Series comparison

-[PULL 00/11] target-arm queue
+[PULL 00/14] target-arm queue
-Last handful of arm patches before softfreeze...
+arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length
 patches, which are somewhere between a bugfix and a new feature.
-The following changes since commit a98135f727595382e200d04c2996e868b7925a01:
+thanks
 -- PMM
-  Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200316-pull-request' into staging (2020-03-16 14:55:59 +0000)
+The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:
   Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200317
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727
-for you to fetch changes up to e88d3671e3bbd59d385838a4101ea19cdcf47309:
+for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:
-  hw/arm/pxa2xx: Do not wire up OHCI for PXA255 (2020-03-17 11:36:48 +0000)
+  hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)
 ----------------------------------------------------------------
-target-arm:
+target-arm queue:
- * hw/arm/pxa2xx: Do not wire up OHCI for PXA255
+ * hw/arm/smmuv3: Check 31st bit to see if CD is valid
- * aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command
+ * qemu-options.hx: Fix formatting of -machine memory-backend option
- * m25p80: Improve command handling for Jedec and unsupported commands
+ * hw: aspeed_gpio: Fix memory size
- * hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()
+ * hw/arm/nseries: Display hexadecimal value with '0x' prefix
- * hw/arm/fsl-imx6, imx6ul: Wire up USB controllers
+ * Add sve-default-vector-length cpu property
- * hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices
+ * docs: Update path that mentions deprecated.rst
  * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
  * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
  * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
  * target/arm: Report M-profile alignment faults correctly to the guest
  * target/arm: Add missing 'return's after calling v7m_exception_taken()
  * target/arm: Enforce that M-profile SP low 2 bits are always zero
 ----------------------------------------------------------------
-Chen Qun (1):
+Joe Komlodi (1):
-      hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()
+      hw/arm/smmuv3: Check 31st bit to see if CD is valid
-Guenter Roeck (10):
+Joel Stanley (1):
-      hw/usb: Add basic i.MX USB Phy support
+      hw: aspeed_gpio: Fix memory size
       hw/arm/fsl-imx6ul: Fix USB interrupt numbers
       hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices
       hw/arm/fsl-imx6ul: Wire up USB controllers
       hw/arm/fsl-imx6: Wire up USB controllers
       m25p80: Convert to support tracing
       m25p80: Improve command handling for Jedec commands
       m25p80: Improve command handling for unsupported commands
       aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command
       hw/arm/pxa2xx: Do not wire up OHCI for PXA255
- hw/usb/Makefile.objs         |   2 +
+Mao Zhongyi (1):
- include/hw/arm/fsl-imx6.h    |   6 ++
+      docs: Update path that mentions deprecated.rst
  include/hw/arm/fsl-imx6ul.h  |  16 ++-
  include/hw/usb/imx-usb-phy.h |  53 ++++++++++
  hw/arm/fsl-imx6.c            |  36 +++++++
  hw/arm/fsl-imx6ul.c          |  49 ++++++++++
  hw/arm/pxa2xx.c              |   3 -
  hw/block/m25p80.c            |  58 +++++------
  hw/net/imx_fec.c             |   6 +-
  hw/ssi/aspeed_smc.c          |   2 +-
  hw/usb/imx-usb-phy.c         | 225 +++++++++++++++++++++++++++++++++++++++++++
  MAINTAINERS                  |   2 +
  hw/arm/Kconfig               |   1 +
  hw/block/trace-events        |  16 +++
  hw/usb/Kconfig               |   5 +
 files changed, 444 insertions(+), 36 deletions(-)
  create mode 100644 include/hw/usb/imx-usb-phy.h
  create mode 100644 hw/usb/imx-usb-phy.c
+Peter Maydell (7):
+      qemu-options.hx: Fix formatting of -machine memory-backend option
+      target/arm: Enforce that M-profile SP low 2 bits are always zero
+      target/arm: Add missing 'return's after calling v7m_exception_taken()
+      target/arm: Report M-profile alignment faults correctly to the guest
+      hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
+      hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
+      hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
+Philippe Mathieu-Daudé (1):
+      hw/arm/nseries: Display hexadecimal value with '0x' prefix
+Richard Henderson (3):
+      target/arm: Correctly bound length in sve_zcr_get_valid_len
+      target/arm: Export aarch64_sve_zcr_get_valid_len
+      target/arm: Add sve-default-vector-length cpu property
+ docs/system/arm/cpu-features.rst | 15 ++++++++++
+ configure                        |  2 +-
+ hw/arm/smmuv3-internal.h         |  2 +-
+ target/arm/cpu.h                 |  5 ++++
+ target/arm/internals.h           | 10 +++++++
+ hw/arm/nseries.c                 |  2 +-
+ hw/gpio/aspeed_gpio.c            |  3 +-
+ hw/intc/armv7m_nvic.c            | 40 +++++++++++++++++++--------
+ target/arm/cpu.c                 | 14 ++++++++--
+ target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++++++++++
+ target/arm/gdbstub.c             |  4 +++
+ target/arm/helper.c              |  8 ++++--
+ target/arm/m_helper.c            | 24 ++++++++++++----
+ target/arm/translate.c           |  3 ++
+ target/i386/cpu.c                |  2 +-
+ MAINTAINERS                      |  2 +-
+ qemu-options.hx                  | 30 +++++++++++---------
+files changed, 183 insertions(+), 43 deletions(-)

-[PULL 06/11] hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()
+[PULL 01/14] hw/arm/smmuv3: Check 31st bit to see if CD is valid
-From: Chen Qun <kuhn.chenqun@huawei.com>
+From: Joe Komlodi <joe.komlodi@xilinx.com>
-The current code causes clang static code analyzer generate warning:
+The bit to see if a CD is valid is the last bit of the first word of the CD.
 hw/net/imx_fec.c:858:9: warning: Value stored to 'value' is never read
         value = value & 0x0000000f;
         ^       ~~~~~~~~~~~~~~~~~~
 hw/net/imx_fec.c:864:9: warning: Value stored to 'value' is never read
         value = value & 0x000000fd;
         ^       ~~~~~~~~~~~~~~~~~~
-According to the definition of the function, the two “value” assignments
+Signed-off-by: Joe Komlodi <joe.komlodi@xilinx.com>
- should be written to registers.
+Message-id: 1626728232-134665-2-git-send-email-joe.komlodi@xilinx.com
 Reported-by: Euler Robot <euler.robot@huawei.com>
 Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
 Message-id: 20200313123242.13236-1-kuhn.chenqun@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/imx_fec.c | 6 ++++--
+ hw/arm/smmuv3-internal.h | 2 +-
-file changed, 4 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
+--- a/hw/arm/smmuv3-internal.h
-+++ b/hw/net/imx_fec.c
++++ b/hw/arm/smmuv3-internal.h
-@@ -XXX,XX +XXX,XX @@ static void imx_enet_write(IMXFECState *s, uint32_t index, uint32_t value)
+@@ -XXX,XX +XXX,XX @@ static inline int pa_range(STE *ste)
-         break;
-     case ENET_TGSR:
+ /* CD fields */
-         /* implement clear timer flag */
--        value = value & 0x0000000f;
+-#define CD_VALID(x)   extract32((x)->word[0], 30, 1)
-+        s->regs[index] &= ~(value & 0x0000000f); /* all bits W1C */
++#define CD_VALID(x)   extract32((x)->word[0], 31, 1)
-         break;
+ #define CD_ASID(x)    extract32((x)->word[1], 16, 16)
-     case ENET_TCSR0:
+ #define CD_TTB(x, sel)                                      \
-     case ENET_TCSR1:
+     ({                                                      \
      case ENET_TCSR2:
      case ENET_TCSR3:
 -        value = value & 0x000000fd;
 +        s->regs[index] &= ~(value & 0x00000080); /* W1C bits */
 +        s->regs[index] &= ~0x0000007d; /* writable fields */
 +        s->regs[index] |= (value & 0x0000007d);
          break;
      case ENET_TCCR0:
      case ENET_TCCR1:
 --
 .20.1

-[PULL 09/11] m25p80: Improve command handling for unsupported commands
+[PULL 02/14] qemu-options.hx: Fix formatting of -machine memory-backend option
-From: Guenter Roeck <linux@roeck-us.net>
+The documentation of the -machine memory-backend has some minor
 formatting errors:
  * Misindentation of the initial line meant that the whole option
    section is incorrectly indented in the HTML output compared to
    the other -machine options
  * The examples weren't indented, which meant that they were formatted
    as plain run-on text including outputting the "::" as text.
  * The a) b) list has no rst-format markup so it is rendered as
    a single run-on paragraph
-Whenever an unsupported command is encountered, the current code
+Fix the formatting.
 interprets each transferred byte as new command. Most of the time, those
 'commands' are interpreted as new unknown commands. However, in rare
 cases, it may be that for example address or length information
 passed with the original command is by itself a valid command.
 If that happens, the state machine may get completely confused and,
 worst case, start writing data into the flash or even erase it.
-To avoid the problem, transition into STATE_READING_DATA and keep
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-sending a value of 0 until the chip is deselected after encountering
+Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-an unsupported command.
+Message-id: 20210719105257.3599-1-peter.maydell@linaro.org
 ---
  qemu-options.hx | 30 +++++++++++++++++-------------
 file changed, 17 insertions(+), 13 deletions(-)
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+diff --git a/qemu-options.hx b/qemu-options.hx
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/block/m25p80.c | 5 +++++
 file changed, 5 insertions(+)
 diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/qemu-options.hx
-+++ b/hw/block/m25p80.c
++++ b/qemu-options.hx
-@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
+@@ -XXX,XX +XXX,XX @@ SRST
-         s->quad_enable = false;
+         Enables or disables ACPI Heterogeneous Memory Attribute Table
-         break;
+         (HMAT) support. The default is off.
-     default:
-+        s->pos = 0;
+-     ``memory-backend='id'``
-+        s->len = 1;
++    ``memory-backend='id'``
-+        s->state = STATE_READING_DATA;
+         An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.
-+        s->data_read_loop = true;
+         Allows to use a memory backend as main RAM.
-+        s->data[0] = 0;
-         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Unknown cmd %x\n", value);
+         For example:
-         break;
+         ::
-     }
+-        -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
 -        -machine memory-backend=pc.ram
 -        -m 512M
 +
 +            -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
 +            -machine memory-backend=pc.ram
 +            -m 512M
          Migration compatibility note:
 -        a) as backend id one shall use value of 'default-ram-id', advertised by
 -        machine type (available via ``query-machines`` QMP command), if migration
 -        to/from old QEMU (<5.0) is expected.
 -        b) for machine types 4.0 and older, user shall
 -        use ``x-use-canonical-path-for-ramblock-id=off`` backend option
 -        if migration to/from old QEMU (<5.0) is expected.
 +
 +        * as backend id one shall use value of 'default-ram-id', advertised by
 +          machine type (available via ``query-machines`` QMP command), if migration
 +          to/from old QEMU (<5.0) is expected.
 +        * for machine types 4.0 and older, user shall
 +          use ``x-use-canonical-path-for-ramblock-id=off`` backend option
 +          if migration to/from old QEMU (<5.0) is expected.
 +
          For example:
          ::
 -        -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
 -        -machine memory-backend=pc.ram
 -        -m 512M
 +
 +            -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
 +            -machine memory-backend=pc.ram
 +            -m 512M
  ERST
  HXCOMM Deprecated by -machine
 --
 .20.1

-New patch
+[PULL 03/14] target/arm: Enforce that M-profile SP low 2 bits are always zero
+For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
+RES0H, which is to say that they must be hardwired to zero so that
+guest attempts to write non-zero values to them are ignored.
+Implement this behaviour by masking out the low bits:
+ * for writes to r13 by the gdbstub
+ * for writes to any of the various flavours of SP via MSR
+ * for writes to r13 via store_reg() in generated code
+Note that all the direct uses of cpu_R[] in translate.c are in places
+where the register is definitely not r13 (usually because that has
+been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
+UNDEF).
+All the other writes to regs[13] in C code are either:
+ * A-profile only code
+ * writes of values we can guarantee to be aligned, such as
+   - writes of previous-SP-value plus or minus a 4-aligned constant
+   - writes of the value in an SP limit register (which we already
+     enforce to be aligned)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
+---
+ target/arm/gdbstub.c   |  4 ++++
+ target/arm/m_helper.c  | 14 ++++++++------
+ target/arm/translate.c |  3 +++
+files changed, 15 insertions(+), 6 deletions(-)
+diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/gdbstub.c
++++ b/target/arm/gdbstub.c
+@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
+     if (n < 16) {
+         /* Core integer register.  */
++        if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
++            /* M profile SP low bits are always 0 */
++            tmp &= ~3;
++        }
+         env->regs[n] = tmp;
+         return 4;
+     }
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/m_helper.c
++++ b/target/arm/m_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+             if (!env->v7m.secure) {
+                 return;
+             }
+-            env->v7m.other_ss_msp = val;
++            env->v7m.other_ss_msp = val & ~3;
+             return;
+         case 0x89: /* PSP_NS */
+             if (!env->v7m.secure) {
+                 return;
+             }
+-            env->v7m.other_ss_psp = val;
++            env->v7m.other_ss_psp = val & ~3;
+             return;
+         case 0x8a: /* MSPLIM_NS */
+             if (!env->v7m.secure) {
+@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+             limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
++            val &= ~0x3;
++
+             if (val < limit) {
+                 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
+             }
+@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+         break;
+     case 8: /* MSP */
+         if (v7m_using_psp(env)) {
+-            env->v7m.other_sp = val;
++            env->v7m.other_sp = val & ~3;
+         } else {
+-            env->regs[13] = val;
++            env->regs[13] = val & ~3;
+         }
+         break;
+     case 9: /* PSP */
+         if (v7m_using_psp(env)) {
+-            env->regs[13] = val;
++            env->regs[13] = val & ~3;
+         } else {
+-            env->v7m.other_sp = val;
++            env->v7m.other_sp = val & ~3;
+         }
+         break;
+     case 10: /* MSPLIM */
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
+          */
+         tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
+         s->base.is_jmp = DISAS_JUMP;
++    } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
++        /* For M-profile SP bits [1:0] are always zero */
++        tcg_gen_andi_i32(var, var, ~3);
+     }
+     tcg_gen_mov_i32(cpu_R[reg], var);
+     tcg_temp_free_i32(var);
+--
+.20.1

