Merge remote-tracking branch 'remotes/cminyard/tags/for-qemu-6.1-2' into staging

Some qemu updates for IPMI and I2C

Move some ADC file to where they belong and move some sensors to a
sensor directory, since with new BMCs coming in lots of different
sensors should be coming in.  Keep from cluttering things up.

Add support for I2C PMBus devices.

Replace the confusing and error-prone i2c_send_recv and i2c_transfer with
specific send and receive functions.  Several errors have already been
made with these, avoid any new errors.

Fix the watchdog_expired field in the IPMI watchdog, it's not a bool,
it's a u8.  After a vmstate transfer, the new value could be wrong.

# gpg: Signature made Fri 09 Jul 2021 17:25:04 BST
# gpg:                using RSA key FD0D5CE67CE0F59A6688268661F38C90919BFF81
# gpg: Good signature from "Corey Minyard <cminyard@mvista.com>" [unknown]
# gpg:                 aka "Corey Minyard <minyard@acm.org>" [unknown]
# gpg:                 aka "Corey Minyard <corey@minyard.net>" [unknown]
# gpg:                 aka "Corey Minyard <minyard@mvista.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: FD0D 5CE6 7CE0 F59A 6688  2686 61F3 8C90 919B FF81

* remotes/cminyard/tags/for-qemu-6.1-2: (24 commits)
  tests/qtest: add tests for MAX34451 device model
  hw/misc: add MAX34451 device
  tests/qtest: add tests for ADM1272 device model
  hw/misc: add ADM1272 device
  hw/i2c: add support for PMBus
  ipmi/sim: fix watchdog_expired data type error in IPMIBmcSim struct
  hw/i2c: Introduce i2c_start_recv() and i2c_start_send()
  hw/i2c: Extract i2c_do_start_transfer() from i2c_start_transfer()
  hw/i2c: Make i2c_start_transfer() direction argument a boolean
  hw/i2c: Rename i2c_set_slave_address() -> i2c_slave_set_address()
  hw/i2c: Remove confusing i2c_send_recv()
  hw/misc/auxbus: Replace i2c_send_recv() by i2c_recv() & i2c_send()
  hw/misc/auxbus: Replace 'is_write' boolean by its value
  hw/misc/auxbus: Explode READ_I2C / WRITE_I2C_MOT cases
  hw/misc/auxbus: Fix MOT/classic I2C mode
  hw/i2c/ppc4xx_i2c: Replace i2c_send_recv() by i2c_recv() & i2c_send()
  hw/i2c/ppc4xx_i2c: Add reference to datasheet
  hw/display/sm501: Replace i2c_send_recv() by i2c_recv() & i2c_send()
  hw/display/sm501: Simplify sm501_i2c_write() logic
  hw/input/lm832x: Define TYPE_LM8323 in public header
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

9 files changed, 52 insertions, 1678 deletions

diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index c71ed25820..507058d8bf 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -11,21 +11,6 @@ config ARMSSE_MHU
 config ARMSSE_CPU_PWRCTRL
     bool
 
-config MAX111X
-    bool
-
-config TMP105
-    bool
-    depends on I2C
-
-config TMP421
-    bool
-    depends on I2C
-
-config EMC141X
-    bool
-    depends on I2C
-
 config ISA_DEBUG
     bool
     depends on ISA_BUS
diff --git a/hw/misc/auxbus.c b/hw/misc/auxbus.c
index 6c099ae2a2..434ff8d910 100644
--- a/hw/misc/auxbus.c
+++ b/hw/misc/auxbus.c
@@ -106,7 +106,6 @@ AUXReply aux_request(AUXBus *bus, AUXCommand cmd, uint32_t address,
     AUXReply ret = AUX_NACK;
     I2CBus *i2c_bus = aux_get_i2c_bus(bus);
     size_t i;
-    bool is_write = false;
 
     DPRINTF("request at address 0x%" PRIX32 ", command %u, len %u\n", address,
             cmd, len);
@@ -117,11 +116,10 @@ AUXReply aux_request(AUXBus *bus, AUXCommand cmd, uint32_t address,
      */
     case WRITE_AUX:
     case READ_AUX:
-        is_write = cmd == READ_AUX ? false : true;
         for (i = 0; i < len; i++) {
             if (!address_space_rw(&bus->aux_addr_space, address++,
                                   MEMTXATTRS_UNSPECIFIED, data++, 1,
-                                  is_write)) {
+                                  cmd == WRITE_AUX)) {
                 ret = AUX_I2C_ACK;
             } else {
                 ret = AUX_NACK;
@@ -133,24 +131,37 @@ AUXReply aux_request(AUXBus *bus, AUXCommand cmd, uint32_t address,
      * Classic I2C transactions..
      */
     case READ_I2C:
+        if (i2c_bus_busy(i2c_bus)) {
+            i2c_end_transfer(i2c_bus);
+        }
+
+        if (i2c_start_recv(i2c_bus, address)) {
+            ret = AUX_I2C_NACK;
+            break;
+        }
+
+        ret = AUX_I2C_ACK;
+        for (i = 0; i < len; i++) {
+            data[i] = i2c_recv(i2c_bus);
+        }
+        i2c_end_transfer(i2c_bus);
+        break;
     case WRITE_I2C:
-        is_write = cmd == READ_I2C ? false : true;
         if (i2c_bus_busy(i2c_bus)) {
             i2c_end_transfer(i2c_bus);
         }
 
-        if (i2c_start_transfer(i2c_bus, address, is_write)) {
+        if (i2c_start_send(i2c_bus, address)) {
             ret = AUX_I2C_NACK;
             break;
         }
 
         ret = AUX_I2C_ACK;
-        while (len > 0) {
-            if (i2c_send_recv(i2c_bus, data++, is_write) < 0) {
+        for (i = 0; i < len; i++) {
+            if (i2c_send(i2c_bus, data[i]) < 0) {
                 ret = AUX_I2C_NACK;
                 break;
             }
-            len--;
         }
         i2c_end_transfer(i2c_bus);
         break;
@@ -163,14 +174,12 @@ AUXReply aux_request(AUXBus *bus, AUXCommand cmd, uint32_t address,
      *  - We changed the address.
      */
     case WRITE_I2C_MOT:
-    case READ_I2C_MOT:
-        is_write = cmd == READ_I2C_MOT ? false : true;
         ret = AUX_I2C_NACK;
         if (!i2c_bus_busy(i2c_bus)) {
             /*
              * No transactions started..
              */
-            if (i2c_start_transfer(i2c_bus, address, is_write)) {
+            if (i2c_start_send(i2c_bus, address)) {
                 break;
             }
         } else if ((address != bus->last_i2c_address) ||
@@ -179,23 +188,48 @@ AUXReply aux_request(AUXBus *bus, AUXCommand cmd, uint32_t address,
              * Transaction started but we need to restart..
              */
             i2c_end_transfer(i2c_bus);
-            if (i2c_start_transfer(i2c_bus, address, is_write)) {
+            if (i2c_start_send(i2c_bus, address)) {
                 break;
             }
         }
 
         bus->last_transaction = cmd;
         bus->last_i2c_address = address;
-        while (len > 0) {
-            if (i2c_send_recv(i2c_bus, data++, is_write) < 0) {
+        ret = AUX_I2C_ACK;
+        for (i = 0; i < len; i++) {
+            if (i2c_send(i2c_bus, data[i]) < 0) {
                 i2c_end_transfer(i2c_bus);
+                ret = AUX_I2C_NACK;
                 break;
             }
-            len--;
         }
-        if (len == 0) {
-            ret = AUX_I2C_ACK;
+        break;
+    case READ_I2C_MOT:
+        ret = AUX_I2C_NACK;
+        if (!i2c_bus_busy(i2c_bus)) {
+            /*
+             * No transactions started..
+             */
+            if (i2c_start_recv(i2c_bus, address)) {
+                break;
+            }
+        } else if ((address != bus->last_i2c_address) ||
+                   (bus->last_transaction != cmd)) {
+            /*
+             * Transaction started but we need to restart..
