Merge tag 'hw-misc-20260707' of https://github.com/philmd/qemu into staging

Misc HW patches

- MAINTAINERS update
- Fix in few trace event formats
- A pair of improvements in util/
- FlexCAN3 to imx8mp-evk board
- Various fixes in hw/
  (EDU, ATI VGA, IDE AHCI, PCA9552, i8257 DMA,
   e1000e/igb, MPT SAS, Hyper-V, QXL, M25P80)

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmpNF0gACgkQ4+MsLN6t
# wN6BORAAkX+wrvd33O5PJKShMvQeMFBKqKm1dBz6xT4thGDFXu6G58O9VLZEIkRl
# BX2duMwVrkkOGdXZyZ/2usYeGTz7PY2XxPPFcvr1EJ+f07988P/9QKfTYbbj/e9N
# 5CaiiXQCKX3FF+pXR11cKIt2Fe8Rj6F511s3sgU3bQRub44zDaV5tGR4rwvpgFfg
# FC4PYpmEJx9R+avSaZ8PABY5yOJuhorx7OIrSHqK+9Mc0V8KjVwtEveiW+5uH5rj
# q8SmmA9keWMZ6T4GajvqUjJUg7nq6u0fmw+lqaUozdkvczeD8c9UHUrfkcKRqRHm
# i4ujgVLFP0mRCIQKGvL1ASDsHQw7BcK8aNLdPBid1MFfmUKRIcaXvr0a+iap2eWS
# ozIliBHnkGxao+GexoJRyEUHYjy1fx9r94C+n/OVnzO7w2g2ba2Q8TeQIcEBfdtS
# pvNl+R6yHaCkv2EKRSmf4rzKcwjl35Jnc+H77+dfQ5vWEY/newyCFFkKFCZdVJ1j
# DEakYvZ3XlUNYviAmYPax0l6W+4VG/3cL14SmUShcTAHenCDGRnLUZY2EoQvUE4z
# 32ihTONNNdB8sl3Xn+oCTqME8hjUJEa4MXrB7X8jG7DSVlAAKSneDPyNVee7f2ox
# +uJ0I7dVVPkQ6ca02DEQXnPN2sm/vvDRA6v9k/m7WE8WSN3RUS4=
# =pe1W
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 07 Jul 2026 17:12:08 CEST
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" [full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'hw-misc-20260707' of https://github.com/philmd/qemu: (36 commits)
  MAINTAINERS: update Chao Liu's email address
  Revert "aspeed/smc: snoop SPI transfers to fake dummy cycles"
  Revert "aspeed/smc: Fix number of dummy cycles for FAST_READ_4 command"
  hw/ssi: aspeed_smc: Fix direct-read dummy bytes
  hw/ssi: xilinx_spips: Fix dummy phase handling
  hw/ssi: npcm7xx_fiu: Correct the dummy cycle emulation logic
  hw/block: m25p80: Fix dummy byte handling for Spansion flash
  hw/arm/msf2-som: Fix spansion-cr2nv value for S25FL128S
  hw/block: m25p80: Fix dummy byte handling for Macronix flash
  hw/block: m25p80: Fix dummy byte handling for Numonyx/Micron flash
  hw/block: m25p80: Fix dummy byte handling for Winbond flash
  backends/iommufd: Fix dev_id and type order in viommu trace
  hw/acpi/ich9: move initial property values into ich9_reset_properties()
  hw/rtc/mc146818rtc: convert date from object prop to class prop
  hw/arm: Add basic FlexCAN3 support to TYPE_FSL_IMX8MP and imx8mp-evk
  hw/arm/imx8mp-evk: Introduce FslImx8mpEvkState
  hw/arm/imx8mp-evk: Open code DEFINE_MACHINE_AARCH64
  hw/net/can/flexcan: Subclass TYPE_CAN_FLEXCAN
  hw/net/can/flexcan: Wire clock control module via link property
  hw/intc/loongarch_dintc: Fix OOB access in DINT MMIO write handler
  ...

