=stick,file=myimage.img \
+  -device usb-storage,bus=usb-bus.0,drive=stick
+
+Instead of providing a custom Linux kernel via the -kernel command you may also
+choose to let the Orange Pi PC machine load the bootloader from SD card, just like
+a real board would do using the BootROM. Simply pass the selected image via the -sd
+argument and remove the -kernel, -append, -dbt and -initrd arguments:
+
+.. code-block:: bash
+
+  $ qemu-system-arm -M orangepi-pc -nic user -nographic \
+       -sd Armbian_19.11.3_Orangepipc_buster_current_5.3.9.img
+
+Note that both the official Orange Pi PC images and Armbian images start
+a lot of userland programs via systemd. Depending on the host hardware and OS,
+they may be slow to emulate, especially due to emulating the 4 cores.
+To help reduce the performance slow down due to emulating the 4 cores, you can
+give the following kernel parameters via U-Boot (or via -append):
+
+.. code-block:: bash
+
+  => setenv extraargs 'systemd.default_timeout_start_sec=9000 loglevel=7 nosmp console=ttyS0,115200'
+
+Running U-Boot
+""""""""""""""
+
+U-Boot mainline can be build and configured using the orangepi_pc_defconfig
+using similar commands as describe above for Linux. Note that it is recommended
+for development/testing to select the following configuration setting in U-Boot:
+
+  Device Tree Control > Provider for DTB for DT Control > Embedded DTB
+
+To start U-Boot using the Orange Pi PC machine, provide the
+u-boot binary to the -kernel argument:
+
+.. code-block:: bash
+
+  $ qemu-system-arm -M orangepi-pc -nic user -nographic \
+      -kernel /path/to/uboot/u-boot -sd disk.img
+
+Use the following U-boot commands to load and boot a Linux kernel from SD card:
+
+.. code-block:: bash
+
+  => setenv bootargs console=ttyS0,115200
+  => ext2load mmc 0 0x42000000 zImage
+  => ext2load mmc 0 0x43000000 sun8i-h3-orangepi-pc.dtb
+  => bootz 0x42000000 - 0x43000000
+
+Running NetBSD
+""""""""""""""
+
+The NetBSD operating system also includes support for Allwinner H3 based boards,
+including the Orange Pi PC. NetBSD 9.0 is known to work best for the Orange Pi PC
+board and provides a fully working system with serial console, networking and storage.
+For the Orange Pi PC machine, get the 'evbarm-earmv7hf' based image from:
+
+  https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.0/evbarm-earmv7hf/binary/gzimg/armv7.img.gz
+
+The image requires manually installing U-Boot in the image. Build U-Boot with
+the orangepi_pc_defconfig configuration as described in the previous section.
+Next, unzip the NetBSD image and write the U-Boot binary including SPL using:
+
+.. code-block:: bash
+
+  $ gunzip armv7.img.gz
+  $ dd if=/path/to/u-boot-sunxi-with-spl.bin of=armv7.img bs=1024 seek=8 conv=notrunc
+
+Finally, before starting the machine the SD image must be extended such
+that the NetBSD kernel will not conclude the NetBSD partition is larger than
+the emulated SD card:
+
+.. code-block:: bash
+
+  $ dd if=/dev/zero bs=1M count=64 >> armv7.img
+
+Start the machine using the following command:
+
+.. code-block:: bash
+
+  $ qemu-system-arm -M orangepi-pc -nic user -nographic \
+        -sd armv7.img -global allwinner-rtc.base-year=2000
+
+At the U-Boot stage, interrupt the automatic boot process by pressing a key
+and set the following environment variables before booting:
+
+.. code-block:: bash
+
+  => setenv bootargs root=ld0a
+  => setenv kernel netbsd-GENERIC.ub
+  => setenv fdtfile dtb/sun8i-h3-orangepi-pc.dtb
+  => setenv bootcmd 'fatload mmc 0:1 ${kernel_addr_r} ${kernel}; fatload mmc 0:1 ${fdt_addr_r} ${fdtfile}; fdt addr ${fdt_addr_r}; bootm ${kernel_addr_r} - ${fdt_addr_r}'
+
+Optionally you may save the environment variables to SD card with 'saveenv'.
+To continue booting simply give the 'boot' command and NetBSD boots.
+
+Orange Pi PC acceptance tests
+"""""""""""""""""""""""""""""
+
+The Orange Pi PC machine has several acceptance tests included.
+To run the whole set of tests, build QEMU from source and simply
+provide the following command:
+
+.. code-block:: bash
+
+  $ AVOCADO_ALLOW_LARGE_STORAGE=yes avocado --show=app,console run \
+     -t machine:orangepi-pc tests/acceptance/boot_linux_console.py
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
 ``qemu-system-aarch64 --machine help``.
 