-[PULL 08/11] m25p80: Improve command handling for Jedec commands
+[PULL 04/14] target/arm: Add missing 'return's after calling v7m_exception_taken()
-From: Guenter Roeck <linux@roeck-us.net>
+In do_v7m_exception_exit(), we perform various checks as part of
 performing the exception return.  If one of these checks fails, the
 architecture requires that we take an appropriate exception on the
 existing stackframe.  We implement this by calling
 v7m_exception_taken() to set up to take the new exception, and then
 immediately returning from do_v7m_exception_exit() without proceeding
 any further with the unstack-and-exception-return process.
-When requesting JEDEC data using the JEDEC_READ command, the Linux kernel
+In a couple of checks that are new in v8.1M, we forgot the "return"
-always requests 6 bytes. The current implementation only returns three
+statement, with the effect that if bad code in the guest tripped over
-bytes, and interprets the remaining three bytes as new commands.
+these checks we would set up to take a UsageFault exception but then
-While this does not matter most of the time, it is at the very least
+blunder on trying to also unstack and return from the original
-confusing. To avoid the problem, always report up to 6 bytes of JEDEC
+exception, with the probable result that the guest would crash.
 data. Fill remaining data with 0.
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Add the missing return statements.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-3-peter.maydell@linaro.org
 ---
- hw/block/m25p80.c | 5 ++++-
+ target/arm/m_helper.c | 2 ++
-file changed, 4 insertions(+), 1 deletion(-)
+file changed, 2 insertions(+)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/target/arm/m_helper.c
-+++ b/hw/block/m25p80.c
++++ b/target/arm/m_helper.c
-@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
+@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-         for (i = 0; i < s->pi->id_len; i++) {
+                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
-             s->data[i] = s->pi->id[i];
+                         "stackframe: NSACR prevents clearing FPU registers\n");
-         }
+                     v7m_exception_taken(cpu, excret, true, false);
-+        for (; i < SPI_NOR_MAX_ID_LEN; i++) {
++                    return;
-+            s->data[i] = 0;
+                 } else if (!cpacr_pass) {
-+        }
+                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                             exc_secure);
--        s->len = s->pi->id_len;
+@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-+        s->len = SPI_NOR_MAX_ID_LEN;
+                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
-         s->pos = 0;
+                         "stackframe: CPACR prevents clearing FPU registers\n");
-         s->state = STATE_READING_DATA;
+                     v7m_exception_taken(cpu, excret, true, false);
-         break;
++                    return;
                  }
              }
              /* Clear s0..s15, FPSCR and VPR */
 --
 .20.1

-New patch
+[PULL 05/14] target/arm: Report M-profile alignment faults correctly to the guest
+For M-profile, we weren't reporting alignment faults triggered by the
+generic TCG code correctly to the guest.  These get passed into
+arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile
+style exception.fsr value of 1.  We didn't check for this, and so
+they fell through into the default of "assume this is an MPU fault"
+and were reported to the guest as a data access violation MPU fault.
+Report these alignment faults as UsageFaults which set the UNALIGNED
+bit in the UFSR.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-4-peter.maydell@linaro.org
+---
+ target/arm/m_helper.c | 8 ++++++++
+file changed, 8 insertions(+)
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/m_helper.c
++++ b/target/arm/m_helper.c
+@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+         env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
+         break;
+     case EXCP_UNALIGNED:
++        /* Unaligned faults reported by M-profile aware code */
+         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
+         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
+         break;
+@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+             }
+             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
+             break;
++        case 0x1: /* Alignment fault reported by generic code */
++            qemu_log_mask(CPU_LOG_INT,
++                          "...really UsageFault with UFSR.UNALIGNED\n");
++            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
++            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
++                                    env->v7m.secure);
++            break;
+         default:
+             /*
+              * All other FSR values are either MPU faults or "can't happen
+--
+.20.1

-New patch
+[PULL 06/14] hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
+The ISCR.ISRPENDING bit is set when an external interrupt is pending.
+This is true whether that external interrupt is enabled or not.
+This means that we can't use 's->vectpending == 0' as a shortcut to
+"ISRPENDING is zero", because s->vectpending indicates only the
+highest priority pending enabled interrupt.
+Remove the incorrect optimization so that if there is no pending
+enabled interrupt we fall through to scanning through the whole
+interrupt array.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
+---
+ hw/intc/armv7m_nvic.c | 9 ++++-----
+file changed, 4 insertions(+), 5 deletions(-)
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/armv7m_nvic.c
++++ b/hw/intc/armv7m_nvic.c
+@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)
+ {
+     int irq;
+-    /* We can shortcut if the highest priority pending interrupt
+-     * happens to be external or if there is nothing pending.
++    /*
++     * We can shortcut if the highest priority pending interrupt
++     * happens to be external; if not we need to check the whole
++     * vectors[] array.
+      */
+     if (s->vectpending > NVIC_FIRST_IRQ) {
+         return true;
+     }
+-    if (s->vectpending == 0) {
+-        return false;
+-    }
+     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
+         if (s->vectors[irq].pending) {
+--
+.20.1

-[PULL 10/11] aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command
+[PULL 07/14] hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
-From: Guenter Roeck <linux@roeck-us.net>
+The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of
 the register.  We were incorrectly masking it to 8 bits, so it would
 report the wrong value if the pending exception was greater than 256.
 Fix the bug.
-The Linux kernel recently started using FAST_READ_4 commands.
-This results in flash read failures. At the same time, the m25p80
-emulation is seen to read 8 more bytes than expected. Adjusting the
-expected number of dummy cycles to match FAST_READ fixes the problem.
-Fixes: f95c4bffdc4c ("aspeed/smc: snoop SPI transfers to fake dummy cycles")
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
 ---
- hw/ssi/aspeed_smc.c | 2 +-
+ hw/intc/armv7m_nvic.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/aspeed_smc.c
+--- a/hw/intc/armv7m_nvic.c
-+++ b/hw/ssi/aspeed_smc.c
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static int aspeed_smc_num_dummies(uint8_t command)
+@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-     case FAST_READ:
+         /* VECTACTIVE */
-     case DOR:
+         val = cpu->env.v7m.exception;
-     case QOR:
+         /* VECTPENDING */
-+    case FAST_READ_4:
+-        val |= (s->vectpending & 0xff) << 12;
-     case DOR_4:
++        val |= (s->vectpending & 0x1ff) << 12;
-     case QOR_4:
+         /* ISRPENDING - set if any external IRQ is pending */
-         return 1;
+         if (nvic_isrpending(s)) {
-     case DIOR:
+             val |= (1 << 22);
 -    case FAST_READ_4:
      case DIOR_4:
          return 2;
      case QIOR:
 --
 .20.1

-[PULL 03/11] hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices
+[PULL 08/14] hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
-From: Guenter Roeck <linux@roeck-us.net>
+In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if
 the register is accessed NonSecure and the highest priority pending
 enabled exception (that would be returned in the VECTPENDING field)
 targets Secure, then the VECTPENDING field must read 1 rather than
 the exception number of the pending exception. Implement this.
-Recent Linux kernels (post v4.20) crash due to accesses to flexcan
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-and pwm controllers. Instantiate as unimplemented devices to work
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-around the problem.
+Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
 ---
  hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++-------
 file changed, 24 insertions(+), 7 deletions(-)
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 Message-id: 20200313014551.12554-4-linux@roeck-us.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/fsl-imx6ul.c | 14 ++++++++++++++
 file changed, 14 insertions(+)
 diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx6ul.c
+--- a/hw/intc/armv7m_nvic.c
-+++ b/hw/arm/fsl-imx6ul.c
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
-      */
+     nvic_irq_update(s);
-     create_unimplemented_device("sdma", FSL_IMX6UL_SDMA_ADDR, 0x4000);
+ }
-+    /*
++static bool vectpending_targets_secure(NVICState *s)
-+     * PWM
++{
-+     */
++    /* Return true if s->vectpending targets Secure state */
-+    create_unimplemented_device("pwm1", FSL_IMX6UL_PWM1_ADDR, 0x4000);
++    if (s->vectpending_is_s_banked) {
-+    create_unimplemented_device("pwm2", FSL_IMX6UL_PWM2_ADDR, 0x4000);
++        return true;
-+    create_unimplemented_device("pwm3", FSL_IMX6UL_PWM3_ADDR, 0x4000);
++    }
-+    create_unimplemented_device("pwm4", FSL_IMX6UL_PWM4_ADDR, 0x4000);
++    return !exc_is_banked(s->vectpending) &&
 +        exc_targets_secure(s, s->vectpending);
 +}
 +
-+    /*
+ void armv7m_nvic_get_pending_irq_info(void *opaque,
-+     * CAN
+                                       int *pirq, bool *ptargets_secure)
-+     */
+ {
-+    create_unimplemented_device("can1", FSL_IMX6UL_CAN1_ADDR, 0x4000);
+@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
-+    create_unimplemented_device("can2", FSL_IMX6UL_CAN2_ADDR, 0x4000);
-+
+     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
-     /*
-      * APHB_DMA
+-    if (s->vectpending_is_s_banked) {
-      */
+-        targets_secure = true;
 -    } else {
 -        targets_secure = !exc_is_banked(pending) &&
 -            exc_targets_secure(s, pending);
 -    }
 +    targets_secure = vectpending_targets_secure(s);
      trace_nvic_get_pending_irq_info(pending, targets_secure);
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
          /* VECTACTIVE */
          val = cpu->env.v7m.exception;
          /* VECTPENDING */
 -        val |= (s->vectpending & 0x1ff) << 12;
 +        if (s->vectpending) {
 +            /*
 +             * From v8.1M VECTPENDING must read as 1 if accessed as
 +             * NonSecure and the highest priority pending and enabled
 +             * exception targets Secure.
 +             */
 +            int vp = s->vectpending;
 +            if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) &&
 +                vectpending_targets_secure(s)) {
 +                vp = 1;
 +            }
 +            val |= (vp & 0x1ff) << 12;
 +        }
          /* ISRPENDING - set if any external IRQ is pending */
          if (nvic_isrpending(s)) {
              val |= (1 << 22);
 --
 .20.1