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

include/hw/acpi/ich9.h

@@ -81,6 +81,8 @@ void ich9_pm_init(PCIDevice *lpc_pci, ICH9LPCPMRegs *pm, qemu_irq sci_irq);
 void ich9_pm_iospace_update(ICH9LPCPMRegs *pm, uint32_t pm_io_base);
 extern const VMStateDescription vmstate_ich9_pm;
 
+void ich9_pm_reset_properties(ICH9LPCPMRegs *pm);
+
 void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm);
 
 void ich9_pm_device_pre_plug_cb(HotplugHandler *hotplug_dev, DeviceState *dev,

include/hw/arm/fsl-imx8mp.h

@@ -17,6 +17,7 @@
 #include "hw/misc/imx7_snvs.h"
 #include "hw/misc/imx8mp_analog.h"
 #include "hw/misc/imx8mp_ccm.h"
+#include "hw/net/flexcan.h"
 #include "hw/net/imx_fec.h"
 #include "hw/core/or-irq.h"
 #include "hw/pci-host/designware.h"
@@ -37,6 +38,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(FslImx8mpState, FSL_IMX8MP)
 #define FSL_IMX8MP_RAM_SIZE_MAX     (8 * GiB)
 
 enum FslImx8mpConfiguration {
+    FSL_IMX8MP_NUM_CANS         = 2,
     FSL_IMX8MP_NUM_CPUS         = 4,
     FSL_IMX8MP_NUM_ECSPIS       = 3,
     FSL_IMX8MP_NUM_GPIOS        = 5,
@@ -68,11 +70,14 @@ struct FslImx8mpState {
     USBDWC3            usb[FSL_IMX8MP_NUM_USBS];
     DesignwarePCIEHost pcie;
     FslImx8mPciePhyState   pcie_phy;
+    FlexcanState       flexcan[FSL_IMX8MP_NUM_CANS];
     OrIRQState         gpt5_gpt6_irq;
     MemoryRegion       ocram;
 
     uint32_t           phy_num;
     bool               phy_connected;
+
+    CanBusState       *canbus[FSL_IMX8MP_NUM_CANS];
 };
 
 enum FslImx8mpMemoryRegions {
@@ -279,6 +284,9 @@ enum FslImx8mpIrqs {
     FSL_IMX8MP_PCI_INTC_IRQ = 124,
     FSL_IMX8MP_PCI_INTD_IRQ = 123,
     FSL_IMX8MP_PCI_MSI_IRQ  = 140,
+
+    FSL_IMX8MP_FLEXCAN1_IRQ  = 142,
+    FSL_IMX8MP_FLEXCAN2_IRQ  = 144,
 };
 
 #endif /* FSL_IMX8MP_H */

include/hw/net/flexcan.h

@@ -139,7 +139,9 @@ typedef struct FlexcanState {
 } FlexcanState;
 
 #define TYPE_CAN_FLEXCAN "flexcan"
-
 OBJECT_DECLARE_SIMPLE_TYPE(FlexcanState, CAN_FLEXCAN);
 
+#define TYPE_CAN_FLEXCAN2 "flexcan2"
+#define TYPE_CAN_FLEXCAN3 "flexcan3"
+
 #endif

include/hw/ssi/aspeed_smc.h

@@ -80,8 +80,6 @@ struct AspeedSMCState {
 
     AspeedSMCFlash flashes[ASPEED_SMC_CS_MAX];
 
-    uint8_t snoop_index;
-    uint8_t snoop_dummies;
     bool unselect;
 };
 

include/hw/ssi/xilinx_spips.h

@@ -69,7 +69,7 @@ struct XilinxSPIPS {
     uint8_t num_busses;
 
     uint8_t snoop_state;
-    int cmd_dummies;
+    int cmd_dummy_bytes;
     uint8_t link_state;
     uint8_t link_state_next;
     uint8_t link_state_next_when;