+             */
+            i2c_end_transfer(i2c_bus);
+            if (i2c_start_recv(i2c_bus, address)) {
+                break;
+            }
+        }
+
+        bus->last_transaction = cmd;
+        bus->last_i2c_address = address;
+        for (i = 0; i < len; i++) {
+            data[i] = i2c_recv(i2c_bus);
         }
+        ret = AUX_I2C_ACK;
         break;
     default:
         qemu_log_mask(LOG_UNIMP, "AUX cmd=%u not implemented\n", cmd);
diff --git a/hw/misc/emc141x.c b/hw/misc/emc141x.c
deleted file mode 100644
index f7c53d48a4..0000000000
--- a/hw/misc/emc141x.c
+++ /dev/null
@@ -1,326 +0,0 @@
-/*
- * SMSC EMC141X temperature sensor.
- *
- * Copyright (c) 2020 Bytedance Corporation
- * Written by John Wang <wangzhiqiang.bj@bytedance.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 or
- * (at your option) version 3 of the License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "qemu/osdep.h"
-#include "hw/i2c/i2c.h"
-#include "migration/vmstate.h"
-#include "qapi/error.h"
-#include "qapi/visitor.h"
-#include "qemu/module.h"
-#include "qom/object.h"
-#include "hw/misc/emc141x_regs.h"
-
-#define SENSORS_COUNT_MAX    4
-
-struct EMC141XState {
-    I2CSlave parent_obj;
-    struct {
-        uint8_t raw_temp_min;
-        uint8_t raw_temp_current;
-        uint8_t raw_temp_max;
-    } sensor[SENSORS_COUNT_MAX];
-    uint8_t len;
-    uint8_t data;
-    uint8_t pointer;
-};
-
-struct EMC141XClass {
-    I2CSlaveClass parent_class;
-    uint8_t model;
-    unsigned sensors_count;
-};
-
-#define TYPE_EMC141X "emc141x"
-OBJECT_DECLARE_TYPE(EMC141XState, EMC141XClass, EMC141X)
-
-static void emc141x_get_temperature(Object *obj, Visitor *v, const char *name,
-                                    void *opaque, Error **errp)
-{
-    EMC141XState *s = EMC141X(obj);
-    EMC141XClass *sc = EMC141X_GET_CLASS(s);
-    int64_t value;
-    unsigned tempid;
-
-    if (sscanf(name, "temperature%u", &tempid) != 1) {
-        error_setg(errp, "error reading %s: %s", name, g_strerror(errno));
-        return;
-    }
-
-    if (tempid >= sc->sensors_count) {
-        error_setg(errp, "error reading %s", name);
-        return;
-    }
-
-    value = s->sensor[tempid].raw_temp_current * 1000;
-
-    visit_type_int(v, name, &value, errp);
-}
-
-static void emc141x_set_temperature(Object *obj, Visitor *v, const char *name,
-                                    void *opaque, Error **errp)
-{
-    EMC141XState *s = EMC141X(obj);
-    EMC141XClass *sc = EMC141X_GET_CLASS(s);
-    int64_t temp;
-    unsigned tempid;
-
-    if (!visit_type_int(v, name, &temp, errp)) {
-        return;
-    }
-
-    if (sscanf(name, "temperature%u", &tempid) != 1) {
-        error_setg(errp, "error reading %s: %s", name, g_strerror(errno));
-        return;
-    }
-
-    if (tempid >= sc->sensors_count) {
-        error_setg(errp, "error reading %s", name);
-        return;
-    }
-
-    s->sensor[tempid].raw_temp_current = temp / 1000;
-}
-
-static void emc141x_read(EMC141XState *s)
-{
-    EMC141XClass *sc = EMC141X_GET_CLASS(s);
-    switch (s->pointer) {
-    case EMC141X_DEVICE_ID:
-        s->data = sc->model;
-        break;
-    case EMC141X_MANUFACTURER_ID:
-        s->data = MANUFACTURER_ID;
-        break;
-    case EMC141X_REVISION:
-        s->data = REVISION;
-        break;
-    case EMC141X_TEMP_HIGH0:
-        s->data = s->sensor[0].raw_temp_current;
-        break;
-    case EMC141X_TEMP_HIGH1:
-        s->data = s->sensor[1].raw_temp_current;
-        break;
-    case EMC141X_TEMP_HIGH2:
-        s->data = s->sensor[2].raw_temp_current;
-        break;
-    case EMC141X_TEMP_HIGH3:
-        s->data = s->sensor[3].raw_temp_current;
-        break;
-    case EMC141X_TEMP_MAX_HIGH0:
-        s->data = s->sensor[0].raw_temp_max;
-        break;
-    case EMC141X_TEMP_MAX_HIGH1:
-        s->data = s->sensor[1].raw_temp_max;
-        break;
-    case EMC141X_TEMP_MAX_HIGH2:
-        s->data = s->sensor[2].raw_temp_max;
-        break;
-    case EMC141X_TEMP_MAX_HIGH3:
-        s->data = s->sensor[3].raw_temp_max;
-        break;
-    case EMC141X_TEMP_MIN_HIGH0:
-        s->data = s->sensor[0].raw_temp_min;
-        break;
-    case EMC141X_TEMP_MIN_HIGH1:
-        s->data = s->sensor[1].raw_temp_min;
-        break;
-    case EMC141X_TEMP_MIN_HIGH2:
-        s->data = s->sensor[2].raw_temp_min;
-        break;
-    case EMC141X_TEMP_MIN_HIGH3:
-        s->data = s->sensor[3].raw_temp_min;
-        break;
-    default:
-        s->data = 0;
-    }
-}
-
-static void emc141x_write(EMC141XState *s)
-{
-    switch (s->pointer) {
-    case EMC141X_TEMP_MAX_HIGH0:
-        s->sensor[0].raw_temp_max = s->data;
-        break;
-    case EMC141X_TEMP_MAX_HIGH1:
-        s->sensor[1].raw_temp_max = s->data;
-        break;
-    case EMC141X_TEMP_MAX_HIGH2:
-        s->sensor[2].raw_temp_max = s->data;
-        break;
-    case EMC141X_TEMP_MAX_HIGH3:
-        s->sensor[3].raw_temp_max = s->data;
-        break;
-    case EMC141X_TEMP_MIN_HIGH0:
-        s->sensor[0].raw_temp_min = s->data;
-        break;
-    case EMC141X_TEMP_MIN_HIGH1:
-        s->sensor[1].raw_temp_min = s->data;
-        break;
-    case EMC141X_TEMP_MIN_HIGH2:
-        s->sensor[2].raw_temp_min = s->data;
-        break;
-    case EMC141X_TEMP_MIN_HIGH3:
-        s->sensor[3].raw_temp_min = s->data;
-        break;
-    default:
-        s->data = 0;
-    }
-}
-
-static uint8_t emc141x_rx(I2CSlave *i2c)
-{
-    EMC141XState *s = EMC141X(i2c);
-
-    if (s->len == 0) {
-        s->len++;
-        return s->data;
-    } else {
-        return 0xff;
-    }
-}
-
-static int emc141x_tx(I2CSlave *i2c, uint8_t data)
-{
-    EMC141XState *s = EMC141X(i2c);
-
-    if (s->len == 0) {
-        /* first byte is the reg pointer */
-        s->pointer = data;
-        s->len++;
-    } else if (s->len == 1) {
-        s->data = data;
-        emc141x_write(s);
-    }
-
-    return 0;
-}
-
-static int emc141x_event(I2CSlave *i2c, enum i2c_event event)
-{
-    EMC141XState *s = EMC141X(i2c);
-
-    if (event == I2C_START_RECV) {
-        emc141x_read(s);
-    }
-
-    s->len = 0;
-    return 0;
-}
-
-static const VMStateDescription vmstate_emc141x = {
-    .name = "EMC141X",
-    .version_id = 0,
-    .minimum_version_id = 0,
-    .fields = (VMStateField[]) {
-        VMSTATE_UINT8(len, EMC141XState),