 .. toctree::
+   :maxdepth: 1
 
    arm/integratorcp
    arm/versatile
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/stellaris
    arm/musicpal
    arm/sx1
+   arm/orangepi
 
 Arm CPU features
 ================
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Mention 'max' value in the gic-version property description.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20200311131618.7187-2-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
                         virt_set_gic_version, NULL);
     object_property_set_description(obj, "gic-version",
                                     "Set GIC version. "
-                                    "Valid values are 2, 3 and host", NULL);
+                                    "Valid values are 2, 3, host and max",
+                                    NULL);
 
     vms->highmem_ecam = !vmc->no_highmem_ecam;
 
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

We plan to introduce yet another value for the gic version (nosel).
As we already use exotic values such as 0 and -1, let's introduce
a dedicated enum type and let vms->gic_version take this
type.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20200311131618.7187-3-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/virt.h | 11 +++++++++--
 hw/arm/virt.c         | 30 +++++++++++++++---------------
 2 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ typedef enum VirtIOMMUType {
     VIRT_IOMMU_VIRTIO,
 } VirtIOMMUType;
 
+typedef enum VirtGICType {
+    VIRT_GIC_VERSION_MAX,
+    VIRT_GIC_VERSION_HOST,
+    VIRT_GIC_VERSION_2,
+    VIRT_GIC_VERSION_3,
+} VirtGICType;
+
 typedef struct MemMapEntry {
     hwaddr base;
     hwaddr size;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     bool highmem_ecam;
     bool its;
     bool virt;
-    int32_t gic_version;
+    VirtGICType gic_version;
     VirtIOMMUType iommu;
     uint16_t virtio_iommu_bdf;
     struct arm_boot_info bootinfo;
@@ -XXX,XX +XXX,XX @@ static inline int virt_gicv3_redist_region_count(VirtMachineState *vms)
     uint32_t redist0_capacity =
                 vms->memmap[VIRT_GIC_REDIST].size / GICV3_REDIST_SIZE;
 
-    assert(vms->gic_version == 3);
+    assert(vms->gic_version == VIRT_GIC_VERSION_3);
 
     return vms->smp_cpus > redist0_capacity ? 2 : 1;
 }
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void fdt_add_timer_nodes(const VirtMachineState *vms)
         irqflags = GIC_FDT_IRQ_FLAGS_EDGE_LO_HI;
     }
 
-    if (vms->gic_version == 2) {
+    if (vms->gic_version == VIRT_GIC_VERSION_2) {
         irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START,
                              GIC_FDT_IRQ_PPI_CPU_WIDTH,
                              (1 << vms->smp_cpus) - 1);
@@ -XXX,XX +XXX,XX @@ static void fdt_add_gic_node(VirtMachineState *vms)
     qemu_fdt_setprop_cell(vms->fdt, nodename, "#address-cells", 0x2);
     qemu_fdt_setprop_cell(vms->fdt, nodename, "#size-cells", 0x2);
     qemu_fdt_setprop(vms->fdt, nodename, "ranges", NULL, 0);
-    if (vms->gic_version == 3) {
+    if (vms->gic_version == VIRT_GIC_VERSION_3) {
         int nb_redist_regions = virt_gicv3_redist_region_count(vms);
 
         qemu_fdt_setprop_string(vms->fdt, nodename, "compatible",
@@ -XXX,XX +XXX,XX @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
         }
     }
 