-[PULL 01/11] hw/usb: Add basic i.MX USB Phy support
+[PULL 09/14] docs: Update path that mentions deprecated.rst
-From: Guenter Roeck <linux@roeck-us.net>
+From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
-Add basic USB PHY support as implemented in i.MX23, i.MX28, i.MX6,
+Missed in commit f3478392 "docs: Move deprecation, build
-and i.MX7 SoCs.
+and license info out of system/"
-The only support really needed - at least to boot Linux - is support
+Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
 for soft reset, which needs to reset various registers to their initial
 value. Otherwise, just record register values.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com
 Message-id: 20200313014551.12554-2-linux@roeck-us.net
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/usb/Makefile.objs         |   2 +
+ configure         | 2 +-
- include/hw/usb/imx-usb-phy.h |  53 +++++++++
+ target/i386/cpu.c | 2 +-
- hw/usb/imx-usb-phy.c         | 225 +++++++++++++++++++++++++++++++++++
+ MAINTAINERS       | 2 +-
- MAINTAINERS                  |   2 +
+files changed, 3 insertions(+), 3 deletions(-)
  hw/arm/Kconfig               |   1 +
  hw/usb/Kconfig               |   5 +
 files changed, 288 insertions(+)
  create mode 100644 include/hw/usb/imx-usb-phy.h
  create mode 100644 hw/usb/imx-usb-phy.c
-diff --git a/hw/usb/Makefile.objs b/hw/usb/Makefile.objs
+diff --git a/configure b/configure
 index XXXXXXX..XXXXXXX 100755
 --- a/configure
 +++ b/configure
@@ -XXX,XX +XXX,XX @@ fi
  if test -n "${deprecated_features}"; then
      echo "Warning, deprecated features enabled."
 -    echo "Please see docs/system/deprecated.rst"
 +    echo "Please see docs/about/deprecated.rst"
      echo "  features: ${deprecated_features}"
  fi
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/usb/Makefile.objs
+--- a/target/i386/cpu.c
-+++ b/hw/usb/Makefile.objs
++++ b/target/i386/cpu.c
-@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_XEN) += xen-usb.o
+@@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = {
- xen-usb.o-cflags := $(LIBUSB_CFLAGS)
+  * none", but this is just for compatibility while libvirt isn't
- xen-usb.o-libs := $(LIBUSB_LIBS)
+  * adapted to resolve CPU model versions before creating VMs.
- endif
+  * See "Runnability guarantee of CPU models" at
-+
+- * docs/system/deprecated.rst.
-+common-obj-$(CONFIG_IMX_USBPHY) += imx-usb-phy.o
++ * docs/about/deprecated.rst.
-diff --git a/include/hw/usb/imx-usb-phy.h b/include/hw/usb/imx-usb-phy.h
+  */
-new file mode 100644
+ X86CPUVersion default_cpu_version = 1;
-index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/usb/imx-usb-phy.h
@@ -XXX,XX +XXX,XX @@
 +#ifndef IMX_USB_PHY_H
 +#define IMX_USB_PHY_H
 +
 +#include "hw/sysbus.h"
 +#include "qemu/bitops.h"
 +
 +enum IMXUsbPhyRegisters {
 +    USBPHY_PWD,
 +    USBPHY_PWD_SET,
 +    USBPHY_PWD_CLR,
 +    USBPHY_PWD_TOG,
 +    USBPHY_TX,
 +    USBPHY_TX_SET,
 +    USBPHY_TX_CLR,
 +    USBPHY_TX_TOG,
 +    USBPHY_RX,
 +    USBPHY_RX_SET,
 +    USBPHY_RX_CLR,
 +    USBPHY_RX_TOG,
 +    USBPHY_CTRL,
 +    USBPHY_CTRL_SET,
 +    USBPHY_CTRL_CLR,
 +    USBPHY_CTRL_TOG,
 +    USBPHY_STATUS,
 +    USBPHY_DEBUG = 0x14,
 +    USBPHY_DEBUG_SET,
 +    USBPHY_DEBUG_CLR,
 +    USBPHY_DEBUG_TOG,
 +    USBPHY_DEBUG0_STATUS,
 +    USBPHY_DEBUG1 = 0x1c,
 +    USBPHY_DEBUG1_SET,
 +    USBPHY_DEBUG1_CLR,
 +    USBPHY_DEBUG1_TOG,
 +    USBPHY_VERSION,
 +    USBPHY_MAX
 +};
 +
 +#define USBPHY_CTRL_SFTRST BIT(31)
 +
 +#define TYPE_IMX_USBPHY "imx.usbphy"
 +#define IMX_USBPHY(obj) OBJECT_CHECK(IMXUSBPHYState, (obj), TYPE_IMX_USBPHY)
 +
 +typedef struct IMXUSBPHYState {
 +    /* <private> */
 +    SysBusDevice parent_obj;
 +
 +    /* <public> */
 +    MemoryRegion iomem;
 +
 +    uint32_t usbphy[USBPHY_MAX];
 +} IMXUSBPHYState;
 +
 +#endif /* IMX_USB_PHY_H */
 diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/usb/imx-usb-phy.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * i.MX USB PHY
 + *
 + * Copyright (c) 2020 Guenter Roeck <linux@roeck-us.net>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + *
 + * We need to implement basic reset control in the PHY control register.
 + * For everything else, it is sufficient to set whatever is written.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "hw/usb/imx-usb-phy.h"
 +#include "migration/vmstate.h"
 +#include "qemu/log.h"
 +#include "qemu/module.h"
 +
 +static const VMStateDescription vmstate_imx_usbphy = {
 +    .name = TYPE_IMX_USBPHY,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(usbphy, IMXUSBPHYState, USBPHY_MAX),
 +        VMSTATE_END_OF_LIST()
 +    },
 +};
 +
 +static void imx_usbphy_softreset(IMXUSBPHYState *s)
 +{
 +    s->usbphy[USBPHY_PWD] = 0x001e1c00;
 +    s->usbphy[USBPHY_TX] = 0x10060607;
 +    s->usbphy[USBPHY_RX] = 0x00000000;
 +    s->usbphy[USBPHY_CTRL] = 0xc0200000;
 +}
 +
 +static void imx_usbphy_reset(DeviceState *dev)
 +{
 +    IMXUSBPHYState *s = IMX_USBPHY(dev);
 +
 +    s->usbphy[USBPHY_STATUS] = 0x00000000;
 +    s->usbphy[USBPHY_DEBUG] = 0x7f180000;
 +    s->usbphy[USBPHY_DEBUG0_STATUS] = 0x00000000;
 +    s->usbphy[USBPHY_DEBUG1] = 0x00001000;
 +    s->usbphy[USBPHY_VERSION] = 0x04020000;
 +
 +    imx_usbphy_softreset(s);
 +}
 +
 +static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    IMXUSBPHYState *s = (IMXUSBPHYState *)opaque;
 +    uint32_t index = offset >> 2;
 +    uint32_t value;
 +
 +    switch (index) {
 +    case USBPHY_PWD_SET:
 +    case USBPHY_TX_SET:
 +    case USBPHY_RX_SET:
 +    case USBPHY_CTRL_SET:
 +    case USBPHY_DEBUG_SET:
 +    case USBPHY_DEBUG1_SET:
 +        /*
 +         * All REG_NAME_SET register access are in fact targeting the
 +         * REG_NAME register.
 +         */
 +        value = s->usbphy[index - 1];
 +        break;
 +    case USBPHY_PWD_CLR:
 +    case USBPHY_TX_CLR:
 +    case USBPHY_RX_CLR:
 +    case USBPHY_CTRL_CLR:
 +    case USBPHY_DEBUG_CLR:
 +    case USBPHY_DEBUG1_CLR:
 +        /*
 +         * All REG_NAME_CLR register access are in fact targeting the
 +         * REG_NAME register.
 +         */
 +        value = s->usbphy[index - 2];
 +        break;
 +    case USBPHY_PWD_TOG:
 +    case USBPHY_TX_TOG:
 +    case USBPHY_RX_TOG:
 +    case USBPHY_CTRL_TOG:
 +    case USBPHY_DEBUG_TOG:
 +    case USBPHY_DEBUG1_TOG:
 +        /*
 +         * All REG_NAME_TOG register access are in fact targeting the
 +         * REG_NAME register.
 +         */
 +        value = s->usbphy[index - 3];
 +        break;
 +    default:
 +        value = s->usbphy[index];
 +        break;
 +    }
 +    return (uint64_t)value;
 +}
 +
 +static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
 +                             unsigned size)
 +{
 +    IMXUSBPHYState *s = (IMXUSBPHYState *)opaque;
 +    uint32_t index = offset >> 2;
 +
 +    switch (index) {
 +    case USBPHY_CTRL:
 +        s->usbphy[index] = value;
 +        if (value & USBPHY_CTRL_SFTRST) {
 +            imx_usbphy_softreset(s);
 +        }
 +        break;
 +    case USBPHY_PWD:
 +    case USBPHY_TX:
 +    case USBPHY_RX:
 +    case USBPHY_STATUS:
 +    case USBPHY_DEBUG:
 +    case USBPHY_DEBUG1:
 +        s->usbphy[index] = value;
 +        break;
 +    case USBPHY_CTRL_SET:
 +        s->usbphy[index - 1] |= value;
 +        if (value & USBPHY_CTRL_SFTRST) {
 +            imx_usbphy_softreset(s);
 +        }
 +        break;
 +    case USBPHY_PWD_SET:
 +    case USBPHY_TX_SET:
 +    case USBPHY_RX_SET:
 +    case USBPHY_DEBUG_SET:
 +    case USBPHY_DEBUG1_SET:
 +        /*
 +         * All REG_NAME_SET register access are in fact targeting the
 +         * REG_NAME register. So we change the value of the REG_NAME
 +         * register, setting bits passed in the value.
 +         */
 +        s->usbphy[index - 1] |= value;
 +        break;
 +    case USBPHY_PWD_CLR:
 +    case USBPHY_TX_CLR:
 +    case USBPHY_RX_CLR:
 +    case USBPHY_CTRL_CLR:
 +    case USBPHY_DEBUG_CLR:
 +    case USBPHY_DEBUG1_CLR:
 +        /*
 +         * All REG_NAME_CLR register access are in fact targeting the
 +         * REG_NAME register. So we change the value of the REG_NAME
 +         * register, unsetting bits passed in the value.
 +         */
 +        s->usbphy[index - 2] &= ~value;
 +        break;
 +    case USBPHY_CTRL_TOG:
 +        s->usbphy[index - 3] ^= value;
 +        if ((value & USBPHY_CTRL_SFTRST) &&
 +            (s->usbphy[index - 3] & USBPHY_CTRL_SFTRST)) {
 +            imx_usbphy_softreset(s);
 +        }
 +        break;
 +    case USBPHY_PWD_TOG:
 +    case USBPHY_TX_TOG:
 +    case USBPHY_RX_TOG:
 +    case USBPHY_DEBUG_TOG:
 +    case USBPHY_DEBUG1_TOG:
 +        /*
 +         * All REG_NAME_TOG register access are in fact targeting the
 +         * REG_NAME register. So we change the value of the REG_NAME
 +         * register, toggling bits passed in the value.
 +         */
 +        s->usbphy[index - 3] ^= value;
 +        break;
 +    default:
 +        /* Other registers are read-only */
 +        break;
 +    }
 +}
 +
 +static const struct MemoryRegionOps imx_usbphy_ops = {
 +    .read = imx_usbphy_read,
 +    .write = imx_usbphy_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .valid = {
 +        /*
 +         * Our device would not work correctly if the guest was doing
 +         * unaligned access. This might not be a limitation on the real
 +         * device but in practice there is no reason for a guest to access
 +         * this device unaligned.
 +         */
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +        .unaligned = false,
 +    },
 +};
 +
 +static void imx_usbphy_realize(DeviceState *dev, Error **errp)
 +{
 +    IMXUSBPHYState *s = IMX_USBPHY(dev);
 +
 +    memory_region_init_io(&s->iomem, OBJECT(s), &imx_usbphy_ops, s,
 +                          "imx-usbphy", 0x1000);
 +    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 +}
 +
 +static void imx_usbphy_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = imx_usbphy_reset;
 +    dc->vmsd = &vmstate_imx_usbphy;
 +    dc->desc = "i.MX USB PHY Module";
 +    dc->realize = imx_usbphy_realize;
 +}
 +
 +static const TypeInfo imx_usbphy_info = {
 +    .name          = TYPE_IMX_USBPHY,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(IMXUSBPHYState),
 +    .class_init    = imx_usbphy_class_init,
 +};
 +
 +static void imx_usbphy_register_types(void)
 +{
 +    type_register_static(&imx_usbphy_info);
 +}
 +
 +type_init(imx_usbphy_register_types)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: hw/arm/sabrelite.c
+@@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/*
- F: hw/arm/fsl-imx6.c
- F: hw/misc/imx6_*.c
+ Incompatible changes
- F: hw/ssi/imx_spi.c
+ R: libvir-list@redhat.com
-+F: hw/usb/imx-usb-phy.c
+-F: docs/system/deprecated.rst
-+F: include/hw/usb/imx-usb-phy.h
++F: docs/about/deprecated.rst
- F: include/hw/arm/fsl-imx6.h
- F: include/hw/misc/imx6_*.h
+ Build System
- F: include/hw/ssi/imx_spi.h
+ ------------
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
      select IMX
      select IMX_FEC
      select IMX_I2C
 +    select IMX_USBPHY
      select SDHCI
  config ASPEED_SOC
 diff --git a/hw/usb/Kconfig b/hw/usb/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/usb/Kconfig
 +++ b/hw/usb/Kconfig
@@ -XXX,XX +XXX,XX @@ config USB_STORAGE_MTP
      bool
      default y
      depends on USB
 +
 +config IMX_USBPHY
 +    bool
 +    default y
 +    depends on USB
 --
 .20.1

-[PULL 02/11] hw/arm/fsl-imx6ul: Fix USB interrupt numbers
+[PULL 10/14] target/arm: Correctly bound length in sve_zcr_get_valid_len
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-USB1 and USB2 interrupt numbers were swapped. USB_PHY2 interrupt number
+Currently, our only caller is sve_zcr_len_for_el, which has
-is 45. That didn't really matter up to now since the interrupts were not
+already masked the length extracted from ZCR_ELx, so the
-used, but it needs to be fixed to be able to wire up the USB controllers.
+masking done here is a nop.  But we will shortly have uses
 from other locations, where the length will be unmasked.
-Fixes: 31cbf933f0e ("i.MX6UL: Add i.MX6UL SOC")
+Saturate the length to ARM_MAX_VQ instead of truncating to
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+the low 4 bits.
-Message-id: 20200313014551.12554-3-linux@roeck-us.net
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210723203344.968563-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/fsl-imx6ul.h | 6 +++---
+ target/arm/helper.c | 4 +++-
-file changed, 3 insertions(+), 3 deletions(-)
+file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6ul.h
+--- a/target/arm/helper.c
-+++ b/include/hw/arm/fsl-imx6ul.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULIRQs {
+@@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
-     FSL_IMX6UL_UART7_IRQ    = 39,
+ {
-     FSL_IMX6UL_UART8_IRQ    = 40,
+     uint32_t end_len;
--    FSL_IMX6UL_USB1_IRQ     = 42,
+-    end_len = start_len &= 0xf;
--    FSL_IMX6UL_USB2_IRQ     = 43,
++    start_len = MIN(start_len, ARM_MAX_VQ - 1);
-+    FSL_IMX6UL_USB1_IRQ     = 43,
++    end_len = start_len;
-+    FSL_IMX6UL_USB2_IRQ     = 42,
++
-     FSL_IMX6UL_USB_PHY1_IRQ = 44,
+     if (!test_bit(start_len, cpu->sve_vq_map)) {
--    FSL_IMX6UL_USB_PHY2_IRQ = 44,
+         end_len = find_last_bit(cpu->sve_vq_map, start_len);
-+    FSL_IMX6UL_USB_PHY2_IRQ = 45,
+         assert(end_len < start_len);
      FSL_IMX6UL_CAAM_JQ2_IRQ = 46,
      FSL_IMX6UL_CAAM_ERR_IRQ = 47,
 --
 .20.1

-[PULL 11/11] hw/arm/pxa2xx: Do not wire up OHCI for PXA255
+[PULL 11/14] target/arm: Export aarch64_sve_zcr_get_valid_len
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-PXA255 does not support a USB OHCI controller, so don't wire it up.
+Rename from sve_zcr_get_valid_len and make accessible
 from outside of helper.c.
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200313160215.28155-1-linux@roeck-us.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210723203344.968563-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/pxa2xx.c | 3 ---
+ target/arm/internals.h | 10 ++++++++++
-file changed, 3 deletions(-)
+ target/arm/helper.c    |  4 ++--
 files changed, 12 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/pxa2xx.c
+--- a/target/arm/internals.h
-+++ b/hw/arm/pxa2xx.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
+@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void);
-         s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, "ssi");
+ void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
  #endif /* CONFIG_TCG */
 +/**
 + * aarch64_sve_zcr_get_valid_len:
 + * @cpu: cpu context
 + * @start_len: maximum len to consider
 + *
 + * Return the maximum supported sve vector length <= @start_len.
 + * Note that both @start_len and the return value are in units
 + * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
 + */
 +uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
  enum arm_fprounding {
      FPROUNDING_TIEEVEN,
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
      return 0;
  }
 -static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 +uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
  {
      uint32_t end_len;
@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
          zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
      }
--    sysbus_create_simple("sysbus-ohci", 0x4c000000,
+-    return sve_zcr_get_valid_len(cpu, zcr_len);
--                         qdev_get_gpio_in(s->pic, PXA2XX_PIC_USBH1));
++    return aarch64_sve_zcr_get_valid_len(cpu, zcr_len);
--
+ }
-     s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000);
-     s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000);
+ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 --
 .20.1