-        VMSTATE_UINT8(data, EMC141XState),
-        VMSTATE_UINT8(pointer, EMC141XState),
-        VMSTATE_I2C_SLAVE(parent_obj, EMC141XState),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-static void emc141x_reset(DeviceState *dev)
-{
-    EMC141XState *s = EMC141X(dev);
-    int i;
-
-    for (i = 0; i < SENSORS_COUNT_MAX; i++) {
-        s->sensor[i].raw_temp_max = 0x55;
-    }
-    s->pointer = 0;
-    s->len = 0;
-}
-
-static void emc141x_initfn(Object *obj)
-{
-    object_property_add(obj, "temperature0", "int",
-                        emc141x_get_temperature,
-                        emc141x_set_temperature, NULL, NULL);
-    object_property_add(obj, "temperature1", "int",
-                        emc141x_get_temperature,
-                        emc141x_set_temperature, NULL, NULL);
-    object_property_add(obj, "temperature2", "int",
-                        emc141x_get_temperature,
-                        emc141x_set_temperature, NULL, NULL);
-    object_property_add(obj, "temperature3", "int",
-                        emc141x_get_temperature,
-                        emc141x_set_temperature, NULL, NULL);
-}
-
-static void emc141x_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
-
-    dc->reset = emc141x_reset;
-    k->event = emc141x_event;
-    k->recv = emc141x_rx;
-    k->send = emc141x_tx;
-    dc->vmsd = &vmstate_emc141x;
-}
-
-static void emc1413_class_init(ObjectClass *klass, void *data)
-{
-    EMC141XClass *ec = EMC141X_CLASS(klass);
-
-    emc141x_class_init(klass, data);
-    ec->model = EMC1413_DEVICE_ID;
-    ec->sensors_count = 3;
-}
-
-static void emc1414_class_init(ObjectClass *klass, void *data)
-{
-    EMC141XClass *ec = EMC141X_CLASS(klass);
-
-    emc141x_class_init(klass, data);
-    ec->model = EMC1414_DEVICE_ID;
-    ec->sensors_count = 4;
-}
-
-static const TypeInfo emc141x_info = {
-    .name          = TYPE_EMC141X,
-    .parent        = TYPE_I2C_SLAVE,
-    .instance_size = sizeof(EMC141XState),
-    .class_size    = sizeof(EMC141XClass),
-    .instance_init = emc141x_initfn,
-    .abstract      = true,
-};
-
-static const TypeInfo emc1413_info = {
-    .name          = "emc1413",
-    .parent        = TYPE_EMC141X,
-    .class_init    = emc1413_class_init,
-};
-
-static const TypeInfo emc1414_info = {
-    .name          = "emc1414",
-    .parent        = TYPE_EMC141X,
-    .class_init    = emc1414_class_init,
-};
-
-static void emc141x_register_types(void)
-{
-    type_register_static(&emc141x_info);
-    type_register_static(&emc1413_info);
-    type_register_static(&emc1414_info);
-}
-
-type_init(emc141x_register_types)
diff --git a/hw/misc/max111x.c b/hw/misc/max111x.c
deleted file mode 100644
index 1b3234a519..0000000000
--- a/hw/misc/max111x.c
+++ /dev/null
@@ -1,236 +0,0 @@
-/*
- * Maxim MAX1110/1111 ADC chip emulation.
- *
- * Copyright (c) 2006 Openedhand Ltd.
- * Written by Andrzej Zaborowski <balrog@zabor.org>
- *
- * This code is licensed under the GNU GPLv2.
- *
- * Contributions after 2012-01-13 are licensed under the terms of the
- * GNU GPL, version 2 or (at your option) any later version.
- */
-
-#include "qemu/osdep.h"
-#include "hw/misc/max111x.h"
-#include "hw/irq.h"
-#include "migration/vmstate.h"
-#include "qemu/module.h"
-#include "hw/qdev-properties.h"
-
-/* Control-byte bitfields */
-#define CB_PD0		(1 << 0)
-#define CB_PD1		(1 << 1)
-#define CB_SGL		(1 << 2)
-#define CB_UNI		(1 << 3)
-#define CB_SEL0		(1 << 4)
-#define CB_SEL1		(1 << 5)
-#define CB_SEL2		(1 << 6)
-#define CB_START	(1 << 7)
-
-#define CHANNEL_NUM(v, b0, b1, b2)	\
-                        ((((v) >> (2 + (b0))) & 4) |	\
-                         (((v) >> (3 + (b1))) & 2) |	\
-                         (((v) >> (4 + (b2))) & 1))
-
-static uint32_t max111x_read(MAX111xState *s)
-{
-    if (!s->tb1)
-        return 0;
-
-    switch (s->cycle ++) {
-    case 1:
-        return s->rb2;
-    case 2:
-        return s->rb3;
-    }
-
-    return 0;
-}
-
-/* Interpret a control-byte */
-static void max111x_write(MAX111xState *s, uint32_t value)
-{
-    int measure, chan;
-
-    /* Ignore the value if START bit is zero */
-    if (!(value & CB_START))
-        return;
-
-    s->cycle = 0;
-
-    if (!(value & CB_PD1)) {
-        s->tb1 = 0;
-        return;
-    }
-
-    s->tb1 = value;
-
-    if (s->inputs == 8)
-        chan = CHANNEL_NUM(value, 1, 0, 2);
-    else
-        chan = CHANNEL_NUM(value & ~CB_SEL0, 0, 1, 2);
-
-    if (value & CB_SGL)
-        measure = s->input[chan] - s->com;
-    else
-        measure = s->input[chan] - s->input[chan ^ 1];
-
-    if (!(value & CB_UNI))
-        measure ^= 0x80;
-
-    s->rb2 = (measure >> 2) & 0x3f;
-    s->rb3 = (measure << 6) & 0xc0;
-
-    /* FIXME: When should the IRQ be lowered?  */
-    qemu_irq_raise(s->interrupt);
-}
-
-static uint32_t max111x_transfer(SSIPeripheral *dev, uint32_t value)
-{
-    MAX111xState *s = MAX_111X(dev);
-    max111x_write(s, value);
-    return max111x_read(s);
-}
-
-static const VMStateDescription vmstate_max111x = {
-    .name = "max111x",
-    .version_id = 1,
-    .minimum_version_id = 1,
-    .fields = (VMStateField[]) {
-        VMSTATE_SSI_PERIPHERAL(parent_obj, MAX111xState),
-        VMSTATE_UINT8(tb1, MAX111xState),
-        VMSTATE_UINT8(rb2, MAX111xState),
-        VMSTATE_UINT8(rb3, MAX111xState),
-        VMSTATE_INT32_EQUAL(inputs, MAX111xState, NULL),
-        VMSTATE_INT32(com, MAX111xState),
-        VMSTATE_ARRAY_INT32_UNSAFE(input, MAX111xState, inputs,
-                                   vmstate_info_uint8, uint8_t),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-static void max111x_input_set(void *opaque, int line, int value)
-{
-    MAX111xState *s = MAX_111X(opaque);
-
-    assert(line >= 0 && line < s->inputs);
-    s->input[line] = value;
-}
-
-static int max111x_init(SSIPeripheral *d, int inputs)
-{
-    DeviceState *dev = DEVICE(d);
-    MAX111xState *s = MAX_111X(dev);
-
-    qdev_init_gpio_out(dev, &s->interrupt, 1);
-    qdev_init_gpio_in(dev, max111x_input_set, inputs);
-
-    s->inputs = inputs;
-
-    return 0;
-}
-
-static void max1110_realize(SSIPeripheral *dev, Error **errp)
-{
-    max111x_init(dev, 8);
-}
-
-static void max1111_realize(SSIPeripheral *dev, Error **errp)
-{
-    max111x_init(dev, 4);
-}
-
-static void max111x_reset(DeviceState *dev)
-{
-    MAX111xState *s = MAX_111X(dev);
-    int i;
-
-    for (i = 0; i < s->inputs; i++) {