-    if (vms->gic_version == 2) {
+    if (vms->gic_version == VIRT_GIC_VERSION_2) {
         irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START,
                              GIC_FDT_IRQ_PPI_CPU_WIDTH,
                              (1 << vms->smp_cpus) - 1);
@@ -XXX,XX +XXX,XX @@ static uint64_t virt_cpu_mp_affinity(VirtMachineState *vms, int idx)
          * purposes are to make TCG consistent (with 64-bit KVM hosts)
          * and to improve SGI efficiency.
          */
-        if (vms->gic_version == 3) {
+        if (vms->gic_version == VIRT_GIC_VERSION_3) {
             clustersz = GICV3_TARGETLIST_BITS;
         } else {
             clustersz = GIC_TARGETLIST_BITS;
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     /* We can probe only here because during property set
      * KVM is not available yet
      */
-    if (vms->gic_version <= 0) {
-        /* "host" or "max" */
+    if (vms->gic_version == VIRT_GIC_VERSION_HOST ||
+        vms->gic_version == VIRT_GIC_VERSION_MAX) {
         if (!kvm_enabled()) {
-            if (vms->gic_version == 0) {
+            if (vms->gic_version == VIRT_GIC_VERSION_HOST) {
                 error_report("gic-version=host requires KVM");
                 exit(1);
             } else {
                 /* "max": currently means 3 for TCG */
-                vms->gic_version = 3;
+                vms->gic_version = VIRT_GIC_VERSION_3;
             }
         } else {
             vms->gic_version = kvm_arm_vgic_probe();
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     /* The maximum number of CPUs depends on the GIC version, or on how
      * many redistributors we can fit into the memory map.
      */
-    if (vms->gic_version == 3) {
+    if (vms->gic_version == VIRT_GIC_VERSION_3) {
         virt_max_cpus =
             vms->memmap[VIRT_GIC_REDIST].size / GICV3_REDIST_SIZE;
         virt_max_cpus +=
@@ -XXX,XX +XXX,XX @@ static void virt_set_its(Object *obj, bool value, Error **errp)
 static char *virt_get_gic_version(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-    const char *val = vms->gic_version == 3 ? "3" : "2";
+    const char *val = vms->gic_version == VIRT_GIC_VERSION_3 ? "3" : "2";
 
     return g_strdup(val);
 }
@@ -XXX,XX +XXX,XX @@ static void virt_set_gic_version(Object *obj, const char *value, Error **errp)
     VirtMachineState *vms = VIRT_MACHINE(obj);
 
     if (!strcmp(value, "3")) {
-        vms->gic_version = 3;
+        vms->gic_version = VIRT_GIC_VERSION_3;
     } else if (!strcmp(value, "2")) {
-        vms->gic_version = 2;
+        vms->gic_version = VIRT_GIC_VERSION_2;
     } else if (!strcmp(value, "host")) {
-        vms->gic_version = 0; /* Will probe later */
+        vms->gic_version = VIRT_GIC_VERSION_HOST; /* Will probe later */
     } else if (!strcmp(value, "max")) {
-        vms->gic_version = -1; /* Will probe later */
+        vms->gic_version = VIRT_GIC_VERSION_MAX; /* Will probe later */
     } else {
         error_setg(errp, "Invalid gic-version value");
         error_append_hint(errp, "Valid values are 3, 2, host, max.\n");
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
                                     "physical address space above 32 bits",
                                     NULL);
     /* Default GIC type is v2 */
-    vms->gic_version = 2;
+    vms->gic_version = VIRT_GIC_VERSION_2;
     object_property_add_str(obj, "gic-version", virt_get_gic_version,
                         virt_set_gic_version, NULL);
     object_property_set_description(obj, "gic-version",
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Let's move the code which freezes which gic-version to
be applied in a dedicated function. We also now set by
default the VIRT_GIC_VERSION_NO_SET. This eventually
turns into the legacy v2 choice in the finalize() function.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20200311131618.7187-4-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/virt.h |  1 +
 hw/arm/virt.c         | 54 ++++++++++++++++++++++++++-----------------
 2 files changed, 34 insertions(+), 21 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ typedef enum VirtGICType {
     VIRT_GIC_VERSION_HOST,
     VIRT_GIC_VERSION_2,
     VIRT_GIC_VERSION_3,
+    VIRT_GIC_VERSION_NOSEL,
 } VirtGICType;
 
 typedef struct MemMapEntry {
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_set_memmap(VirtMachineState *vms)
     }
 }
 