-[PULL 04/11] hw/arm/fsl-imx6ul: Wire up USB controllers
+[PULL 12/14] target/arm: Add sve-default-vector-length cpu property
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-IMX6UL USB controllers are quite similar to IMX7 USB controllers.
+Mirror the behavour of /proc/sys/abi/sve_default_vector_length
-Wire them up the same way.
+under the real linux kernel.  We have no way of passing along
 a real default across exec like the kernel can, but this is a
 decent way of adjusting the startup vector length of a process.
-The only real difference is that wiring up phy devices is necessary
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482
-to avoid phy reset timeouts in the Linux kernel.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Message-id: 20200313014551.12554-5-linux@roeck-us.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210723203344.968563-4-richard.henderson@linaro.org
+[PMM: tweaked docs formatting, document -1 special-case,
+ added fixup patch from RTH mentioning QEMU's maximum veclen.]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/fsl-imx6ul.h | 10 ++++++++++
+ docs/system/arm/cpu-features.rst | 15 ++++++++
- hw/arm/fsl-imx6ul.c         | 35 +++++++++++++++++++++++++++++++++++
+ target/arm/cpu.h                 |  5 +++
-files changed, 45 insertions(+)
+ target/arm/cpu.c                 | 14 ++++++--
  target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++
 files changed, 92 insertions(+), 2 deletions(-)
-diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
+diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6ul.h
+--- a/docs/system/arm/cpu-features.rst
-+++ b/include/hw/arm/fsl-imx6ul.h
++++ b/docs/system/arm/cpu-features.rst
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
- #include "hw/sd/sdhci.h"
+ lengths is to explicitly enable each desired length.  Therefore only
- #include "hw/ssi/imx_spi.h"
+ example's (1), (4), and (6) exhibit recommended uses of the properties.
- #include "hw/net/imx_fec.h"
-+#include "hw/usb/chipidea.h"
++SVE User-mode Default Vector Length Property
-+#include "hw/usb/imx-usb-phy.h"
++--------------------------------------------
- #include "exec/memory.h"
++
- #include "cpu.h"
++For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is
++defined to mirror the Linux kernel parameter file
-@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULConfiguration {
++``/proc/sys/abi/sve_default_vector_length``.  The default length, ``N``,
-     FSL_IMX6UL_NUM_I2CS         = 4,
++is in units of bytes and must be between 16 and 8192.
-     FSL_IMX6UL_NUM_ECSPIS       = 4,
++If not specified, the default vector length is 64.
-     FSL_IMX6UL_NUM_ADCS         = 2,
++
-+    FSL_IMX6UL_NUM_USB_PHYS     = 2,
++If the default length is larger than the maximum vector length enabled,
-+    FSL_IMX6UL_NUM_USBS         = 2,
++the actual vector length will be reduced.  Note that the maximum vector
- };
++length supported by QEMU is 256.
++
- typedef struct FslIMX6ULState {
++If this property is set to ``-1`` then the default vector length
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6ULState {
++is set to the maximum possible length.
-     IMXFECState        eth[FSL_IMX6UL_NUM_ETHS];
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
      SDHCIState         usdhc[FSL_IMX6UL_NUM_USDHCS];
      IMX2WdtState       wdt[FSL_IMX6UL_NUM_WDTS];
 +    IMXUSBPHYState     usbphy[FSL_IMX6UL_NUM_USB_PHYS];
 +    ChipideaState      usb[FSL_IMX6UL_NUM_USBS];
      MemoryRegion       rom;
      MemoryRegion       caam;
      MemoryRegion       ocram;
@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULMemoryMap {
      FSL_IMX6UL_EPIT2_ADDR           = 0x020D4000,
      FSL_IMX6UL_EPIT1_ADDR           = 0x020D0000,
      FSL_IMX6UL_SNVS_HP_ADDR         = 0x020CC000,
 +    FSL_IMX6UL_USBPHY2_ADDR         = 0x020CA000,
 +    FSL_IMX6UL_USBPHY2_SIZE         = (4 * 1024),
 +    FSL_IMX6UL_USBPHY1_ADDR         = 0x020C9000,
 +    FSL_IMX6UL_USBPHY1_SIZE         = (4 * 1024),
      FSL_IMX6UL_ANALOG_ADDR          = 0x020C8000,
      FSL_IMX6UL_CCM_ADDR             = 0x020C4000,
      FSL_IMX6UL_WDOG2_ADDR           = 0x020C0000,
 diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx6ul.c
+--- a/target/arm/cpu.h
-+++ b/hw/arm/fsl-imx6ul.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
- #include "qapi/error.h"
+     /* Used to set the maximum vector length the cpu will support.  */
- #include "hw/arm/fsl-imx6ul.h"
+     uint32_t sve_max_vq;
- #include "hw/misc/unimp.h"
-+#include "hw/usb/imx-usb-phy.h"
++#ifdef CONFIG_USER_ONLY
- #include "hw/boards.h"
++    /* Used to set the default vector length at process start. */
- #include "sysemu/sysemu.h"
++    uint32_t sve_default_vq;
- #include "qemu/error-report.h"
++#endif
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_init(Object *obj)
++
-                               TYPE_IMX_ENET);
+     /*
-     }
+      * In sve_vq_map each set bit is a supported vector length of
+      * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
-+    /* USB */
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-+    for (i = 0; i < FSL_IMX6UL_NUM_USB_PHYS; i++) {
+index XXXXXXX..XXXXXXX 100644
-+        snprintf(name, NAME_SIZE, "usbphy%d", i);
+--- a/target/arm/cpu.c
-+        sysbus_init_child_obj(obj, name, &s->usbphy[i], sizeof(s->usbphy[i]),
++++ b/target/arm/cpu.c
-+                              TYPE_IMX_USBPHY);
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
-+    }
+         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
-+    for (i = 0; i < FSL_IMX6UL_NUM_USBS; i++) {
+         /* with reasonable vector length */
-+        snprintf(name, NAME_SIZE, "usb%d", i);
+         if (cpu_isar_feature(aa64_sve, cpu)) {
-+        sysbus_init_child_obj(obj, name, &s->usb[i], sizeof(s->usb[i]),
+-            env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3);
-+                              TYPE_CHIPIDEA);
++            env->vfp.zcr_el[1] =
 +                aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
          }
          /*
           * Enable TBI0 but not TBI1.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
      QLIST_INIT(&cpu->pre_el_change_hooks);
      QLIST_INIT(&cpu->el_change_hooks);
 -#ifndef CONFIG_USER_ONLY
 +#ifdef CONFIG_USER_ONLY
 +# ifdef TARGET_AARCH64
 +    /*
 +     * The linux kernel defaults to 512-bit vectors, when sve is supported.
 +     * See documentation for /proc/sys/abi/sve_default_vector_length, and
 +     * our corresponding sve-default-vector-length cpu property.
 +     */
 +    cpu->sve_default_vq = 4;
 +# endif
 +#else
      /* Our inbound IRQ and FIQ lines */
      if (kvm_enabled()) {
          /* VIRQ and VFIQ are unused with KVM but we add them to maintain
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
      cpu->isar.id_aa64pfr0 = t;
  }
 +#ifdef CONFIG_USER_ONLY
 +/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
 +static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
 +                                            const char *name, void *opaque,
 +                                            Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    int32_t default_len, default_vq, remainder;
 +
 +    if (!visit_type_int32(v, name, &default_len, errp)) {
 +        return;
 +    }
 +
-     /*
++    /* Undocumented, but the kernel allows -1 to indicate "maximum". */
-      * SDHCI
++    if (default_len == -1) {
-      */
++        cpu->sve_default_vq = ARM_MAX_VQ;
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
++        return;
                                              FSL_IMX6UL_ENETn_TIMER_IRQ[i]));
      }
 +    /* USB */
 +    for (i = 0; i < FSL_IMX6UL_NUM_USB_PHYS; i++) {
 +        object_property_set_bool(OBJECT(&s->usbphy[i]), true, "realized",
 +                                 &error_abort);
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usbphy[i]), 0,
 +                        FSL_IMX6UL_USBPHY1_ADDR + i * 0x1000);
 +    }
 +
-+    for (i = 0; i < FSL_IMX6UL_NUM_USBS; i++) {
++    default_vq = default_len / 16;
-+        static const int FSL_IMX6UL_USBn_IRQ[] = {
++    remainder = default_len % 16;
-+            FSL_IMX6UL_USB1_IRQ,
++
-+            FSL_IMX6UL_USB2_IRQ,
++    /*
-+        };
++     * Note that the 512 max comes from include/uapi/asm/sve_context.h
-+        object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",
++     * and is the maximum architectural width of ZCR_ELx.LEN.
-+                                 &error_abort);
++     */
-+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
++    if (remainder || default_vq < 1 || default_vq > 512) {
-+                        FSL_IMX6UL_USBO2_USB_ADDR + i * 0x200);
++        error_setg(errp, "cannot set sve-default-vector-length");
-+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
++        if (remainder) {
-+                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
++            error_append_hint(errp, "Vector length not a multiple of 16\n");
-+                                            FSL_IMX6UL_USBn_IRQ[i]));
++        } else if (default_vq < 1) {
 +            error_append_hint(errp, "Vector length smaller than 16\n");
 +        } else {
 +            error_append_hint(errp, "Vector length larger than %d\n",
 +                              512 * 16);
 +        }
 +        return;
 +    }
 +
-     /*
++    cpu->sve_default_vq = default_vq;
-      * USDHC
++}
-      */
++
 +static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
 +                                            const char *name, void *opaque,
 +                                            Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    int32_t value = cpu->sve_default_vq * 16;
 +
 +    visit_type_int32(v, name, &value, errp);
 +}
 +#endif
 +
  void aarch64_add_sve_properties(Object *obj)
  {
      uint32_t vq;
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
          object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
                              cpu_arm_set_sve_vq, NULL, NULL);
      }
 +
 +#ifdef CONFIG_USER_ONLY
 +    /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
 +    object_property_add(obj, "sve-default-vector-length", "int32",
 +                        cpu_arm_get_sve_default_vec_len,
 +                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
 +#endif
  }
  void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
 --
 .20.1

-[PULL 07/11] m25p80: Convert to support tracing
+[PULL 13/14] hw/arm/nseries: Display hexadecimal value with '0x' prefix
-From: Guenter Roeck <linux@roeck-us.net>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-While at it, add some trace messages to help debug problems
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-seen when running the latest Linux kernel.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210726150953.1218690-1-f4bug@amsat.org
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/block/m25p80.c     | 48 ++++++++++++++++++++-----------------------
+ hw/arm/nseries.c | 2 +-
- hw/block/trace-events | 16 +++++++++++++++
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 38 insertions(+), 26 deletions(-)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/hw/arm/nseries.c
-+++ b/hw/block/m25p80.c
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static uint32_t mipid_txrx(void *opaque, uint32_t cmd, int len)
- #include "qemu/module.h"
+     default:
- #include "qemu/error-report.h"
+     bad_cmd:
- #include "qapi/error.h"
+         qemu_log_mask(LOG_GUEST_ERROR,
--
+-                      "%s: unknown command %02x\n", __func__, s->cmd);
--#ifndef M25P80_ERR_DEBUG
++                      "%s: unknown command 0x%02x\n", __func__, s->cmd);
 -#define M25P80_ERR_DEBUG 0
 -#endif
 -
 -#define DB_PRINT_L(level, ...) do { \
 -    if (M25P80_ERR_DEBUG > (level)) { \
 -        fprintf(stderr,  ": %s: ", __func__); \
 -        fprintf(stderr, ## __VA_ARGS__); \
 -    } \
 -} while (0)
 +#include "trace.h"
  /* Fields for FlashPartInfo->flags */
@@ -XXX,XX +XXX,XX @@ static void flash_erase(Flash *s, int offset, FlashCMD cmd)
          abort();
      }
 -    DB_PRINT_L(0, "offset = %#x, len = %d\n", offset, len);
 +    trace_m25p80_flash_erase(s, offset, len);
 +
      if ((s->pi->flags & capa_to_assert) != capa_to_assert) {
          qemu_log_mask(LOG_GUEST_ERROR, "M25P80: %d erase size not supported by"
                        " device\n", len);
@@ -XXX,XX +XXX,XX @@ void flash_write8(Flash *s, uint32_t addr, uint8_t data)
      }
      if ((prev ^ data) & data) {
 -        DB_PRINT_L(1, "programming zero to one! addr=%" PRIx32 "  %" PRIx8
 -                   " -> %" PRIx8 "\n", addr, prev, data);
 +        trace_m25p80_programming_zero_to_one(s, addr, prev, data);
      }
      if (s->pi->flags & EEPROM) {
@@ -XXX,XX +XXX,XX @@ static void complete_collecting_data(Flash *s)
      s->state = STATE_IDLE;
 +    trace_m25p80_complete_collecting(s, s->cmd_in_progress, n, s->ear,
 +                                     s->cur_addr);
 +
      switch (s->cmd_in_progress) {
      case DPP:
      case QPP:
@@ -XXX,XX +XXX,XX @@ static void reset_memory(Flash *s)
          break;
      }
--    DB_PRINT_L(0, "Reset done.\n");
-+    trace_m25p80_reset_done(s);
- }
- static void decode_fast_read_cmd(Flash *s)
-@@ -XXX,XX +XXX,XX @@ static void decode_qio_read_cmd(Flash *s)
- static void decode_new_cmd(Flash *s, uint32_t value)
- {
--    s->cmd_in_progress = value;
-     int i;
--    DB_PRINT_L(0, "decoded new command:%x\n", value);
-+
-+    s->cmd_in_progress = value;
-+    trace_m25p80_command_decoded(s, value);
-     if (value != RESET_MEMORY) {
-         s->reset_enable = false;
-@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
-         break;
-     case JEDEC_READ:
--        DB_PRINT_L(0, "populated jedec code\n");
-+        trace_m25p80_populated_jedec(s);
-         for (i = 0; i < s->pi->id_len; i++) {
-             s->data[i] = s->pi->id[i];
-         }
-@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
-     case BULK_ERASE_60:
-     case BULK_ERASE:
-         if (s->write_enable) {
--            DB_PRINT_L(0, "chip erase\n");
-+            trace_m25p80_chip_erase(s);
-             flash_erase(s, 0, BULK_ERASE);
-         } else {
-             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: chip erase with write "
-@@ -XXX,XX +XXX,XX @@ static int m25p80_cs(SSISlave *ss, bool select)
-         s->data_read_loop = false;
-     }
--    DB_PRINT_L(0, "%sselect\n", select ? "de" : "");
-+    trace_m25p80_select(s, select ? "de" : "");
-     return 0;
- }
-@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)
-     Flash *s = M25P80(ss);
-     uint32_t r = 0;
-+    trace_m25p80_transfer(s, s->state, s->len, s->needed_bytes, s->pos,
-+                          s->cur_addr, (uint8_t)tx);
-+
-     switch (s->state) {
-     case STATE_PAGE_PROGRAM:
--        DB_PRINT_L(1, "page program cur_addr=%#" PRIx32 " data=%" PRIx8 "\n",
--                   s->cur_addr, (uint8_t)tx);
-+        trace_m25p80_page_program(s, s->cur_addr, (uint8_t)tx);
-         flash_write8(s, s->cur_addr, (uint8_t)tx);
-         s->cur_addr = (s->cur_addr + 1) & (s->size - 1);
-         break;
-     case STATE_READ:
-         r = s->storage[s->cur_addr];
--        DB_PRINT_L(1, "READ 0x%" PRIx32 "=%" PRIx8 "\n", s->cur_addr,
--                   (uint8_t)r);
-+        trace_m25p80_read_byte(s, s->cur_addr, (uint8_t)r);
-         s->cur_addr = (s->cur_addr + 1) & (s->size - 1);
-         break;
-@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)
-         }
-         r = s->data[s->pos];
-+        trace_m25p80_read_data(s, s->pos, (uint8_t)r);
-         s->pos++;
-         if (s->pos == s->len) {
-             s->pos = 0;
-@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)
-             return;
-         }
--        DB_PRINT_L(0, "Binding to IF_MTD drive\n");
-+        trace_m25p80_binding(s);
-         s->storage = blk_blockalign(s->blk, s->size);
-         if (blk_pread(s->blk, 0, s->storage, s->size) != s->size) {
-@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)
-             return;
-         }
-     } else {
--        DB_PRINT_L(0, "No BDRV - binding to RAM\n");
-+        trace_m25p80_binding_no_bdrv(s);
-         s->storage = blk_blockalign(NULL, s->size);
-         memset(s->storage, 0xFF, s->size);
-     }
-diff --git a/hw/block/trace-events b/hw/block/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/trace-events
-+++ b/hw/block/trace-events
-@@ -XXX,XX +XXX,XX @@ xen_block_blockdev_add(char *str) "%s"
- xen_block_blockdev_del(const char *node_name) "%s"
- xen_block_device_create(unsigned int number) "%u"
- xen_block_device_destroy(unsigned int number) "%u"
-+
-+# m25p80.c
-+m25p80_flash_erase(void *s, int offset, uint32_t len) "[%p] offset = 0x%"PRIx32", len = %u"
-+m25p80_programming_zero_to_one(void *s, uint32_t addr, uint8_t prev, uint8_t data) "[%p] programming zero to one! addr=0x%"PRIx32"  0x%"PRIx8" -> 0x%"PRIx8
-+m25p80_reset_done(void *s) "[%p] Reset done."
-+m25p80_command_decoded(void *s, uint32_t cmd) "[%p] new command:0x%"PRIx32
-+m25p80_complete_collecting(void *s, uint32_t cmd, int n, uint8_t ear, uint32_t cur_addr) "[%p] decode cmd: 0x%"PRIx32" len %d ear 0x%"PRIx8" addr 0x%"PRIx32
-+m25p80_populated_jedec(void *s) "[%p] populated jedec code"
-+m25p80_chip_erase(void *s) "[%p] chip erase"
-+m25p80_select(void *s, const char *what) "[%p] %sselect"
-+m25p80_page_program(void *s, uint32_t addr, uint8_t tx) "[%p] page program cur_addr=0x%"PRIx32" data=0x%"PRIx8
-+m25p80_transfer(void *s, uint8_t state, uint32_t len, uint8_t needed, uint32_t pos, uint32_t cur_addr, uint8_t t) "[%p] Transfer state 0x%"PRIx8" len 0x%"PRIx32" needed 0x%"PRIx8" pos 0x%"PRIx32" addr 0x%"PRIx32" tx 0x%"PRIx8
-+m25p80_read_byte(void *s, uint32_t addr, uint8_t v) "[%p] Read byte 0x%"PRIx32"=0x%"PRIx8
-+m25p80_read_data(void *s, uint32_t pos, uint8_t v) "[%p] Read data 0x%"PRIx32"=0x%"PRIx8
-+m25p80_binding(void *s) "[%p] Binding to IF_MTD drive"
-+m25p80_binding_no_bdrv(void *s) "[%p] No BDRV - binding to RAM"
 --
 .20.1