-        s->input[i] = s->reset_input[i];
-    }
-    s->com = 0;
-    s->tb1 = 0;
-    s->rb2 = 0;
-    s->rb3 = 0;
-    s->cycle = 0;
-}
-
-static Property max1110_properties[] = {
-    /* Reset values for ADC inputs */
-    DEFINE_PROP_UINT8("input0", MAX111xState, reset_input[0], 0xf0),
-    DEFINE_PROP_UINT8("input1", MAX111xState, reset_input[1], 0xe0),
-    DEFINE_PROP_UINT8("input2", MAX111xState, reset_input[2], 0xd0),
-    DEFINE_PROP_UINT8("input3", MAX111xState, reset_input[3], 0xc0),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static Property max1111_properties[] = {
-    /* Reset values for ADC inputs */
-    DEFINE_PROP_UINT8("input0", MAX111xState, reset_input[0], 0xf0),
-    DEFINE_PROP_UINT8("input1", MAX111xState, reset_input[1], 0xe0),
-    DEFINE_PROP_UINT8("input2", MAX111xState, reset_input[2], 0xd0),
-    DEFINE_PROP_UINT8("input3", MAX111xState, reset_input[3], 0xc0),
-    DEFINE_PROP_UINT8("input4", MAX111xState, reset_input[4], 0xb0),
-    DEFINE_PROP_UINT8("input5", MAX111xState, reset_input[5], 0xa0),
-    DEFINE_PROP_UINT8("input6", MAX111xState, reset_input[6], 0x90),
-    DEFINE_PROP_UINT8("input7", MAX111xState, reset_input[7], 0x80),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void max111x_class_init(ObjectClass *klass, void *data)
-{
-    SSIPeripheralClass *k = SSI_PERIPHERAL_CLASS(klass);
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    k->transfer = max111x_transfer;
-    dc->reset = max111x_reset;
-    dc->vmsd = &vmstate_max111x;
-    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-}
-
-static const TypeInfo max111x_info = {
-    .name          = TYPE_MAX_111X,
-    .parent        = TYPE_SSI_PERIPHERAL,
-    .instance_size = sizeof(MAX111xState),
-    .class_init    = max111x_class_init,
-    .abstract      = true,
-};
-
-static void max1110_class_init(ObjectClass *klass, void *data)
-{
-    SSIPeripheralClass *k = SSI_PERIPHERAL_CLASS(klass);
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    k->realize = max1110_realize;
-    device_class_set_props(dc, max1110_properties);
-}
-
-static const TypeInfo max1110_info = {
-    .name          = TYPE_MAX_1110,
-    .parent        = TYPE_MAX_111X,
-    .class_init    = max1110_class_init,
-};
-
-static void max1111_class_init(ObjectClass *klass, void *data)
-{
-    SSIPeripheralClass *k = SSI_PERIPHERAL_CLASS(klass);
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    k->realize = max1111_realize;
-    device_class_set_props(dc, max1111_properties);
-}
-
-static const TypeInfo max1111_info = {
-    .name          = TYPE_MAX_1111,
-    .parent        = TYPE_MAX_111X,
-    .class_init    = max1111_class_init,
-};
-
-static void max111x_register_types(void)
-{
-    type_register_static(&max111x_info);
-    type_register_static(&max1110_info);
-    type_register_static(&max1111_info);
-}
-
-type_init(max111x_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index f89b5c1643..a53b849a5a 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -3,13 +3,9 @@ softmmu_ss.add(when: 'CONFIG_EDU', if_true: files('edu.c'))
 softmmu_ss.add(when: 'CONFIG_FW_CFG_DMA', if_true: files('vmcoreinfo.c'))
 softmmu_ss.add(when: 'CONFIG_ISA_DEBUG', if_true: files('debugexit.c'))
 softmmu_ss.add(when: 'CONFIG_ISA_TESTDEV', if_true: files('pc-testdev.c'))
-softmmu_ss.add(when: 'CONFIG_MAX111X', if_true: files('max111x.c'))
 softmmu_ss.add(when: 'CONFIG_PCA9552', if_true: files('pca9552.c'))
 softmmu_ss.add(when: 'CONFIG_PCI_TESTDEV', if_true: files('pci-testdev.c'))
 softmmu_ss.add(when: 'CONFIG_SGA', if_true: files('sga.c'))
-softmmu_ss.add(when: 'CONFIG_TMP105', if_true: files('tmp105.c'))
-softmmu_ss.add(when: 'CONFIG_TMP421', if_true: files('tmp421.c'))
-softmmu_ss.add(when: 'CONFIG_EMC141X', if_true: files('emc141x.c'))
 softmmu_ss.add(when: 'CONFIG_UNIMP', if_true: files('unimp.c'))
 softmmu_ss.add(when: 'CONFIG_EMPTY_SLOT', if_true: files('empty_slot.c'))
 softmmu_ss.add(when: 'CONFIG_LED', if_true: files('led.c'))
@@ -85,7 +81,7 @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
   'bcm2835_powermgt.c',
 ))
 softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
-softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c', 'zynq-xadc.c'))
+softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
 softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-xramc.c'))
 softmmu_ss.add(when: 'CONFIG_STM32F2XX_SYSCFG', if_true: files('stm32f2xx_syscfg.c'))
 softmmu_ss.add(when: 'CONFIG_STM32F4XX_SYSCFG', if_true: files('stm32f4xx_syscfg.c'))
diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
deleted file mode 100644
index d299d9b21b..0000000000
--- a/hw/misc/tmp105.c
+++ /dev/null
@@ -1,328 +0,0 @@
-/*
- * Texas Instruments TMP105 temperature sensor.
- *
- * Copyright (C) 2008 Nokia Corporation
- * Written by Andrzej Zaborowski <andrew@openedhand.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 or
- * (at your option) version 3 of the License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "qemu/osdep.h"
-#include "hw/i2c/i2c.h"
-#include "hw/irq.h"
-#include "migration/vmstate.h"
-#include "tmp105.h"
-#include "qapi/error.h"
-#include "qapi/visitor.h"
-#include "qemu/module.h"
-
-static void tmp105_interrupt_update(TMP105State *s)
-{
-    qemu_set_irq(s->pin, s->alarm ^ ((~s->config >> 2) & 1));	/* POL */
-}
-
-static void tmp105_alarm_update(TMP105State *s)
-{
-    if ((s->config >> 0) & 1) {					/* SD */
-        if ((s->config >> 7) & 1)				/* OS */
-            s->config &= ~(1 << 7);				/* OS */
-        else
-            return;
-    }
-
-    if (s->config >> 1 & 1) {
-        /*
-         * TM == 1 : Interrupt mode. We signal Alert when the
-         * temperature rises above T_high, and expect the guest to clear
-         * it (eg by reading a device register).
-         */
-        if (s->detect_falling) {
-            if (s->temperature < s->limit[0]) {
-                s->alarm = 1;
-                s->detect_falling = false;
-            }
-        } else {
-            if (s->temperature >= s->limit[1]) {
-                s->alarm = 1;
-                s->detect_falling = true;
-            }
-        }
-    } else {
-        /*
-         * TM == 0 : Comparator mode. We signal Alert when the temperature
-         * rises above T_high, and stop signalling it when the temperature
-         * falls below T_low.