+/*
+ * finalize_gic_version - Determines the final gic_version
+ * according to the gic-version property
+ *
+ * Default GIC type is v2
+ */
+static void finalize_gic_version(VirtMachineState *vms)
+{
+    if (vms->gic_version == VIRT_GIC_VERSION_HOST ||
+        vms->gic_version == VIRT_GIC_VERSION_MAX) {
+        if (!kvm_enabled()) {
+            if (vms->gic_version == VIRT_GIC_VERSION_HOST) {
+                error_report("gic-version=host requires KVM");
+                exit(1);
+            } else {
+                /* "max": currently means 3 for TCG */
+                vms->gic_version = VIRT_GIC_VERSION_3;
+            }
+        } else {
+            vms->gic_version = kvm_arm_vgic_probe();
+            if (!vms->gic_version) {
+                error_report(
+                    "Unable to determine GIC version supported by host");
+                exit(1);
+            }
+        }
+    } else if (vms->gic_version == VIRT_GIC_VERSION_NOSEL) {
+        vms->gic_version = VIRT_GIC_VERSION_2;
+    }
+}
+
 static void machvirt_init(MachineState *machine)
 {
     VirtMachineState *vms = VIRT_MACHINE(machine);
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     /* We can probe only here because during property set
      * KVM is not available yet
      */
-    if (vms->gic_version == VIRT_GIC_VERSION_HOST ||
-        vms->gic_version == VIRT_GIC_VERSION_MAX) {
-        if (!kvm_enabled()) {
-            if (vms->gic_version == VIRT_GIC_VERSION_HOST) {
-                error_report("gic-version=host requires KVM");
-                exit(1);
-            } else {
-                /* "max": currently means 3 for TCG */
-                vms->gic_version = VIRT_GIC_VERSION_3;
-            }
-        } else {
-            vms->gic_version = kvm_arm_vgic_probe();
-            if (!vms->gic_version) {
-                error_report(
-                    "Unable to determine GIC version supported by host");
-                exit(1);
-            }
-        }
-    }
+    finalize_gic_version(vms);
 
     if (!cpu_type_valid(machine->cpu_type)) {
         error_report("mach-virt: CPU type %s not supported", machine->cpu_type);
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
                                     "Set on/off to enable/disable using "
                                     "physical address space above 32 bits",
                                     NULL);
-    /* Default GIC type is v2 */
-    vms->gic_version = VIRT_GIC_VERSION_2;
+    vms->gic_version = VIRT_GIC_VERSION_NOSEL;
     object_property_add_str(obj, "gic-version", virt_get_gic_version,
                         virt_set_gic_version, NULL);
     object_property_set_description(obj, "gic-version",
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Convert kvm_arm_vgic_probe() so that it returns a
bitmap of supported in-kernel emulation VGIC versions instead
of the max version: at the moment values can be v2 and v3.
This allows to expose the case where the host GICv3 also
supports GICv2 emulation. This will be useful to choose the
default version in KVM accelerated mode.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200311131618.7187-5-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h |  3 +++
 hw/arm/virt.c        | 11 +++++++++--
 target/arm/kvm.c     | 14 ++++++++------
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/memory.h"
 #include "qemu/error-report.h"
 
+#define KVM_ARM_VGIC_V2   (1 << 0)
+#define KVM_ARM_VGIC_V3   (1 << 1)
+
 /**
  * kvm_arm_vcpu_init:
  * @cs: CPUState
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
                 vms->gic_version = VIRT_GIC_VERSION_3;
             }
         } else {
-            vms->gic_version = kvm_arm_vgic_probe();
-            if (!vms->gic_version) {
+            int probe_bitmap = kvm_arm_vgic_probe();
+
+            if (!probe_bitmap) {
                 error_report(
                     "Unable to determine GIC version supported by host");
                 exit(1);
+            } else {
+                if (probe_bitmap & KVM_ARM_VGIC_V3) {
+                    vms->gic_version = VIRT_GIC_VERSION_3;
+                } else {
+                    vms->gic_version = VIRT_GIC_VERSION_2;
+                }
             }
         }
     } else if (vms->gic_version == VIRT_GIC_VERSION_NOSEL) {
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_irqchip_create(KVMState *s)
 