-[PULL 05/11] hw/arm/fsl-imx6: Wire up USB controllers
+[PULL 14/14] hw: aspeed_gpio: Fix memory size
-From: Guenter Roeck <linux@roeck-us.net>
+From: Joel Stanley <joel@jms.id.au>
-With this patch, the USB controllers on 'sabrelite' are detected
+The macro used to calculate the maximum memory size of the MMIO region
-and can be used to boot the system.
+had a mistake, causing all GPIO models to create a mapping of 0x9D8.
 The intent was to have it be 0x9D8 - 0x800.
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+This extra size doesn't matter on ast2400 and ast2500, which have a 4KB
-Message-id: 20200313014551.12554-6-linux@roeck-us.net
+region set aside for the GPIO controller.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the
 regions would overlap. Worse was the 1.8V controller would map over the
 top of the following peripheral, which happens to be the RTC.
 The mmio region used by each device is a maximum of 2KB, so avoid the
 calculations and hard code this as the maximum.
 Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation")
 Signed-off-by: Joel Stanley <joel@jms.id.au>
 Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20210713065854.134634-2-joel@jms.id.au
 [PMM: fix autocorrect error in commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/fsl-imx6.h |  6 ++++++
+ hw/gpio/aspeed_gpio.c | 3 +--
- hw/arm/fsl-imx6.c         | 36 ++++++++++++++++++++++++++++++++++++
+file changed, 1 insertion(+), 2 deletions(-)
 files changed, 42 insertions(+)
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6.h
+--- a/hw/gpio/aspeed_gpio.c
-+++ b/include/hw/arm/fsl-imx6.h
++++ b/hw/gpio/aspeed_gpio.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/sd/sdhci.h"
+ #define GPIO_1_8V_MEM_SIZE            0x9D8
- #include "hw/ssi/imx_spi.h"
+ #define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
- #include "hw/net/imx_fec.h"
+                                       GPIO_1_8V_REG_OFFSET) >> 2)
-+#include "hw/usb/chipidea.h"
+-#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
-+#include "hw/usb/imx-usb-phy.h"
- #include "exec/memory.h"
+ static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
- #include "cpu.h"
+ {
+@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@
  #define FSL_IMX6_NUM_ESDHCS 4
  #define FSL_IMX6_NUM_ECSPIS 5
  #define FSL_IMX6_NUM_WDTS 2
 +#define FSL_IMX6_NUM_USB_PHYS 2
 +#define FSL_IMX6_NUM_USBS 4
  typedef struct FslIMX6State {
      /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
      SDHCIState     esdhc[FSL_IMX6_NUM_ESDHCS];
      IMXSPIState    spi[FSL_IMX6_NUM_ECSPIS];
      IMX2WdtState   wdt[FSL_IMX6_NUM_WDTS];
 +    IMXUSBPHYState usbphy[FSL_IMX6_NUM_USB_PHYS];
 +    ChipideaState  usb[FSL_IMX6_NUM_USBS];
      IMXFECState    eth;
      MemoryRegion   rom;
      MemoryRegion   caam;
 diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fsl-imx6.c
 +++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "hw/arm/fsl-imx6.h"
 +#include "hw/usb/imx-usb-phy.h"
  #include "hw/boards.h"
  #include "hw/qdev-properties.h"
  #include "sysemu/sysemu.h"
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
                                TYPE_IMX_USDHC);
      }
-+    for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {
+     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
-+        snprintf(name, NAME_SIZE, "usbphy%d", i);
+-            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
-+        sysbus_init_child_obj(obj, name, &s->usbphy[i], sizeof(s->usbphy[i]),
++            TYPE_ASPEED_GPIO, 0x800);
-+                              TYPE_IMX_USBPHY);
-+    }
+     sysbus_init_mmio(sbd, &s->iomem);
-+    for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {
+ }
 +        snprintf(name, NAME_SIZE, "usb%d", i);
 +        sysbus_init_child_obj(obj, name, &s->usb[i], sizeof(s->usb[i]),
 +                              TYPE_CHIPIDEA);
 +    }
 +
      for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {
          snprintf(name, NAME_SIZE, "spi%d", i + 1);
          sysbus_init_child_obj(obj, name, &s->spi[i], sizeof(s->spi[i]),
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                              esdhc_table[i].irq));
      }
 +    /* USB */
 +    for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {
 +        object_property_set_bool(OBJECT(&s->usbphy[i]), true, "realized",
 +                                 &error_abort);
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usbphy[i]), 0,
 +                        FSL_IMX6_USBPHY1_ADDR + i * 0x1000);
 +    }
 +    for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {
 +        static const int FSL_IMX6_USBn_IRQ[] = {
 +            FSL_IMX6_USB_OTG_IRQ,
 +            FSL_IMX6_USB_HOST1_IRQ,
 +            FSL_IMX6_USB_HOST2_IRQ,
 +            FSL_IMX6_USB_HOST3_IRQ,
 +        };
 +
 +        object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",
 +                                 &error_abort);
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
 +                        FSL_IMX6_USBOH3_USB_ADDR + i * 0x200);
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
 +                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
 +                                            FSL_IMX6_USBn_IRQ[i]));
 +    }
 +
      /* Initialize all ECSPI */
      for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {
          static const struct {
 --
 .20.1

Last handful of arm patches before softfreeze...

The following changes since commit a98135f727595382e200d04c2996e868b7925a01:

Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200316-pull-request' into staging (2020-03-16 14:55:59 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200317

for you to fetch changes up to e88d3671e3bbd59d385838a4101ea19cdcf47309:

hw/arm/pxa2xx: Do not wire up OHCI for PXA255 (2020-03-17 11:36:48 +0000)

----------------------------------------------------------------
target-arm:
 * hw/arm/pxa2xx: Do not wire up OHCI for PXA255
 * aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command
 * m25p80: Improve command handling for Jedec and unsupported commands
 * hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()
 * hw/arm/fsl-imx6, imx6ul: Wire up USB controllers
 * hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices

----------------------------------------------------------------
Chen Qun (1):
      hw/net/imx_fec: write TGSR and TCSR3 in imx_enet_write()

Guenter Roeck (10):
      hw/usb: Add basic i.MX USB Phy support
      hw/arm/fsl-imx6ul: Fix USB interrupt numbers
      hw/arm/fsl-imx6ul: Instantiate unimplemented pwm and can devices
      hw/arm/fsl-imx6ul: Wire up USB controllers
      hw/arm/fsl-imx6: Wire up USB controllers
      m25p80: Convert to support tracing
      m25p80: Improve command handling for Jedec commands
      m25p80: Improve command handling for unsupported commands
      aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command
      hw/arm/pxa2xx: Do not wire up OHCI for PXA255

From: Guenter Roeck <linux@roeck-us.net>

Add basic USB PHY support as implemented in i.MX23, i.MX28, i.MX6,
and i.MX7 SoCs.

The only support really needed - at least to boot Linux - is support
for soft reset, which needs to reset various registers to their initial
value. Otherwise, just record register values.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200313014551.12554-2-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/Makefile.objs         |   2 +
 include/hw/usb/imx-usb-phy.h |  53 +++++++++
 hw/usb/imx-usb-phy.c         | 225 +++++++++++++++++++++++++++++++++++
 MAINTAINERS                  |   2 +
 hw/arm/Kconfig               |   1 +
 hw/usb/Kconfig               |   5 +
 6 files changed, 288 insertions(+)
 create mode 100644 include/hw/usb/imx-usb-phy.h
 create mode 100644 hw/usb/imx-usb-phy.c

diff --git a/hw/usb/Makefile.objs b/hw/usb/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/Makefile.objs
+++ b/hw/usb/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_XEN) += xen-usb.o
 xen-usb.o-cflags := $(LIBUSB_CFLAGS)
 xen-usb.o-libs := $(LIBUSB_LIBS)
 endif
+
+common-obj-$(CONFIG_IMX_USBPHY) += imx-usb-phy.o
diff --git a/include/hw/usb/imx-usb-phy.h b/include/hw/usb/imx-usb-phy.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/usb/imx-usb-phy.h
@@ -XXX,XX +XXX,XX @@
+#ifndef IMX_USB_PHY_H
+#define IMX_USB_PHY_H
+
+#include "hw/sysbus.h"
+#include "qemu/bitops.h"
+
+enum IMXUsbPhyRegisters {
+    USBPHY_PWD,
+    USBPHY_PWD_SET,
+    USBPHY_PWD_CLR,
+    USBPHY_PWD_TOG,
+    USBPHY_TX,
+    USBPHY_TX_SET,
+    USBPHY_TX_CLR,
+    USBPHY_TX_TOG,
+    USBPHY_RX,
+    USBPHY_RX_SET,
+    USBPHY_RX_CLR,
+    USBPHY_RX_TOG,
+    USBPHY_CTRL,
+    USBPHY_CTRL_SET,
+    USBPHY_CTRL_CLR,
+    USBPHY_CTRL_TOG,
+    USBPHY_STATUS,
+    USBPHY_DEBUG = 0x14,
+    USBPHY_DEBUG_SET,
+    USBPHY_DEBUG_CLR,
+    USBPHY_DEBUG_TOG,
+    USBPHY_DEBUG0_STATUS,
+    USBPHY_DEBUG1 = 0x1c,
+    USBPHY_DEBUG1_SET,
+    USBPHY_DEBUG1_CLR,
+    USBPHY_DEBUG1_TOG,
+    USBPHY_VERSION,
+    USBPHY_MAX
+};
+
+#define USBPHY_CTRL_SFTRST BIT(31)
+
+#define TYPE_IMX_USBPHY "imx.usbphy"
+#define IMX_USBPHY(obj) OBJECT_CHECK(IMXUSBPHYState, (obj), TYPE_IMX_USBPHY)
+
+typedef struct IMXUSBPHYState {
+    /* <private> */
+    SysBusDevice parent_obj;
+
+    /* <public> */
+    MemoryRegion iomem;
+
+    uint32_t usbphy[USBPHY_MAX];
+} IMXUSBPHYState;
+
+#endif /* IMX_USB_PHY_H */
diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/usb/imx-usb-phy.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * i.MX USB PHY
+ *
+ * Copyright (c) 2020 Guenter Roeck <linux@roeck-us.net>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ * We need to implement basic reset control in the PHY control register.
+ * For everything else, it is sufficient to set whatever is written.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/usb/imx-usb-phy.h"
+#include "migration/vmstate.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+
+static const VMStateDescription vmstate_imx_usbphy = {
+    .name = TYPE_IMX_USBPHY,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(usbphy, IMXUSBPHYState, USBPHY_MAX),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static void imx_usbphy_softreset(IMXUSBPHYState *s)
+{
+    s->usbphy[USBPHY_PWD] = 0x001e1c00;
+    s->usbphy[USBPHY_TX] = 0x10060607;
+    s->usbphy[USBPHY_RX] = 0x00000000;
+    s->usbphy[USBPHY_CTRL] = 0xc0200000;
+}
+
+static void imx_usbphy_reset(DeviceState *dev)
+{
+    IMXUSBPHYState *s = IMX_USBPHY(dev);
+
+    s->usbphy[USBPHY_STATUS] = 0x00000000;
+    s->usbphy[USBPHY_DEBUG] = 0x7f180000;
+    s->usbphy[USBPHY_DEBUG0_STATUS] = 0x00000000;
+    s->usbphy[USBPHY_DEBUG1] = 0x00001000;
+    s->usbphy[USBPHY_VERSION] = 0x04020000;
+
+    imx_usbphy_softreset(s);
+}
+
+static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
+{
+    IMXUSBPHYState *s = (IMXUSBPHYState *)opaque;
+    uint32_t index = offset >> 2;
+    uint32_t value;
+
+    switch (index) {
+    case USBPHY_PWD_SET:
+    case USBPHY_TX_SET:
+    case USBPHY_RX_SET:
+    case USBPHY_CTRL_SET:
+    case USBPHY_DEBUG_SET:
+    case USBPHY_DEBUG1_SET:
+        /*
+         * All REG_NAME_SET register access are in fact targeting the
+         * REG_NAME register.
+         */
+        value = s->usbphy[index - 1];
+        break;
+    case USBPHY_PWD_CLR:
+    case USBPHY_TX_CLR:
+    case USBPHY_RX_CLR:
+    case USBPHY_CTRL_CLR:
+    case USBPHY_DEBUG_CLR:
+    case USBPHY_DEBUG1_CLR:
+        /*
+         * All REG_NAME_CLR register access are in fact targeting the
+         * REG_NAME register.
+         */
+        value = s->usbphy[index - 2];
+        break;
+    case USBPHY_PWD_TOG:
+    case USBPHY_TX_TOG:
+    case USBPHY_RX_TOG:
+    case USBPHY_CTRL_TOG:
+    case USBPHY_DEBUG_TOG:
+    case USBPHY_DEBUG1_TOG:
+        /*
+         * All REG_NAME_TOG register access are in fact targeting the
+         * REG_NAME register.
+         */
+        value = s->usbphy[index - 3];
+        break;
+    default:
+        value = s->usbphy[index];
+        break;
+    }
+    return (uint64_t)value;
+}
+
+static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
+                             unsigned size)
+{
+    IMXUSBPHYState *s = (IMXUSBPHYState *)opaque;
+    uint32_t index = offset >> 2;
+
+    switch (index) {
+    case USBPHY_CTRL:
+        s->usbphy[index] = value;
+        if (value & USBPHY_CTRL_SFTRST) {
+            imx_usbphy_softreset(s);
+        }
+        break;
+    case USBPHY_PWD:
+    case USBPHY_TX:
+    case USBPHY_RX:
+    case USBPHY_STATUS:
+    case USBPHY_DEBUG:
+    case USBPHY_DEBUG1:
+        s->usbphy[index] = value;
+        break;
+    case USBPHY_CTRL_SET:
+        s->usbphy[index - 1] |= value;
+        if (value & USBPHY_CTRL_SFTRST) {
+            imx_usbphy_softreset(s);
+        }
+        break;
+    case USBPHY_PWD_SET:
+    case USBPHY_TX_SET:
+    case USBPHY_RX_SET:
+    case USBPHY_DEBUG_SET:
+    case USBPHY_DEBUG1_SET:
+        /*
+         * All REG_NAME_SET register access are in fact targeting the
+         * REG_NAME register. So we change the value of the REG_NAME
+         * register, setting bits passed in the value.
+         */
+        s->usbphy[index - 1] |= value;
+        break;
+    case USBPHY_PWD_CLR:
+    case USBPHY_TX_CLR:
+    case USBPHY_RX_CLR:
+    case USBPHY_CTRL_CLR:
+    case USBPHY_DEBUG_CLR:
+    case USBPHY_DEBUG1_CLR:
+        /*
+         * All REG_NAME_CLR register access are in fact targeting the
+         * REG_NAME register. So we change the value of the REG_NAME
+         * register, unsetting bits passed in the value.
+         */
+        s->usbphy[index - 2] &= ~value;
+        break;
+    case USBPHY_CTRL_TOG:
+        s->usbphy[index - 3] ^= value;
+        if ((value & USBPHY_CTRL_SFTRST) &&
+            (s->usbphy[index - 3] & USBPHY_CTRL_SFTRST)) {
+            imx_usbphy_softreset(s);
+        }
+        break;
+    case USBPHY_PWD_TOG:
+    case USBPHY_TX_TOG:
+    case USBPHY_RX_TOG:
+    case USBPHY_DEBUG_TOG:
+    case USBPHY_DEBUG1_TOG:
+        /*
+         * All REG_NAME_TOG register access are in fact targeting the
+         * REG_NAME register. So we change the value of the REG_NAME
+         * register, toggling bits passed in the value.
+         */
+        s->usbphy[index - 3] ^= value;
+        break;
+    default:
+        /* Other registers are read-only */
+        break;
+    }
+}
+
+static const struct MemoryRegionOps imx_usbphy_ops = {
+    .read = imx_usbphy_read,
+    .write = imx_usbphy_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        /*
+         * Our device would not work correctly if the guest was doing
+         * unaligned access. This might not be a limitation on the real
+         * device but in practice there is no reason for a guest to access
+         * this device unaligned.
+         */
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+};
+
+static void imx_usbphy_realize(DeviceState *dev, Error **errp)
+{
+    IMXUSBPHYState *s = IMX_USBPHY(dev);
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &imx_usbphy_ops, s,
+                          "imx-usbphy", 0x1000);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+}
+
+static void imx_usbphy_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = imx_usbphy_reset;
+    dc->vmsd = &vmstate_imx_usbphy;
+    dc->desc = "i.MX USB PHY Module";
+    dc->realize = imx_usbphy_realize;
+}
+
+static const TypeInfo imx_usbphy_info = {
+    .name          = TYPE_IMX_USBPHY,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(IMXUSBPHYState),
+    .class_init    = imx_usbphy_class_init,
+};
+
+static void imx_usbphy_register_types(void)
+{
+    type_register_static(&imx_usbphy_info);
+}
+
+type_init(imx_usbphy_register_types)
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/arm/sabrelite.c
 F: hw/arm/fsl-imx6.c
 F: hw/misc/imx6_*.c
 F: hw/ssi/imx_spi.c
+F: hw/usb/imx-usb-phy.c
+F: include/hw/usb/imx-usb-phy.h
 F: include/hw/arm/fsl-imx6.h
 F: include/hw/misc/imx6_*.h
 F: include/hw/ssi/imx_spi.h
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
     select IMX
     select IMX_FEC
     select IMX_I2C
+    select IMX_USBPHY
     select SDHCI
 