-         */
-        if (s->detect_falling) {
-            if (s->temperature < s->limit[0]) {
-                s->alarm = 0;
-                s->detect_falling = false;
-            }
-        } else {
-            if (s->temperature >= s->limit[1]) {
-                s->alarm = 1;
-                s->detect_falling = true;
-            }
-        }
-    }
-
-    tmp105_interrupt_update(s);
-}
-
-static void tmp105_get_temperature(Object *obj, Visitor *v, const char *name,
-                                   void *opaque, Error **errp)
-{
-    TMP105State *s = TMP105(obj);
-    int64_t value = s->temperature * 1000 / 256;
-
-    visit_type_int(v, name, &value, errp);
-}
-
-/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
- * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
- */
-static void tmp105_set_temperature(Object *obj, Visitor *v, const char *name,
-                                   void *opaque, Error **errp)
-{
-    TMP105State *s = TMP105(obj);
-    int64_t temp;
-
-    if (!visit_type_int(v, name, &temp, errp)) {
-        return;
-    }
-    if (temp >= 128000 || temp < -128000) {
-        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " C is out of range",
-                   temp / 1000, temp % 1000);
-        return;
-    }
-
-    s->temperature = (int16_t) (temp * 256 / 1000);
-
-    tmp105_alarm_update(s);
-}
-
-static const int tmp105_faultq[4] = { 1, 2, 4, 6 };
-
-static void tmp105_read(TMP105State *s)
-{
-    s->len = 0;
-
-    if ((s->config >> 1) & 1) {					/* TM */
-        s->alarm = 0;
-        tmp105_interrupt_update(s);
-    }
-
-    switch (s->pointer & 3) {
-    case TMP105_REG_TEMPERATURE:
-        s->buf[s->len ++] = (((uint16_t) s->temperature) >> 8);
-        s->buf[s->len ++] = (((uint16_t) s->temperature) >> 0) &
-                (0xf0 << ((~s->config >> 5) & 3));		/* R */
-        break;
-
-    case TMP105_REG_CONFIG:
-        s->buf[s->len ++] = s->config;
-        break;
-
-    case TMP105_REG_T_LOW:
-        s->buf[s->len ++] = ((uint16_t) s->limit[0]) >> 8;
-        s->buf[s->len ++] = ((uint16_t) s->limit[0]) >> 0;
-        break;
-
-    case TMP105_REG_T_HIGH:
-        s->buf[s->len ++] = ((uint16_t) s->limit[1]) >> 8;
-        s->buf[s->len ++] = ((uint16_t) s->limit[1]) >> 0;
-        break;
-    }
-}
-
-static void tmp105_write(TMP105State *s)
-{
-    switch (s->pointer & 3) {
-    case TMP105_REG_TEMPERATURE:
-        break;
-
-    case TMP105_REG_CONFIG:
-        if (s->buf[0] & ~s->config & (1 << 0))			/* SD */
-            printf("%s: TMP105 shutdown\n", __func__);
-        s->config = s->buf[0];
-        s->faults = tmp105_faultq[(s->config >> 3) & 3];	/* F */
-        tmp105_alarm_update(s);
-        break;
-
-    case TMP105_REG_T_LOW:
-    case TMP105_REG_T_HIGH:
-        if (s->len >= 3)
-            s->limit[s->pointer & 1] = (int16_t)
-                    ((((uint16_t) s->buf[0]) << 8) | s->buf[1]);
-        tmp105_alarm_update(s);
-        break;
-    }
-}
-
-static uint8_t tmp105_rx(I2CSlave *i2c)
-{
-    TMP105State *s = TMP105(i2c);
-
-    if (s->len < 2) {
-        return s->buf[s->len ++];
-    } else {
-        return 0xff;
-    }
-}
-
-static int tmp105_tx(I2CSlave *i2c, uint8_t data)
-{
-    TMP105State *s = TMP105(i2c);
-
-    if (s->len == 0) {
-        s->pointer = data;
-        s->len++;
-    } else {
-        if (s->len <= 2) {
-            s->buf[s->len - 1] = data;
-        }
-        s->len++;
-        tmp105_write(s);
-    }
-
-    return 0;
-}
-
-static int tmp105_event(I2CSlave *i2c, enum i2c_event event)
-{
-    TMP105State *s = TMP105(i2c);
-
-    if (event == I2C_START_RECV) {
-        tmp105_read(s);
-    }
-
-    s->len = 0;
-    return 0;
-}
-
-static int tmp105_post_load(void *opaque, int version_id)
-{
-    TMP105State *s = opaque;
-
-    s->faults = tmp105_faultq[(s->config >> 3) & 3];		/* F */
-
-    tmp105_interrupt_update(s);
-    return 0;
-}
-
-static bool detect_falling_needed(void *opaque)
-{
-    TMP105State *s = opaque;
-
-    /*
-     * We only need to migrate the detect_falling bool if it's set;
-     * for migration from older machines we assume that it is false
-     * (ie temperature is not out of range).
-     */
-    return s->detect_falling;
-}
-
-static const VMStateDescription vmstate_tmp105_detect_falling = {
-    .name = "TMP105/detect-falling",
-    .version_id = 1,
-    .minimum_version_id = 1,
-    .needed = detect_falling_needed,
-    .fields = (VMStateField[]) {
-        VMSTATE_BOOL(detect_falling, TMP105State),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-static const VMStateDescription vmstate_tmp105 = {
-    .name = "TMP105",
-    .version_id = 0,
-    .minimum_version_id = 0,
-    .post_load = tmp105_post_load,
-    .fields = (VMStateField[]) {
-        VMSTATE_UINT8(len, TMP105State),
-        VMSTATE_UINT8_ARRAY(buf, TMP105State, 2),
-        VMSTATE_UINT8(pointer, TMP105State),
-        VMSTATE_UINT8(config, TMP105State),
-        VMSTATE_INT16(temperature, TMP105State),
-        VMSTATE_INT16_ARRAY(limit, TMP105State, 2),
-        VMSTATE_UINT8(alarm, TMP105State),
-        VMSTATE_I2C_SLAVE(i2c, TMP105State),
-        VMSTATE_END_OF_LIST()
-    },
-    .subsections = (const VMStateDescription*[]) {
-        &vmstate_tmp105_detect_falling,
-        NULL
-    }
-};
-
-static void tmp105_reset(I2CSlave *i2c)
-{
-    TMP105State *s = TMP105(i2c);
-
-    s->temperature = 0;
-    s->pointer = 0;
-    s->config = 0;
-    s->faults = tmp105_faultq[(s->config >> 3) & 3];
-    s->alarm = 0;
-    s->detect_falling = false;
-
-    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
-    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
-
-    tmp105_interrupt_update(s);
-}
-
-static void tmp105_realize(DeviceState *dev, Error **errp)
-{
-    I2CSlave *i2c = I2C_SLAVE(dev);
-    TMP105State *s = TMP105(i2c);
-
-    qdev_init_gpio_out(&i2c->qdev, &s->pin, 1);
-
-    tmp105_reset(&s->i2c);
-}
-
-static void tmp105_initfn(Object *obj)
-{
-    object_property_add(obj, "temperature", "int",
-                        tmp105_get_temperature,
-                        tmp105_set_temperature, NULL, NULL);
-}
-
-static void tmp105_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
-
-    dc->realize = tmp105_realize;
-    k->event = tmp105_event;
-    k->recv = tmp105_rx;
-    k->send = tmp105_tx;
-    dc->vmsd = &vmstate_tmp105;
-}
-
-static const TypeInfo tmp105_info = {
-    .name          = TYPE_TMP105,
-    .parent        = TYPE_I2C_SLAVE,
-    .instance_size = sizeof(TMP105State),
-    .instance_init = tmp105_initfn,
-    .class_init    = tmp105_class_init,
-};
-
-static void tmp105_register_types(void)
-{
-    type_register_static(&tmp105_info);
-}
-
-type_init(tmp105_register_types)
diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
deleted file mode 100644
index 7c97071ad7..0000000000
--- a/hw/misc/tmp105.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Texas Instruments TMP105 Temperature Sensor
- *
- * Browse the data sheet:
- *
- *    http://www.ti.com/lit/gpn/tmp105
- *
- * Copyright (C) 2012 Alex Horn <alex.horn@cs.ox.ac.uk>
- * Copyright (C) 2008-2012 Andrzej Zaborowski <balrogg@gmail.com>
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or
- * later. See the COPYING file in the top-level directory.
- */
-#ifndef QEMU_TMP105_H
-#define QEMU_TMP105_H
-
-#include "hw/i2c/i2c.h"
-#include "hw/misc/tmp105_regs.h"
-#include "qom/object.h"
-
-#define TYPE_TMP105 "tmp105"
-OBJECT_DECLARE_SIMPLE_TYPE(TMP105State, TMP105)
-
-/**
- * TMP105State:
- * @config: Bits 5 and 6 (value 32 and 64) determine the precision of the
- * temperature. See Table 8 in the data sheet.