 int kvm_arm_vgic_probe(void)
 {
+    int val = 0;
+
     if (kvm_create_device(kvm_state,
                           KVM_DEV_TYPE_ARM_VGIC_V3, true) == 0) {
-        return 3;
-    } else if (kvm_create_device(kvm_state,
-                                 KVM_DEV_TYPE_ARM_VGIC_V2, true) == 0) {
-        return 2;
-    } else {
-        return 0;
+        val |= KVM_ARM_VGIC_V3;
     }
+    if (kvm_create_device(kvm_state,
+                          KVM_DEV_TYPE_ARM_VGIC_V2, true) == 0) {
+        val |= KVM_ARM_VGIC_V2;
+    }
+    return val;
 }
 
 int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level)
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

Restructure the finalize_gic_version with switch cases and
clearly separate the following cases:

- KVM mode / in-kernel irqchip
- KVM mode / userspace irqchip
- TCG mode

In KVM mode / in-kernel irqchip , we explictly check whether
the chosen version is supported by the host. If the end-user
explicitly sets v2/v3 and this is not supported by the host,
then the user gets an explicit error message. Note that for
old kernels where the CREATE_DEVICE ioctl doesn't exist then
we will now fail if the user specifically asked for gicv2,
where previously we (probably) would have succeeded.

In KVM mode / userspace irqchip we immediatly output an error
in case the end-user explicitly selected v3. Also we warn the
end-user about the unexpected usage of gic-version=host in
that case as only userspace GICv2 is supported.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20200311131618.7187-6-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 88 +++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 67 insertions(+), 21 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_set_memmap(VirtMachineState *vms)
  */
 static void finalize_gic_version(VirtMachineState *vms)
 {
-    if (vms->gic_version == VIRT_GIC_VERSION_HOST ||
-        vms->gic_version == VIRT_GIC_VERSION_MAX) {
-        if (!kvm_enabled()) {
-            if (vms->gic_version == VIRT_GIC_VERSION_HOST) {
-                error_report("gic-version=host requires KVM");
-                exit(1);
-            } else {
-                /* "max": currently means 3 for TCG */
-                vms->gic_version = VIRT_GIC_VERSION_3;
-            }
-        } else {
-            int probe_bitmap = kvm_arm_vgic_probe();
+    if (kvm_enabled()) {
+        int probe_bitmap;
 