 config ASPEED_SOC
diff --git a/hw/usb/Kconfig b/hw/usb/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/Kconfig
+++ b/hw/usb/Kconfig
@@ -XXX,XX +XXX,XX @@ config USB_STORAGE_MTP
     bool
     default y
     depends on USB
+
+config IMX_USBPHY
+    bool
+    default y
+    depends on USB
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

USB1 and USB2 interrupt numbers were swapped. USB_PHY2 interrupt number
is 45. That didn't really matter up to now since the interrupts were not
used, but it needs to be fixed to be able to wire up the USB controllers.

Fixes: 31cbf933f0e ("i.MX6UL: Add i.MX6UL SOC")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200313014551.12554-3-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6ul.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULIRQs {
     FSL_IMX6UL_UART7_IRQ    = 39,
     FSL_IMX6UL_UART8_IRQ    = 40,
 
-    FSL_IMX6UL_USB1_IRQ     = 42,
-    FSL_IMX6UL_USB2_IRQ     = 43,
+    FSL_IMX6UL_USB1_IRQ     = 43,
+    FSL_IMX6UL_USB2_IRQ     = 42,
     FSL_IMX6UL_USB_PHY1_IRQ = 44,
-    FSL_IMX6UL_USB_PHY2_IRQ = 44,
+    FSL_IMX6UL_USB_PHY2_IRQ = 45,
 
     FSL_IMX6UL_CAAM_JQ2_IRQ = 46,
     FSL_IMX6UL_CAAM_ERR_IRQ = 47,
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Recent Linux kernels (post v4.20) crash due to accesses to flexcan
and pwm controllers. Instantiate as unimplemented devices to work
around the problem.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200313014551.12554-4-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx6ul.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6ul.c
+++ b/hw/arm/fsl-imx6ul.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
      */
     create_unimplemented_device("sdma", FSL_IMX6UL_SDMA_ADDR, 0x4000);
 
+    /*
+     * PWM
+     */
+    create_unimplemented_device("pwm1", FSL_IMX6UL_PWM1_ADDR, 0x4000);
+    create_unimplemented_device("pwm2", FSL_IMX6UL_PWM2_ADDR, 0x4000);
+    create_unimplemented_device("pwm3", FSL_IMX6UL_PWM3_ADDR, 0x4000);
+    create_unimplemented_device("pwm4", FSL_IMX6UL_PWM4_ADDR, 0x4000);
+
+    /*
+     * CAN
+     */
+    create_unimplemented_device("can1", FSL_IMX6UL_CAN1_ADDR, 0x4000);
+    create_unimplemented_device("can2", FSL_IMX6UL_CAN2_ADDR, 0x4000);
+
     /*
      * APHB_DMA
      */
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

IMX6UL USB controllers are quite similar to IMX7 USB controllers.
Wire them up the same way.

The only real difference is that wiring up phy devices is necessary
to avoid phy reset timeouts in the Linux kernel.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200313014551.12554-5-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6ul.h | 10 ++++++++++
 hw/arm/fsl-imx6ul.c         | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sd/sdhci.h"
 #include "hw/ssi/imx_spi.h"
 #include "hw/net/imx_fec.h"
+#include "hw/usb/chipidea.h"
+#include "hw/usb/imx-usb-phy.h"
 #include "exec/memory.h"
 #include "cpu.h"
 
@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULConfiguration {
     FSL_IMX6UL_NUM_I2CS         = 4,
     FSL_IMX6UL_NUM_ECSPIS       = 4,
     FSL_IMX6UL_NUM_ADCS         = 2,
+    FSL_IMX6UL_NUM_USB_PHYS     = 2,
+    FSL_IMX6UL_NUM_USBS         = 2,
 };
 
 typedef struct FslIMX6ULState {
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6ULState {
     IMXFECState        eth[FSL_IMX6UL_NUM_ETHS];
     SDHCIState         usdhc[FSL_IMX6UL_NUM_USDHCS];
     IMX2WdtState       wdt[FSL_IMX6UL_NUM_WDTS];
+    IMXUSBPHYState     usbphy[FSL_IMX6UL_NUM_USB_PHYS];
+    ChipideaState      usb[FSL_IMX6UL_NUM_USBS];
     MemoryRegion       rom;
     MemoryRegion       caam;
     MemoryRegion       ocram;
@@ -XXX,XX +XXX,XX @@ enum FslIMX6ULMemoryMap {
     FSL_IMX6UL_EPIT2_ADDR           = 0x020D4000,
     FSL_IMX6UL_EPIT1_ADDR           = 0x020D0000,
     FSL_IMX6UL_SNVS_HP_ADDR         = 0x020CC000,
+    FSL_IMX6UL_USBPHY2_ADDR         = 0x020CA000,
+    FSL_IMX6UL_USBPHY2_SIZE         = (4 * 1024),
+    FSL_IMX6UL_USBPHY1_ADDR         = 0x020C9000,
+    FSL_IMX6UL_USBPHY1_SIZE         = (4 * 1024),
     FSL_IMX6UL_ANALOG_ADDR          = 0x020C8000,
     FSL_IMX6UL_CCM_ADDR             = 0x020C4000,
     FSL_IMX6UL_WDOG2_ADDR           = 0x020C0000,
diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6ul.c
+++ b/hw/arm/fsl-imx6ul.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/arm/fsl-imx6ul.h"
 #include "hw/misc/unimp.h"
+#include "hw/usb/imx-usb-phy.h"
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_init(Object *obj)
                               TYPE_IMX_ENET);
     }
 
+    /* USB */
+    for (i = 0; i < FSL_IMX6UL_NUM_USB_PHYS; i++) {
+        snprintf(name, NAME_SIZE, "usbphy%d", i);
+        sysbus_init_child_obj(obj, name, &s->usbphy[i], sizeof(s->usbphy[i]),
+                              TYPE_IMX_USBPHY);
+    }
+    for (i = 0; i < FSL_IMX6UL_NUM_USBS; i++) {
+        snprintf(name, NAME_SIZE, "usb%d", i);
+        sysbus_init_child_obj(obj, name, &s->usb[i], sizeof(s->usb[i]),
+                              TYPE_CHIPIDEA);
+    }
+
     /*
      * SDHCI
      */
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)
                                             FSL_IMX6UL_ENETn_TIMER_IRQ[i]));
     }
 
+    /* USB */
+    for (i = 0; i < FSL_IMX6UL_NUM_USB_PHYS; i++) {
+        object_property_set_bool(OBJECT(&s->usbphy[i]), true, "realized",
+                                 &error_abort);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usbphy[i]), 0,
+                        FSL_IMX6UL_USBPHY1_ADDR + i * 0x1000);
+    }
+
+    for (i = 0; i < FSL_IMX6UL_NUM_USBS; i++) {
+        static const int FSL_IMX6UL_USBn_IRQ[] = {
+            FSL_IMX6UL_USB1_IRQ,
+            FSL_IMX6UL_USB2_IRQ,
+        };
+        object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",
+                                 &error_abort);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
+                        FSL_IMX6UL_USBO2_USB_ADDR + i * 0x200);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
+                           qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+                                            FSL_IMX6UL_USBn_IRQ[i]));
+    }
+
     /*
      * USDHC
      */
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

With this patch, the USB controllers on 'sabrelite' are detected
and can be used to boot the system.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20200313014551.12554-6-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h |  6 ++++++
 hw/arm/fsl-imx6.c         | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sd/sdhci.h"
 #include "hw/ssi/imx_spi.h"
 #include "hw/net/imx_fec.h"
+#include "hw/usb/chipidea.h"
+#include "hw/usb/imx-usb-phy.h"
 #include "exec/memory.h"
 #include "cpu.h"
 
@@ -XXX,XX +XXX,XX @@
 #define FSL_IMX6_NUM_ESDHCS 4
 #define FSL_IMX6_NUM_ECSPIS 5
 #define FSL_IMX6_NUM_WDTS 2
+#define FSL_IMX6_NUM_USB_PHYS 2
+#define FSL_IMX6_NUM_USBS 4
 
 typedef struct FslIMX6State {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
     SDHCIState     esdhc[FSL_IMX6_NUM_ESDHCS];
     IMXSPIState    spi[FSL_IMX6_NUM_ECSPIS];
     IMX2WdtState   wdt[FSL_IMX6_NUM_WDTS];
+    IMXUSBPHYState usbphy[FSL_IMX6_NUM_USB_PHYS];
+    ChipideaState  usb[FSL_IMX6_NUM_USBS];
     IMXFECState    eth;
     MemoryRegion   rom;
     MemoryRegion   caam;
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/arm/fsl-imx6.h"
+#include "hw/usb/imx-usb-phy.h"
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"
 #include "sysemu/sysemu.h"
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
                               TYPE_IMX_USDHC);
     }
 
+    for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {
+        snprintf(name, NAME_SIZE, "usbphy%d", i);
+        sysbus_init_child_obj(obj, name, &s->usbphy[i], sizeof(s->usbphy[i]),
+                              TYPE_IMX_USBPHY);
+    }
+    for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {
+        snprintf(name, NAME_SIZE, "usb%d", i);
+        sysbus_init_child_obj(obj, name, &s->usb[i], sizeof(s->usb[i]),
+                              TYPE_CHIPIDEA);
+    }
+
     for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {
         snprintf(name, NAME_SIZE, "spi%d", i + 1);
         sysbus_init_child_obj(obj, name, &s->spi[i], sizeof(s->spi[i]),
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                                             esdhc_table[i].irq));
     }
 
+    /* USB */
+    for (i = 0; i < FSL_IMX6_NUM_USB_PHYS; i++) {
+        object_property_set_bool(OBJECT(&s->usbphy[i]), true, "realized",
+                                 &error_abort);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usbphy[i]), 0,
+                        FSL_IMX6_USBPHY1_ADDR + i * 0x1000);
+    }
+    for (i = 0; i < FSL_IMX6_NUM_USBS; i++) {
+        static const int FSL_IMX6_USBn_IRQ[] = {
+            FSL_IMX6_USB_OTG_IRQ,
+            FSL_IMX6_USB_HOST1_IRQ,
+            FSL_IMX6_USB_HOST2_IRQ,
+            FSL_IMX6_USB_HOST3_IRQ,
+        };
+
+        object_property_set_bool(OBJECT(&s->usb[i]), true, "realized",
+                                 &error_abort);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->usb[i]), 0,
+                        FSL_IMX6_USBOH3_USB_ADDR + i * 0x200);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->usb[i]), 0,
+                           qdev_get_gpio_in(DEVICE(&s->a9mpcore),
+                                            FSL_IMX6_USBn_IRQ[i]));
+    }
+
     /* Initialize all ECSPI */
     for (i = 0; i < FSL_IMX6_NUM_ECSPIS; i++) {
         static const struct {
-- 
2.20.1

From: Chen Qun <kuhn.chenqun@huawei.com>

The current code causes clang static code analyzer generate warning:
hw/net/imx_fec.c:858:9: warning: Value stored to 'value' is never read
        value = value & 0x0000000f;
        ^       ~~~~~~~~~~~~~~~~~~
hw/net/imx_fec.c:864:9: warning: Value stored to 'value' is never read
        value = value & 0x000000fd;
        ^       ~~~~~~~~~~~~~~~~~~