- *
- * @see_also: http://www.ti.com/lit/gpn/tmp105
- */
-struct TMP105State {
-    /*< private >*/
-    I2CSlave i2c;
-    /*< public >*/
-
-    uint8_t len;
-    uint8_t buf[2];
-    qemu_irq pin;
-
-    uint8_t pointer;
-    uint8_t config;
-    int16_t temperature;
-    int16_t limit[2];
-    int faults;
-    uint8_t alarm;
-    /*
-     * The TMP105 initially looks for a temperature rising above T_high;
-     * once this is detected, the condition it looks for next is the
-     * temperature falling below T_low. This flag is false when initially
-     * looking for T_high, true when looking for T_low.
-     */
-    bool detect_falling;
-};
-
-#endif
diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c
deleted file mode 100644
index a3db57dcb5..0000000000
--- a/hw/misc/tmp421.c
+++ /dev/null
@@ -1,391 +0,0 @@
-/*
- * Texas Instruments TMP421 temperature sensor.
- *
- * Copyright (c) 2016 IBM Corporation.
- *
- * Largely inspired by :
- *
- * Texas Instruments TMP105 temperature sensor.
- *
- * Copyright (C) 2008 Nokia Corporation
- * Written by Andrzej Zaborowski <andrew@openedhand.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 or
- * (at your option) version 3 of the License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "qemu/osdep.h"
-#include "hw/i2c/i2c.h"
-#include "migration/vmstate.h"
-#include "qapi/error.h"
-#include "qapi/visitor.h"
-#include "qemu/module.h"
-#include "qom/object.h"
-
-/* Manufacturer / Device ID's */
-#define TMP421_MANUFACTURER_ID          0x55
-#define TMP421_DEVICE_ID                0x21
-#define TMP422_DEVICE_ID                0x22
-#define TMP423_DEVICE_ID                0x23
-
-typedef struct DeviceInfo {
-    int model;
-    const char *name;
-} DeviceInfo;
-
-static const DeviceInfo devices[] = {
-    { TMP421_DEVICE_ID, "tmp421" },
-    { TMP422_DEVICE_ID, "tmp422" },
-    { TMP423_DEVICE_ID, "tmp423" },
-};
-
-struct TMP421State {
-    /*< private >*/
-    I2CSlave i2c;
-    /*< public >*/
-
-    int16_t temperature[4];
-
-    uint8_t status;
-    uint8_t config[2];
-    uint8_t rate;
-
-    uint8_t len;
-    uint8_t buf[2];
-    uint8_t pointer;
-
-};
-
-struct TMP421Class {
-    I2CSlaveClass parent_class;
-    DeviceInfo *dev;
-};
-
-#define TYPE_TMP421 "tmp421-generic"
-OBJECT_DECLARE_TYPE(TMP421State, TMP421Class, TMP421)
-
-
-/* the TMP421 registers */
-#define TMP421_STATUS_REG               0x08
-#define    TMP421_STATUS_BUSY             (1 << 7)
-#define TMP421_CONFIG_REG_1             0x09
-#define    TMP421_CONFIG_RANGE            (1 << 2)
-#define    TMP421_CONFIG_SHUTDOWN         (1 << 6)
-#define TMP421_CONFIG_REG_2             0x0A
-#define    TMP421_CONFIG_RC               (1 << 2)
-#define    TMP421_CONFIG_LEN              (1 << 3)
-#define    TMP421_CONFIG_REN              (1 << 4)
-#define    TMP421_CONFIG_REN2             (1 << 5)
-#define    TMP421_CONFIG_REN3             (1 << 6)
-
-#define TMP421_CONVERSION_RATE_REG      0x0B
-#define TMP421_ONE_SHOT                 0x0F
-
-#define TMP421_RESET                    0xFC
-#define TMP421_MANUFACTURER_ID_REG      0xFE
-#define TMP421_DEVICE_ID_REG            0xFF
-
-#define TMP421_TEMP_MSB0                0x00
-#define TMP421_TEMP_MSB1                0x01
-#define TMP421_TEMP_MSB2                0x02
-#define TMP421_TEMP_MSB3                0x03
-#define TMP421_TEMP_LSB0                0x10
-#define TMP421_TEMP_LSB1                0x11
-#define TMP421_TEMP_LSB2                0x12
-#define TMP421_TEMP_LSB3                0x13
-
-static const int32_t mins[2] = { -40000, -55000 };
-static const int32_t maxs[2] = { 127000, 150000 };
-
-static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,
-                                   void *opaque, Error **errp)
-{
-    TMP421State *s = TMP421(obj);
-    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
-    int offset = ext_range * 64 * 256;
-    int64_t value;
-    int tempid;
-
-    if (sscanf(name, "temperature%d", &tempid) != 1) {
-        error_setg(errp, "error reading %s: %s", name, g_strerror(errno));
-        return;
-    }
-
-    if (tempid >= 4 || tempid < 0) {
-        error_setg(errp, "error reading %s", name);
-        return;
-    }
-
-    value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;
-
-    visit_type_int(v, name, &value, errp);
-}
-
-/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
- * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
- */
-static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,
-                                   void *opaque, Error **errp)
-{
-    TMP421State *s = TMP421(obj);
-    int64_t temp;
-    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
-    int offset = ext_range * 64 * 256;
-    int tempid;
-
-    if (!visit_type_int(v, name, &temp, errp)) {
-        return;
-    }
-
-    if (temp >= maxs[ext_range] || temp < mins[ext_range]) {
-        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " C is out of range",
-                   temp / 1000, temp % 1000);
-        return;
-    }
-
-    if (sscanf(name, "temperature%d", &tempid) != 1) {
-        error_setg(errp, "error reading %s: %s", name, g_strerror(errno));
-        return;
-    }
-
-    if (tempid >= 4 || tempid < 0) {
-        error_setg(errp, "error reading %s", name);
-        return;
-    }
-
-    s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;
-}
-
-static void tmp421_read(TMP421State *s)
-{
-    TMP421Class *sc = TMP421_GET_CLASS(s);
-
-    s->len = 0;
-
-    switch (s->pointer) {
-    case TMP421_MANUFACTURER_ID_REG:
-        s->buf[s->len++] = TMP421_MANUFACTURER_ID;
-        break;
-    case TMP421_DEVICE_ID_REG:
-        s->buf[s->len++] = sc->dev->model;
-        break;
-    case TMP421_CONFIG_REG_1:
-        s->buf[s->len++] = s->config[0];
-        break;
-    case TMP421_CONFIG_REG_2:
-        s->buf[s->len++] = s->config[1];
-        break;
-    case TMP421_CONVERSION_RATE_REG:
-        s->buf[s->len++] = s->rate;
-        break;
-    case TMP421_STATUS_REG:
-        s->buf[s->len++] = s->status;
-        break;
-
-        /* FIXME: check for channel enablement in config registers */
-    case TMP421_TEMP_MSB0:
-        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);
-        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
-        break;
-    case TMP421_TEMP_MSB1:
-        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);
-        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
-        break;
-    case TMP421_TEMP_MSB2:
-        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);
-        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
-        break;
-    case TMP421_TEMP_MSB3:
-        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);
-        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
-        break;
-    case TMP421_TEMP_LSB0:
-        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
-        break;
-    case TMP421_TEMP_LSB1:
-        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
-        break;
-    case TMP421_TEMP_LSB2:
-        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
-        break;
-    case TMP421_TEMP_LSB3:
-        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
-        break;
-    }
-}
-
-static void tmp421_reset(I2CSlave *i2c);
-
-static void tmp421_write(TMP421State *s)
-{
-    switch (s->pointer) {
-    case TMP421_CONVERSION_RATE_REG:
-        s->rate = s->buf[0];
-        break;
-    case TMP421_CONFIG_REG_1:
-        s->config[0] = s->buf[0];
-        break;
-    case TMP421_CONFIG_REG_2:
-        s->config[1] = s->buf[0];
-        break;
-    case TMP421_RESET:
-        tmp421_reset(I2C_SLAVE(s));
-        break;
-    }
-}
-
-static uint8_t tmp421_rx(I2CSlave *i2c)
-{
-    TMP421State *s = TMP421(i2c);
-
-    if (s->len < 2) {
-        return s->buf[s->len++];
-    } else {
-        return 0xff;
-    }
-}
-
-static int tmp421_tx(I2CSlave *i2c, uint8_t data)
-{
-    TMP421State *s = TMP421(i2c);
-
-    if (s->len == 0) {
-        /* first byte is the register pointer for a read or write
-         * operation */
-        s->pointer = data;
-        s->len++;
-    } else if (s->len == 1) {
-        /* second byte is the data to write. The device only supports
-         * one byte writes */
-        s->buf[0] = data;
-        tmp421_write(s);
-    }
-
-    return 0;
-}
-
-static int tmp421_event(I2CSlave *i2c, enum i2c_event event)
-{
-    TMP421State *s = TMP421(i2c);
-
-    if (event == I2C_START_RECV) {
-        tmp421_read(s);
-    }
-
-    s->len = 0;
-    return 0;
-}
-
-static const VMStateDescription vmstate_tmp421 = {
-    .name = "TMP421",
-    .version_id = 0,
-    .minimum_version_id = 0,
-    .fields = (VMStateField[]) {
-        VMSTATE_UINT8(len, TMP421State),
-        VMSTATE_UINT8_ARRAY(buf, TMP421State, 2),
-        VMSTATE_UINT8(pointer, TMP421State),
-        VMSTATE_UINT8_ARRAY(config, TMP421State, 2),
-        VMSTATE_UINT8(status, TMP421State),
-        VMSTATE_UINT8(rate, TMP421State),
-        VMSTATE_INT16_ARRAY(temperature, TMP421State, 4),
-        VMSTATE_I2C_SLAVE(i2c, TMP421State),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-static void tmp421_reset(I2CSlave *i2c)
-{
-    TMP421State *s = TMP421(i2c);
-    TMP421Class *sc = TMP421_GET_CLASS(s);
-
-    memset(s->temperature, 0, sizeof(s->temperature));
-    s->pointer = 0;
-
-    s->config[0] = 0; /* TMP421_CONFIG_RANGE */
-
-     /* resistance correction and channel enablement */
-    switch (sc->dev->model) {
-    case TMP421_DEVICE_ID:
-        s->config[1] = 0x1c;
-        break;
-    case TMP422_DEVICE_ID:
-        s->config[1] = 0x3c;
-        break;
-    case TMP423_DEVICE_ID:
-        s->config[1] = 0x7c;
-        break;
-    }
-
-    s->rate = 0x7;       /* 8Hz */
-    s->status = 0;
-}
-
-static void tmp421_realize(DeviceState *dev, Error **errp)
-{
-    TMP421State *s = TMP421(dev);
-
-    tmp421_reset(&s->i2c);
-}
-
-static void tmp421_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
-    TMP421Class *sc = TMP421_CLASS(klass);
-
-    dc->realize = tmp421_realize;
-    k->event = tmp421_event;
-    k->recv = tmp421_rx;
-    k->send = tmp421_tx;
-    dc->vmsd = &vmstate_tmp421;
-    sc->dev = (DeviceInfo *) data;
-
-    object_class_property_add(klass, "temperature0", "int",
-                              tmp421_get_temperature,
-                              tmp421_set_temperature, NULL, NULL);
-    object_class_property_add(klass, "temperature1", "int",
-                              tmp421_get_temperature,
-                              tmp421_set_temperature, NULL, NULL);
-    object_class_property_add(klass, "temperature2", "int",
-                              tmp421_get_temperature,
-                              tmp421_set_temperature, NULL, NULL);
-    object_class_property_add(klass, "temperature3", "int",
-                              tmp421_get_temperature,
-                              tmp421_set_temperature, NULL, NULL);
-}
-
-static const TypeInfo tmp421_info = {
-    .name          = TYPE_TMP421,
-    .parent        = TYPE_I2C_SLAVE,
-    .instance_size = sizeof(TMP421State),
-    .class_size    = sizeof(TMP421Class),
-    .abstract      = true,
-};
-
-static void tmp421_register_types(void)
-{
-    int i;
-
-    type_register_static(&tmp421_info);
-    for (i = 0; i < ARRAY_SIZE(devices); ++i) {
-        TypeInfo ti = {
-            .name       = devices[i].name,
-            .parent     = TYPE_TMP421,
-            .class_init = tmp421_class_init,
-            .class_data = (void *) &devices[i],
-        };
-        type_register(&ti);
-    }
-}
-
-type_init(tmp421_register_types)
diff --git a/hw/misc/zynq-xadc.c b/hw/misc/zynq-xadc.c
deleted file mode 100644
index 7b1972ce06..0000000000
--- a/hw/misc/zynq-xadc.c
+++ /dev/null
@@ -1,305 +0,0 @@
-/*
- * ADC registers for Xilinx Zynq Platform
- *
- * Copyright (c) 2015 Guenter Roeck
- * Based on hw/misc/zynq_slcr.c, written by Michal Simek
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "qemu/osdep.h"
-#include "hw/irq.h"
-#include "hw/misc/zynq-xadc.h"
-#include "migration/vmstate.h"
-#include "qemu/timer.h"
-#include "qemu/log.h"
-#include "qemu/module.h"
-
-enum {
-    CFG                = 0x000 / 4,
-    INT_STS,
-    INT_MASK,
-    MSTS,
-    CMDFIFO,
-    RDFIFO,
-    MCTL,
-};
-
-#define CFG_ENABLE              BIT(31)
-#define CFG_CFIFOTH_SHIFT       20
-#define CFG_CFIFOTH_LENGTH      4
-#define CFG_DFIFOTH_SHIFT       16
-#define CFG_DFIFOTH_LENGTH      4
-#define CFG_WEDGE               BIT(13)
-#define CFG_REDGE               BIT(12)
-#define CFG_TCKRATE_SHIFT       8
-#define CFG_TCKRATE_LENGTH      2
-
-#define CFG_TCKRATE_DIV(x)      (0x1 << (x - 1))
-
-#define CFG_IGAP_SHIFT          0
-#define CFG_IGAP_LENGTH         5
-
-#define INT_CFIFO_LTH           BIT(9)
-#define INT_DFIFO_GTH           BIT(8)
-#define INT_OT                  BIT(7)
-#define INT_ALM_SHIFT           0
-#define INT_ALM_LENGTH          7
-#define INT_ALM_MASK            (((1 << INT_ALM_LENGTH) - 1) << INT_ALM_SHIFT)
-
-#define INT_ALL (INT_CFIFO_LTH | INT_DFIFO_GTH | INT_OT | INT_ALM_MASK)
-
-#define MSTS_CFIFO_LVL_SHIFT    16
-#define MSTS_CFIFO_LVL_LENGTH   4
-#define MSTS_DFIFO_LVL_SHIFT    12
-#define MSTS_DFIFO_LVL_LENGTH   4
-#define MSTS_CFIFOF             BIT(11)
-#define MSTS_CFIFOE             BIT(10)
-#define MSTS_DFIFOF             BIT(9)
-#define MSTS_DFIFOE             BIT(8)
-#define MSTS_OT                 BIT(7)
-#define MSTS_ALM_SHIFT          0
-#define MSTS_ALM_LENGTH         7
-
-#define MCTL_RESET              BIT(4)
-
-#define CMD_NOP                 0x00
-#define CMD_READ                0x01
-#define CMD_WRITE               0x02
-
-static void zynq_xadc_update_ints(ZynqXADCState *s)
-{
-
-    /* We are fast, commands are actioned instantly so the CFIFO is always
-     * empty (and below threshold).