-            if (!probe_bitmap) {
+        if (!kvm_irqchip_in_kernel()) {
+            switch (vms->gic_version) {
+            case VIRT_GIC_VERSION_HOST:
+                warn_report(
+                    "gic-version=host not relevant with kernel-irqchip=off "
+                     "as only userspace GICv2 is supported. Using v2 ...");
+                return;
+            case VIRT_GIC_VERSION_MAX:
+            case VIRT_GIC_VERSION_NOSEL:
+                vms->gic_version = VIRT_GIC_VERSION_2;
+                return;
+            case VIRT_GIC_VERSION_2:
+                return;
+            case VIRT_GIC_VERSION_3:
                 error_report(
-                    "Unable to determine GIC version supported by host");
+                    "gic-version=3 is not supported with kernel-irqchip=off");
                 exit(1);
-            } else {
-                if (probe_bitmap & KVM_ARM_VGIC_V3) {
-                    vms->gic_version = VIRT_GIC_VERSION_3;
-                } else {
-                    vms->gic_version = VIRT_GIC_VERSION_2;
-                }
             }
         }
-    } else if (vms->gic_version == VIRT_GIC_VERSION_NOSEL) {
+
+        probe_bitmap = kvm_arm_vgic_probe();
+        if (!probe_bitmap) {
+            error_report("Unable to determine GIC version supported by host");
+            exit(1);
+        }
+
+        switch (vms->gic_version) {
+        case VIRT_GIC_VERSION_HOST:
+        case VIRT_GIC_VERSION_MAX:
+            if (probe_bitmap & KVM_ARM_VGIC_V3) {
+                vms->gic_version = VIRT_GIC_VERSION_3;
+            } else {
+                vms->gic_version = VIRT_GIC_VERSION_2;
+            }
+            return;
+        case VIRT_GIC_VERSION_NOSEL:
+            vms->gic_version = VIRT_GIC_VERSION_2;
+            break;
+        case VIRT_GIC_VERSION_2:
+        case VIRT_GIC_VERSION_3:
+            break;
+        }
+
+        /* Check chosen version is effectively supported by the host */
+        if (vms->gic_version == VIRT_GIC_VERSION_2 &&
+            !(probe_bitmap & KVM_ARM_VGIC_V2)) {
+            error_report("host does not support in-kernel GICv2 emulation");
+            exit(1);
+        } else if (vms->gic_version == VIRT_GIC_VERSION_3 &&
+                   !(probe_bitmap & KVM_ARM_VGIC_V3)) {
+            error_report("host does not support in-kernel GICv3 emulation");
+            exit(1);
+        }
+        return;
+    }
+
+    /* TCG mode */
+    switch (vms->gic_version) {
+    case VIRT_GIC_VERSION_NOSEL:
         vms->gic_version = VIRT_GIC_VERSION_2;
+        break;
+    case VIRT_GIC_VERSION_MAX:
+        vms->gic_version = VIRT_GIC_VERSION_3;
+        break;
+    case VIRT_GIC_VERSION_HOST:
+        error_report("gic-version=host requires KVM");
+        exit(1);
+    case VIRT_GIC_VERSION_2:
+    case VIRT_GIC_VERSION_3:
+        break;
     }
 }
 
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

At the moment if the end-user does not specify the gic-version along
with KVM acceleration, v2 is set by default. However most of the
systems now have GICv3 and sometimes they do not support GICv2
compatibility.

This patch keeps the default v2 selection in all cases except
in the KVM accelerated mode when either
- the host does not support GICv2 in-kernel emulation or
- number of VCPUS exceeds 8.

Those cases did not work anyway so we do not break any compatibility.
Now we get v3 selected in such a case.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20200311131618.7187-7-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

From: Beata Michalska <beata.michalska@linaro.org>

KVM_SET_VCPU_EVENTS might actually lead to vcpu registers being modified.
As such this should be the last step of sync to avoid potential overwriting
of whatever changes KVM might have done.

Signed-off-by: Beata Michalska <beata.michalska@linaro.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20200312003401.29017-2-beata.michalska@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm32.c | 15 ++++++++++-----
 target/arm/kvm64.c | 15 ++++++++++-----
 2 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
-    ret = kvm_put_vcpu_events(cpu);
-    if (ret) {
-        return ret;
-    }
-
     write_cpustate_to_list(cpu, true);
 
     if (!write_list_to_kvmstate(cpu, level)) {
         return EINVAL;
     }
 
+    /*
+     * Setting VCPU events should be triggered after syncing the registers
+     * to avoid overwriting potential changes made by KVM upon calling
+     * KVM_SET_VCPU_EVENTS ioctl
+     */
+    ret = kvm_put_vcpu_events(cpu);
+    if (ret) {
+        return ret;
+    }
+
     kvm_arm_sync_mpstate_to_kvm(cpu);
 
     return ret;
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
-    ret = kvm_put_vcpu_events(cpu);
-    if (ret) {
-        return ret;
-    }
-
     write_cpustate_to_list(cpu, true);
 
     if (!write_list_to_kvmstate(cpu, level)) {
         return -EINVAL;
     }
 
+   /*
+    * Setting VCPU events should be triggered after syncing the registers
+    * to avoid overwriting potential changes made by KVM upon calling
+    * KVM_SET_VCPU_EVENTS ioctl
+    */
+    ret = kvm_put_vcpu_events(cpu);
+    if (ret) {
+        return ret;
+    }
+
     kvm_arm_sync_mpstate_to_kvm(cpu);
 
     return ret;
-- 
2.20.1