According to the definition of the function, the two “value” assignments
 should be written to registers.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
Message-id: 20200313123242.13236-1-kuhn.chenqun@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/imx_fec.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_enet_write(IMXFECState *s, uint32_t index, uint32_t value)
         break;
     case ENET_TGSR:
         /* implement clear timer flag */
-        value = value & 0x0000000f;
+        s->regs[index] &= ~(value & 0x0000000f); /* all bits W1C */
         break;
     case ENET_TCSR0:
     case ENET_TCSR1:
     case ENET_TCSR2:
     case ENET_TCSR3:
-        value = value & 0x000000fd;
+        s->regs[index] &= ~(value & 0x00000080); /* W1C bits */
+        s->regs[index] &= ~0x0000007d; /* writable fields */
+        s->regs[index] |= (value & 0x0000007d);
         break;
     case ENET_TCCR0:
     case ENET_TCCR1:
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

While at it, add some trace messages to help debug problems
seen when running the latest Linux kernel.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/block/m25p80.c     | 48 ++++++++++++++++++++-----------------------
 hw/block/trace-events | 16 +++++++++++++++
 2 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
-
-#ifndef M25P80_ERR_DEBUG
-#define M25P80_ERR_DEBUG 0
-#endif
-
-#define DB_PRINT_L(level, ...) do { \
-    if (M25P80_ERR_DEBUG > (level)) { \
-        fprintf(stderr,  ": %s: ", __func__); \
-        fprintf(stderr, ## __VA_ARGS__); \
-    } \
-} while (0)
+#include "trace.h"
 
 /* Fields for FlashPartInfo->flags */
 
@@ -XXX,XX +XXX,XX @@ static void flash_erase(Flash *s, int offset, FlashCMD cmd)
         abort();
     }
 
-    DB_PRINT_L(0, "offset = %#x, len = %d\n", offset, len);
+    trace_m25p80_flash_erase(s, offset, len);
+
     if ((s->pi->flags & capa_to_assert) != capa_to_assert) {
         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: %d erase size not supported by"
                       " device\n", len);
@@ -XXX,XX +XXX,XX @@ void flash_write8(Flash *s, uint32_t addr, uint8_t data)
     }
 
     if ((prev ^ data) & data) {
-        DB_PRINT_L(1, "programming zero to one! addr=%" PRIx32 "  %" PRIx8
-                   " -> %" PRIx8 "\n", addr, prev, data);
+        trace_m25p80_programming_zero_to_one(s, addr, prev, data);
     }
 
     if (s->pi->flags & EEPROM) {
@@ -XXX,XX +XXX,XX @@ static void complete_collecting_data(Flash *s)
 
     s->state = STATE_IDLE;
 
+    trace_m25p80_complete_collecting(s, s->cmd_in_progress, n, s->ear,
+                                     s->cur_addr);
+
     switch (s->cmd_in_progress) {
     case DPP:
     case QPP:
@@ -XXX,XX +XXX,XX @@ static void reset_memory(Flash *s)
         break;
     }
 
-    DB_PRINT_L(0, "Reset done.\n");
+    trace_m25p80_reset_done(s);
 }
 
 static void decode_fast_read_cmd(Flash *s)
@@ -XXX,XX +XXX,XX @@ static void decode_qio_read_cmd(Flash *s)
 
 static void decode_new_cmd(Flash *s, uint32_t value)
 {
-    s->cmd_in_progress = value;
     int i;
-    DB_PRINT_L(0, "decoded new command:%x\n", value);
+
+    s->cmd_in_progress = value;
+    trace_m25p80_command_decoded(s, value);
 
     if (value != RESET_MEMORY) {
         s->reset_enable = false;
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
         break;
 
     case JEDEC_READ:
-        DB_PRINT_L(0, "populated jedec code\n");
+        trace_m25p80_populated_jedec(s);
         for (i = 0; i < s->pi->id_len; i++) {
             s->data[i] = s->pi->id[i];
         }
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
     case BULK_ERASE_60:
     case BULK_ERASE:
         if (s->write_enable) {
-            DB_PRINT_L(0, "chip erase\n");
+            trace_m25p80_chip_erase(s);
             flash_erase(s, 0, BULK_ERASE);
         } else {
             qemu_log_mask(LOG_GUEST_ERROR, "M25P80: chip erase with write "
@@ -XXX,XX +XXX,XX @@ static int m25p80_cs(SSISlave *ss, bool select)
         s->data_read_loop = false;
     }
 
-    DB_PRINT_L(0, "%sselect\n", select ? "de" : "");
+    trace_m25p80_select(s, select ? "de" : "");
 
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)
     Flash *s = M25P80(ss);
     uint32_t r = 0;
 
+    trace_m25p80_transfer(s, s->state, s->len, s->needed_bytes, s->pos,
+                          s->cur_addr, (uint8_t)tx);
+
     switch (s->state) {
 
     case STATE_PAGE_PROGRAM:
-        DB_PRINT_L(1, "page program cur_addr=%#" PRIx32 " data=%" PRIx8 "\n",
-                   s->cur_addr, (uint8_t)tx);
+        trace_m25p80_page_program(s, s->cur_addr, (uint8_t)tx);
         flash_write8(s, s->cur_addr, (uint8_t)tx);
         s->cur_addr = (s->cur_addr + 1) & (s->size - 1);
         break;
 
     case STATE_READ:
         r = s->storage[s->cur_addr];
-        DB_PRINT_L(1, "READ 0x%" PRIx32 "=%" PRIx8 "\n", s->cur_addr,
-                   (uint8_t)r);
+        trace_m25p80_read_byte(s, s->cur_addr, (uint8_t)r);
         s->cur_addr = (s->cur_addr + 1) & (s->size - 1);
         break;
 
@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSISlave *ss, uint32_t tx)
         }
 
         r = s->data[s->pos];
+        trace_m25p80_read_data(s, s->pos, (uint8_t)r);
         s->pos++;
         if (s->pos == s->len) {
             s->pos = 0;
@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)
             return;
         }
 
-        DB_PRINT_L(0, "Binding to IF_MTD drive\n");
+        trace_m25p80_binding(s);
         s->storage = blk_blockalign(s->blk, s->size);
 
         if (blk_pread(s->blk, 0, s->storage, s->size) != s->size) {
@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSISlave *ss, Error **errp)
             return;
         }
     } else {
-        DB_PRINT_L(0, "No BDRV - binding to RAM\n");
+        trace_m25p80_binding_no_bdrv(s);
         s->storage = blk_blockalign(NULL, s->size);
         memset(s->storage, 0xFF, s->size);
     }
diff --git a/hw/block/trace-events b/hw/block/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/trace-events
+++ b/hw/block/trace-events
@@ -XXX,XX +XXX,XX @@ xen_block_blockdev_add(char *str) "%s"
 xen_block_blockdev_del(const char *node_name) "%s"
 xen_block_device_create(unsigned int number) "%u"
 xen_block_device_destroy(unsigned int number) "%u"
+
+# m25p80.c
+m25p80_flash_erase(void *s, int offset, uint32_t len) "[%p] offset = 0x%"PRIx32", len = %u"
+m25p80_programming_zero_to_one(void *s, uint32_t addr, uint8_t prev, uint8_t data) "[%p] programming zero to one! addr=0x%"PRIx32"  0x%"PRIx8" -> 0x%"PRIx8
+m25p80_reset_done(void *s) "[%p] Reset done."
+m25p80_command_decoded(void *s, uint32_t cmd) "[%p] new command:0x%"PRIx32
+m25p80_complete_collecting(void *s, uint32_t cmd, int n, uint8_t ear, uint32_t cur_addr) "[%p] decode cmd: 0x%"PRIx32" len %d ear 0x%"PRIx8" addr 0x%"PRIx32
+m25p80_populated_jedec(void *s) "[%p] populated jedec code"
+m25p80_chip_erase(void *s) "[%p] chip erase"
+m25p80_select(void *s, const char *what) "[%p] %sselect"
+m25p80_page_program(void *s, uint32_t addr, uint8_t tx) "[%p] page program cur_addr=0x%"PRIx32" data=0x%"PRIx8
+m25p80_transfer(void *s, uint8_t state, uint32_t len, uint8_t needed, uint32_t pos, uint32_t cur_addr, uint8_t t) "[%p] Transfer state 0x%"PRIx8" len 0x%"PRIx32" needed 0x%"PRIx8" pos 0x%"PRIx32" addr 0x%"PRIx32" tx 0x%"PRIx8
+m25p80_read_byte(void *s, uint32_t addr, uint8_t v) "[%p] Read byte 0x%"PRIx32"=0x%"PRIx8
+m25p80_read_data(void *s, uint32_t pos, uint8_t v) "[%p] Read data 0x%"PRIx32"=0x%"PRIx8
+m25p80_binding(void *s) "[%p] Binding to IF_MTD drive"
+m25p80_binding_no_bdrv(void *s) "[%p] No BDRV - binding to RAM"
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

When requesting JEDEC data using the JEDEC_READ command, the Linux kernel
always requests 6 bytes. The current implementation only returns three
bytes, and interprets the remaining three bytes as new commands.
While this does not matter most of the time, it is at the very least
confusing. To avoid the problem, always report up to 6 bytes of JEDEC
data. Fill remaining data with 0.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/block/m25p80.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
         for (i = 0; i < s->pi->id_len; i++) {
             s->data[i] = s->pi->id[i];
         }
+        for (; i < SPI_NOR_MAX_ID_LEN; i++) {
+            s->data[i] = 0;
+        }
 
-        s->len = s->pi->id_len;
+        s->len = SPI_NOR_MAX_ID_LEN;
         s->pos = 0;
         s->state = STATE_READING_DATA;
         break;
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Whenever an unsupported command is encountered, the current code
interprets each transferred byte as new command. Most of the time, those
'commands' are interpreted as new unknown commands. However, in rare
cases, it may be that for example address or length information
passed with the original command is by itself a valid command.
If that happens, the state machine may get completely confused and,
worst case, start writing data into the flash or even erase it.

To avoid the problem, transition into STATE_READING_DATA and keep
sending a value of 0 until the chip is deselected after encountering
an unsupported command.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/block/m25p80.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
         s->quad_enable = false;
         break;
     default:
+        s->pos = 0;
+        s->len = 1;
+        s->state = STATE_READING_DATA;
+        s->data_read_loop = true;
+        s->data[0] = 0;
         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: Unknown cmd %x\n", value);
         break;
     }
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

The Linux kernel recently started using FAST_READ_4 commands.
This results in flash read failures. At the same time, the m25p80
emulation is seen to read 8 more bytes than expected. Adjusting the
expected number of dummy cycles to match FAST_READ fixes the problem.

Fixes: f95c4bffdc4c ("aspeed/smc: snoop SPI transfers to fake dummy cycles")
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/aspeed_smc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static int aspeed_smc_num_dummies(uint8_t command)
     case FAST_READ:
     case DOR:
     case QOR:
+    case FAST_READ_4:
     case DOR_4:
     case QOR_4:
         return 1;
     case DIOR:
-    case FAST_READ_4:
     case DIOR_4:
         return 2;
     case QIOR:
-- 
2.20.1

arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length
patches, which are somewhere between a bugfix and a new feature.

thanks
-- PMM

The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727

for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:

hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/smmuv3: Check 31st bit to see if CD is valid
 * qemu-options.hx: Fix formatting of -machine memory-backend option
 * hw: aspeed_gpio: Fix memory size
 * hw/arm/nseries: Display hexadecimal value with '0x' prefix
 * Add sve-default-vector-length cpu property
 * docs: Update path that mentions deprecated.rst
 * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
 * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
 * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
 * target/arm: Report M-profile alignment faults correctly to the guest
 * target/arm: Add missing 'return's after calling v7m_exception_taken()
 * target/arm: Enforce that M-profile SP low 2 bits are always zero

----------------------------------------------------------------
Joe Komlodi (1):
      hw/arm/smmuv3: Check 31st bit to see if CD is valid

Joel Stanley (1):
      hw: aspeed_gpio: Fix memory size

Mao Zhongyi (1):
      docs: Update path that mentions deprecated.rst

Peter Maydell (7):
      qemu-options.hx: Fix formatting of -machine memory-backend option
      target/arm: Enforce that M-profile SP low 2 bits are always zero
      target/arm: Add missing 'return's after calling v7m_exception_taken()
      target/arm: Report M-profile alignment faults correctly to the guest
      hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
      hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
      hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS

Philippe Mathieu-Daudé (1):
      hw/arm/nseries: Display hexadecimal value with '0x' prefix

Richard Henderson (3):
      target/arm: Correctly bound length in sve_zcr_get_valid_len
      target/arm: Export aarch64_sve_zcr_get_valid_len
      target/arm: Add sve-default-vector-length cpu property

The documentation of the -machine memory-backend has some minor
formatting errors:
 * Misindentation of the initial line meant that the whole option
   section is incorrectly indented in the HTML output compared to
   the other -machine options
 * The examples weren't indented, which meant that they were formatted
   as plain run-on text including outputting the "::" as text.
 * The a) b) list has no rst-format markup so it is rendered as
   a single run-on paragraph

Fix the formatting.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20210719105257.3599-1-peter.maydell@linaro.org
---
 qemu-options.hx | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
         Enables or disables ACPI Heterogeneous Memory Attribute Table
         (HMAT) support. The default is off.
 
-     ``memory-backend='id'``
+    ``memory-backend='id'``
         An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.
         Allows to use a memory backend as main RAM.
 
         For example:
         ::
-        -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
-        -machine memory-backend=pc.ram
-        -m 512M
+
+            -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
+            -machine memory-backend=pc.ram
+            -m 512M
 
         Migration compatibility note:
-        a) as backend id one shall use value of 'default-ram-id', advertised by
-        machine type (available via ``query-machines`` QMP command), if migration
-        to/from old QEMU (<5.0) is expected.
-        b) for machine types 4.0 and older, user shall
-        use ``x-use-canonical-path-for-ramblock-id=off`` backend option
-        if migration to/from old QEMU (<5.0) is expected.
+
+        * as backend id one shall use value of 'default-ram-id', advertised by
+          machine type (available via ``query-machines`` QMP command), if migration
+          to/from old QEMU (<5.0) is expected.
+        * for machine types 4.0 and older, user shall
+          use ``x-use-canonical-path-for-ramblock-id=off`` backend option
+          if migration to/from old QEMU (<5.0) is expected.
+
         For example:
         ::
-        -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
-        -machine memory-backend=pc.ram
-        -m 512M
+
+            -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
+            -machine memory-backend=pc.ram
+            -m 512M
 ERST
 
 HXCOMM Deprecated by -machine
-- 
2.20.1

For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
RES0H, which is to say that they must be hardwired to zero so that
guest attempts to write non-zero values to them are ignored.

Implement this behaviour by masking out the low bits:
 * for writes to r13 by the gdbstub
 * for writes to any of the various flavours of SP via MSR
 * for writes to r13 via store_reg() in generated code

Note that all the direct uses of cpu_R[] in translate.c are in places
where the register is definitely not r13 (usually because that has
been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
UNDEF).