-     */
-    s->regs[INT_STS] |= INT_CFIFO_LTH;
-
-    if (s->xadc_dfifo_entries >
-        extract32(s->regs[CFG], CFG_DFIFOTH_SHIFT, CFG_DFIFOTH_LENGTH)) {
-        s->regs[INT_STS] |= INT_DFIFO_GTH;
-    }
-
-    qemu_set_irq(s->qemu_irq, !!(s->regs[INT_STS] & ~s->regs[INT_MASK]));
-}
-
-static void zynq_xadc_reset(DeviceState *d)
-{
-    ZynqXADCState *s = ZYNQ_XADC(d);
-
-    s->regs[CFG] = 0x14 << CFG_IGAP_SHIFT |
-                   CFG_TCKRATE_DIV(4) << CFG_TCKRATE_SHIFT | CFG_REDGE;
-    s->regs[INT_STS] = INT_CFIFO_LTH;
-    s->regs[INT_MASK] = 0xffffffff;
-    s->regs[CMDFIFO] = 0;
-    s->regs[RDFIFO] = 0;
-    s->regs[MCTL] = MCTL_RESET;
-
-    memset(s->xadc_regs, 0, sizeof(s->xadc_regs));
-    memset(s->xadc_dfifo, 0, sizeof(s->xadc_dfifo));
-    s->xadc_dfifo_entries = 0;
-
-    zynq_xadc_update_ints(s);
-}
-
-static uint16_t xadc_pop_dfifo(ZynqXADCState *s)
-{
-    uint16_t rv = s->xadc_dfifo[0];
-    int i;
-
-    if (s->xadc_dfifo_entries > 0) {
-        s->xadc_dfifo_entries--;
-    }
-    for (i = 0; i < s->xadc_dfifo_entries; i++) {
-        s->xadc_dfifo[i] = s->xadc_dfifo[i + 1];
-    }
-    s->xadc_dfifo[s->xadc_dfifo_entries] = 0;
-    zynq_xadc_update_ints(s);
-    return rv;
-}
-
-static void xadc_push_dfifo(ZynqXADCState *s, uint16_t regval)
-{
-    if (s->xadc_dfifo_entries < ZYNQ_XADC_FIFO_DEPTH) {
-        s->xadc_dfifo[s->xadc_dfifo_entries++] = s->xadc_read_reg_previous;
-    }
-    s->xadc_read_reg_previous = regval;
-    zynq_xadc_update_ints(s);
-}
-
-static bool zynq_xadc_check_offset(hwaddr offset, bool rnw)
-{
-    switch (offset) {
-    case CFG:
-    case INT_MASK:
-    case INT_STS:
-    case MCTL:
-        return true;
-    case RDFIFO:
-    case MSTS:
-        return rnw;     /* read only */
-    case CMDFIFO:
-        return !rnw;    /* write only */
-    default:
-        return false;
-    }
-}
-
-static uint64_t zynq_xadc_read(void *opaque, hwaddr offset, unsigned size)
-{
-    ZynqXADCState *s = opaque;
-    int reg = offset / 4;
-    uint32_t rv = 0;
-
-    if (!zynq_xadc_check_offset(reg, true)) {
-        qemu_log_mask(LOG_GUEST_ERROR, "zynq_xadc: Invalid read access to "
-                      "addr %" HWADDR_PRIx "\n", offset);
-        return 0;
-    }
-
-    switch (reg) {
-    case CFG:
-    case INT_MASK:
-    case INT_STS:
-    case MCTL:
-        rv = s->regs[reg];
-        break;
-    case MSTS:
-        rv = MSTS_CFIFOE;
-        rv |= s->xadc_dfifo_entries << MSTS_DFIFO_LVL_SHIFT;
-        if (!s->xadc_dfifo_entries) {
-            rv |= MSTS_DFIFOE;
-        } else if (s->xadc_dfifo_entries == ZYNQ_XADC_FIFO_DEPTH) {
-            rv |= MSTS_DFIFOF;
-        }
-        break;
-    case RDFIFO:
-        rv = xadc_pop_dfifo(s);
-        break;
-    }
-    return rv;
-}
-
-static void zynq_xadc_write(void *opaque, hwaddr offset, uint64_t val,
-                            unsigned size)
-{
-    ZynqXADCState *s = (ZynqXADCState *)opaque;
-    int reg = offset / 4;
-    int xadc_reg;
-    int xadc_cmd;
-    int xadc_data;
-
-    if (!zynq_xadc_check_offset(reg, false)) {
-        qemu_log_mask(LOG_GUEST_ERROR, "zynq_xadc: Invalid write access "
-                      "to addr %" HWADDR_PRIx "\n", offset);
-        return;
-    }
-
-    switch (reg) {
-    case CFG:
-        s->regs[CFG] = val;
-        break;
-    case INT_STS:
-        s->regs[INT_STS] &= ~val;
-        break;
-    case INT_MASK:
-        s->regs[INT_MASK] = val & INT_ALL;
-        break;
-    case CMDFIFO:
-        xadc_cmd  = extract32(val, 26,  4);
-        xadc_reg  = extract32(val, 16, 10);
-        xadc_data = extract32(val,  0, 16);
-
-        if (s->regs[MCTL] & MCTL_RESET) {
-            qemu_log_mask(LOG_GUEST_ERROR, "zynq_xadc: Sending command "
-                          "while comm channel held in reset: %" PRIx32 "\n",
-                          (uint32_t) val);
-            break;
-        }
-
-        if (xadc_reg >= ZYNQ_XADC_NUM_ADC_REGS && xadc_cmd != CMD_NOP) {
-            qemu_log_mask(LOG_GUEST_ERROR, "read/write op to invalid xadc "
-                          "reg 0x%x\n", xadc_reg);
-            break;
-        }
-
-        switch (xadc_cmd) {
-        case CMD_READ:
-            xadc_push_dfifo(s, s->xadc_regs[xadc_reg]);
-            break;
-        case CMD_WRITE:
-            s->xadc_regs[xadc_reg] = xadc_data;
-            /* fallthrough */
-        case CMD_NOP:
-            xadc_push_dfifo(s, 0);
-            break;
-        }
-        break;
-    case MCTL:
-        s->regs[MCTL] = val & 0x00fffeff;
-        break;
-    }
-    zynq_xadc_update_ints(s);
-}
-
-static const MemoryRegionOps xadc_ops = {
-    .read = zynq_xadc_read,
-    .write = zynq_xadc_write,
-    .endianness = DEVICE_NATIVE_ENDIAN,
-};
-
-static void zynq_xadc_init(Object *obj)
-{
-    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    ZynqXADCState *s = ZYNQ_XADC(obj);
-
-    memory_region_init_io(&s->iomem, obj, &xadc_ops, s, "zynq-xadc",
-                          ZYNQ_XADC_MMIO_SIZE);
-    sysbus_init_mmio(sbd, &s->iomem);
-    sysbus_init_irq(sbd, &s->qemu_irq);
-}
-
-static const VMStateDescription vmstate_zynq_xadc = {
-    .name = "zynq-xadc",
-    .version_id = 1,
-    .minimum_version_id = 1,
-    .fields = (VMStateField[]) {
-        VMSTATE_UINT32_ARRAY(regs, ZynqXADCState, ZYNQ_XADC_NUM_IO_REGS),
-        VMSTATE_UINT16_ARRAY(xadc_regs, ZynqXADCState,
-                             ZYNQ_XADC_NUM_ADC_REGS),
-        VMSTATE_UINT16_ARRAY(xadc_dfifo, ZynqXADCState,
-                             ZYNQ_XADC_FIFO_DEPTH),
-        VMSTATE_UINT16(xadc_read_reg_previous, ZynqXADCState),
-        VMSTATE_UINT16(xadc_dfifo_entries, ZynqXADCState),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-static void zynq_xadc_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    dc->vmsd = &vmstate_zynq_xadc;
-    dc->reset = zynq_xadc_reset;
-}
-
-static const TypeInfo zynq_xadc_info = {
-    .class_init = zynq_xadc_class_init,
-    .name  = TYPE_ZYNQ_XADC,
-    .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size  = sizeof(ZynqXADCState),
-    .instance_init = zynq_xadc_init,
-};
-
-static void zynq_xadc_register_types(void)
-{
-    type_register_static(&zynq_xadc_info);
-}
-
-type_init(zynq_xadc_register_types)