All the other writes to regs[13] in C code are either:
 * A-profile only code
 * writes of values we can guarantee to be aligned, such as
   - writes of previous-SP-value plus or minus a 4-aligned constant
   - writes of the value in an SP limit register (which we already
     enforce to be aligned)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
---
 target/arm/gdbstub.c   |  4 ++++
 target/arm/m_helper.c  | 14 ++++++++------
 target/arm/translate.c |  3 +++
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 
     if (n < 16) {
         /* Core integer register.  */
+        if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
+            /* M profile SP low bits are always 0 */
+            tmp &= ~3;
+        }
         env->regs[n] = tmp;
         return 4;
     }
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
             if (!env->v7m.secure) {
                 return;
             }
-            env->v7m.other_ss_msp = val;
+            env->v7m.other_ss_msp = val & ~3;
             return;
         case 0x89: /* PSP_NS */
             if (!env->v7m.secure) {
                 return;
             }
-            env->v7m.other_ss_psp = val;
+            env->v7m.other_ss_psp = val & ~3;
             return;
         case 0x8a: /* MSPLIM_NS */
             if (!env->v7m.secure) {
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
 
             limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
 
+            val &= ~0x3;
+
             if (val < limit) {
                 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
             }
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
         break;
     case 8: /* MSP */
         if (v7m_using_psp(env)) {
-            env->v7m.other_sp = val;
+            env->v7m.other_sp = val & ~3;
         } else {
-            env->regs[13] = val;
+            env->regs[13] = val & ~3;
         }
         break;
     case 9: /* PSP */
         if (v7m_using_psp(env)) {
-            env->regs[13] = val;
+            env->regs[13] = val & ~3;
         } else {
-            env->v7m.other_sp = val;
+            env->v7m.other_sp = val & ~3;
         }
         break;
     case 10: /* MSPLIM */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
          */
         tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
         s->base.is_jmp = DISAS_JUMP;
+    } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
+        /* For M-profile SP bits [1:0] are always zero */
+        tcg_gen_andi_i32(var, var, ~3);
     }
     tcg_gen_mov_i32(cpu_R[reg], var);
     tcg_temp_free_i32(var);
-- 
2.20.1

In do_v7m_exception_exit(), we perform various checks as part of
performing the exception return.  If one of these checks fails, the
architecture requires that we take an appropriate exception on the
existing stackframe.  We implement this by calling
v7m_exception_taken() to set up to take the new exception, and then
immediately returning from do_v7m_exception_exit() without proceeding
any further with the unstack-and-exception-return process.

In a couple of checks that are new in v8.1M, we forgot the "return"
statement, with the effect that if bad code in the guest tripped over
these checks we would set up to take a UsageFault exception but then
blunder on trying to also unstack and return from the original
exception, with the probable result that the guest would crash.

Add the missing return statements.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-3-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                         "stackframe: NSACR prevents clearing FPU registers\n");
                     v7m_exception_taken(cpu, excret, true, false);
+                    return;
                 } else if (!cpacr_pass) {
                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
                                             exc_secure);
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                         "stackframe: CPACR prevents clearing FPU registers\n");
                     v7m_exception_taken(cpu, excret, true, false);
+                    return;
                 }
             }
             /* Clear s0..s15, FPSCR and VPR */
-- 
2.20.1

For M-profile, we weren't reporting alignment faults triggered by the
generic TCG code correctly to the guest.  These get passed into
arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile
style exception.fsr value of 1.  We didn't check for this, and so
they fell through into the default of "assume this is an MPU fault"
and were reported to the guest as a data access violation MPU fault.

Report these alignment faults as UsageFaults which set the UNALIGNED
bit in the UFSR.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-4-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
         break;
     case EXCP_UNALIGNED:
+        /* Unaligned faults reported by M-profile aware code */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
         break;
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
             }
             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
             break;
+        case 0x1: /* Alignment fault reported by generic code */
+            qemu_log_mask(CPU_LOG_INT,
+                          "...really UsageFault with UFSR.UNALIGNED\n");
+            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                    env->v7m.secure);
+            break;
         default:
             /*
              * All other FSR values are either MPU faults or "can't happen
-- 
2.20.1

The ISCR.ISRPENDING bit is set when an external interrupt is pending.
This is true whether that external interrupt is enabled or not.
This means that we can't use 's->vectpending == 0' as a shortcut to
"ISRPENDING is zero", because s->vectpending indicates only the
highest priority pending enabled interrupt.

Remove the incorrect optimization so that if there is no pending
enabled interrupt we fall through to scanning through the whole
interrupt array.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)
 {
     int irq;
 
-    /* We can shortcut if the highest priority pending interrupt
-     * happens to be external or if there is nothing pending.
+    /*
+     * We can shortcut if the highest priority pending interrupt
+     * happens to be external; if not we need to check the whole
+     * vectors[] array.
      */
     if (s->vectpending > NVIC_FIRST_IRQ) {
         return true;
     }
-    if (s->vectpending == 0) {
-        return false;
-    }
 
     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
         if (s->vectors[irq].pending) {
-- 
2.20.1

The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of
the register.  We were incorrectly masking it to 8 bits, so it would
report the wrong value if the pending exception was greater than 256.
Fix the bug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         /* VECTACTIVE */
         val = cpu->env.v7m.exception;
         /* VECTPENDING */
-        val |= (s->vectpending & 0xff) << 12;
+        val |= (s->vectpending & 0x1ff) << 12;
         /* ISRPENDING - set if any external IRQ is pending */
         if (nvic_isrpending(s)) {
             val |= (1 << 22);
-- 
2.20.1

In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if
the register is accessed NonSecure and the highest priority pending
enabled exception (that would be returned in the VECTPENDING field)
targets Secure, then the VECTPENDING field must read 1 rather than
the exception number of the pending exception. Implement this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
     nvic_irq_update(s);
 }
 
+static bool vectpending_targets_secure(NVICState *s)
+{
+    /* Return true if s->vectpending targets Secure state */
+    if (s->vectpending_is_s_banked) {
+        return true;
+    }
+    return !exc_is_banked(s->vectpending) &&
+        exc_targets_secure(s, s->vectpending);
+}
+
 void armv7m_nvic_get_pending_irq_info(void *opaque,
                                       int *pirq, bool *ptargets_secure)
 {
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
 
     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
 
-    if (s->vectpending_is_s_banked) {
-        targets_secure = true;
-    } else {
-        targets_secure = !exc_is_banked(pending) &&
-            exc_targets_secure(s, pending);
-    }
+    targets_secure = vectpending_targets_secure(s);
 
     trace_nvic_get_pending_irq_info(pending, targets_secure);
 
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         /* VECTACTIVE */
         val = cpu->env.v7m.exception;
         /* VECTPENDING */
-        val |= (s->vectpending & 0x1ff) << 12;
+        if (s->vectpending) {
+            /*
+             * From v8.1M VECTPENDING must read as 1 if accessed as
+             * NonSecure and the highest priority pending and enabled
+             * exception targets Secure.
+             */
+            int vp = s->vectpending;
+            if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) &&
+                vectpending_targets_secure(s)) {
+                vp = 1;
+            }
+            val |= (vp & 0x1ff) << 12;
+        }
         /* ISRPENDING - set if any external IRQ is pending */
         if (nvic_isrpending(s)) {
             val |= (1 << 22);
-- 
2.20.1

From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>

Missed in commit f3478392 "docs: Move deprecation, build
and license info out of system/"

Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure         | 2 +-
 target/i386/cpu.c | 2 +-
 MAINTAINERS       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ fi
 
 if test -n "${deprecated_features}"; then
     echo "Warning, deprecated features enabled."
-    echo "Please see docs/system/deprecated.rst"
+    echo "Please see docs/about/deprecated.rst"
     echo "  features: ${deprecated_features}"
 fi
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = {
  * none", but this is just for compatibility while libvirt isn't
  * adapted to resolve CPU model versions before creating VMs.
  * See "Runnability guarantee of CPU models" at
- * docs/system/deprecated.rst.
+ * docs/about/deprecated.rst.
  */
 X86CPUVersion default_cpu_version = 1;
 
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/*
 
 Incompatible changes
 R: libvir-list@redhat.com
-F: docs/system/deprecated.rst
+F: docs/about/deprecated.rst
 
 Build System
 ------------
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Currently, our only caller is sve_zcr_len_for_el, which has
already masked the length extracted from ZCR_ELx, so the
masking done here is a nop.  But we will shortly have uses
from other locations, where the length will be unmasked.

Saturate the length to ARM_MAX_VQ instead of truncating to
the low 4 bits.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 {
     uint32_t end_len;
 
-    end_len = start_len &= 0xf;
+    start_len = MIN(start_len, ARM_MAX_VQ - 1);
+    end_len = start_len;
+
     if (!test_bit(start_len, cpu->sve_vq_map)) {
         end_len = find_last_bit(cpu->sve_vq_map, start_len);
         assert(end_len < start_len);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename from sve_zcr_get_valid_len and make accessible
from outside of helper.c.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    |  4 ++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void);
 void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
 #endif /* CONFIG_TCG */
 
+/**
+ * aarch64_sve_zcr_get_valid_len:
+ * @cpu: cpu context
+ * @start_len: maximum len to consider
+ *
+ * Return the maximum supported sve vector length <= @start_len.
+ * Note that both @start_len and the return value are in units
+ * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
+ */
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
 
 enum arm_fprounding {
     FPROUNDING_TIEEVEN,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
     return 0;
 }
 
-static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 {
     uint32_t end_len;
 
@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
     }
 
-    return sve_zcr_get_valid_len(cpu, zcr_len);
+    return aarch64_sve_zcr_get_valid_len(cpu, zcr_len);
 }
 
 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Mirror the behavour of /proc/sys/abi/sve_default_vector_length
under the real linux kernel.  We have no way of passing along
a real default across exec like the kernel can, but this is a
decent way of adjusting the startup vector length of a process.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-4-richard.henderson@linaro.org
[PMM: tweaked docs formatting, document -1 special-case,
 added fixup patch from RTH mentioning QEMU's maximum veclen.]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst | 15 ++++++++
 target/arm/cpu.h                 |  5 +++
 target/arm/cpu.c                 | 14 ++++++--
 target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++
 4 files changed, 92 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
 lengths is to explicitly enable each desired length.  Therefore only
 example's (1), (4), and (6) exhibit recommended uses of the properties.
 
+SVE User-mode Default Vector Length Property
+--------------------------------------------
+
+For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is
+defined to mirror the Linux kernel parameter file
+``/proc/sys/abi/sve_default_vector_length``.  The default length, ``N``,
+is in units of bytes and must be between 16 and 8192.
+If not specified, the default vector length is 64.
+
+If the default length is larger than the maximum vector length enabled,
+the actual vector length will be reduced.  Note that the maximum vector
+length supported by QEMU is 256.
+
+If this property is set to ``-1`` then the default vector length
+is set to the maximum possible length.
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     /* Used to set the maximum vector length the cpu will support.  */
     uint32_t sve_max_vq;
 
+#ifdef CONFIG_USER_ONLY
+    /* Used to set the default vector length at process start. */
+    uint32_t sve_default_vq;
+#endif
+
     /*
      * In sve_vq_map each set bit is a supported vector length of
      * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
         /* with reasonable vector length */
         if (cpu_isar_feature(aa64_sve, cpu)) {
-            env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3);
+            env->vfp.zcr_el[1] =
+                aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
         }
         /*
          * Enable TBI0 but not TBI1.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
     QLIST_INIT(&cpu->pre_el_change_hooks);
     QLIST_INIT(&cpu->el_change_hooks);
 
-#ifndef CONFIG_USER_ONLY
+#ifdef CONFIG_USER_ONLY
+# ifdef TARGET_AARCH64
+    /*
+     * The linux kernel defaults to 512-bit vectors, when sve is supported.
+     * See documentation for /proc/sys/abi/sve_default_vector_length, and
+     * our corresponding sve-default-vector-length cpu property.
+     */
+    cpu->sve_default_vq = 4;
+# endif
+#else
     /* Our inbound IRQ and FIQ lines */
     if (kvm_enabled()) {
         /* VIRQ and VFIQ are unused with KVM but we add them to maintain
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
     cpu->isar.id_aa64pfr0 = t;
 }
 
+#ifdef CONFIG_USER_ONLY
+/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
+                                            const char *name, void *opaque,
+                                            Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    int32_t default_len, default_vq, remainder;
+
+    if (!visit_type_int32(v, name, &default_len, errp)) {
+        return;
+    }
+
+    /* Undocumented, but the kernel allows -1 to indicate "maximum". */
+    if (default_len == -1) {
+        cpu->sve_default_vq = ARM_MAX_VQ;
+        return;
+    }
+
+    default_vq = default_len / 16;
+    remainder = default_len % 16;
+
+    /*
+     * Note that the 512 max comes from include/uapi/asm/sve_context.h
+     * and is the maximum architectural width of ZCR_ELx.LEN.
+     */
+    if (remainder || default_vq < 1 || default_vq > 512) {
+        error_setg(errp, "cannot set sve-default-vector-length");
+        if (remainder) {
+            error_append_hint(errp, "Vector length not a multiple of 16\n");
+        } else if (default_vq < 1) {
+            error_append_hint(errp, "Vector length smaller than 16\n");
+        } else {
+            error_append_hint(errp, "Vector length larger than %d\n",
+                              512 * 16);
+        }
+        return;
+    }
+
+    cpu->sve_default_vq = default_vq;
+}
+
+static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
+                                            const char *name, void *opaque,
+                                            Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    int32_t value = cpu->sve_default_vq * 16;
+
+    visit_type_int32(v, name, &value, errp);
+}
+#endif
+
 void aarch64_add_sve_properties(Object *obj)
 {
     uint32_t vq;
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
         object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
                             cpu_arm_set_sve_vq, NULL, NULL);
     }
+
+#ifdef CONFIG_USER_ONLY
+    /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+    object_property_add(obj, "sve-default-vector-length", "int32",
+                        cpu_arm_get_sve_default_vec_len,
+                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
+#endif
 }
 
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

The macro used to calculate the maximum memory size of the MMIO region
had a mistake, causing all GPIO models to create a mapping of 0x9D8.
The intent was to have it be 0x9D8 - 0x800.

This extra size doesn't matter on ast2400 and ast2500, which have a 4KB
region set aside for the GPIO controller.

On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the
regions would overlap. Worse was the 1.8V controller would map over the
top of the following peripheral, which happens to be the RTC.

The mmio region used by each device is a maximum of 2KB, so avoid the
calculations and hard code this as the maximum.

Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20210713065854.134634-2-joel@jms.id.au
[PMM: fix autocorrect error in commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/aspeed_gpio.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/aspeed_gpio.c
+++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@
 #define GPIO_1_8V_MEM_SIZE            0x9D8
 #define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
                                       GPIO_1_8V_REG_OFFSET) >> 2)
-#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
 
 static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
 {
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
-            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
+            TYPE_ASPEED_GPIO, 0x800);
 
     sysbus_init_mmio(sbd, &s->iomem);
 }
-- 
2.20.1