Series comparison

-[PULL 00/20] aspeed queue
+[PULL 00/12] aspeed queue
-The following changes since commit 2f4c51c0f384d7888a04b4815861e6d5fd244d75:
+The following changes since commit a95260486aa7e78d7c7194eba65cf03311ad94ad:
-  Merge remote-tracking branch 'remotes/kraxel/tags/usb-20200831-pull-request' into staging (2020-08-31 19:39:13 +0100)
+  Merge tag 'pull-tcg-20231023' of https://gitlab.com/rth7680/qemu into staging (2023-10-23 14:45:46 -0700)
 are available in the Git repository at:
-  https://github.com/legoater/qemu/ tags/pull-aspeed-20200901
+  https://github.com/legoater/qemu/ tags/pull-aspeed-20231025
-for you to fetch changes up to ddd8ab19749b8639fc08bfe4d0df0204eec049f0:
+for you to fetch changes up to dd41ce7a6f13ad4f45ebaf52b9fa91fe5fc961df:
-  hw: add a number of SPI-flash's of m25p80 family (2020-09-01 14:21:51 +0200)
+  hw/arm/aspeed: Move AspeedSoCState::cpu/vic to Aspeed2400SoCState (2023-10-25 09:52:44 +0200)
 ----------------------------------------------------------------
-Various fixes of Aspeed machines :
+aspeed queue:
-* New Supermicro X11 BMC machine (Erik)
+* Update of Andrew's email
-* Fixed valid access size on AST2400 SCU
+* Split of AspeedSoCState per 2400/2600/10x0
 * Improved robustness of the ftgmac100 model.
 * New flash models in m25p80 (Igor)
 * Fixed reset sequence of SDHCI/eMMC controllers
 * Improved support of the AST2600 SDMC  (Joel)
 * Couple of SMC cleanups
 ----------------------------------------------------------------
-Cédric Le Goater (15):
+Andrew Jeffery (1):
-      m25p80: Return the JEDEC ID twice for mx25l25635e
+      MAINTAINERS: aspeed: Update Andrew's email address
       m25p80: Add support for n25q512ax3
       aspeed/scu: Fix valid access size on AST2400
       aspeed/smc: Fix MemoryRegionOps definition
       aspeed/smc: Fix max_slaves of the legacy SMC device
       aspeed/sdhci: Fix reset sequence
       ftgmac100: Fix registers that can be read
       ftgmac100: Fix interrupt status "Packet transmitted on ethernet"
       ftgmac100: Fix interrupt status "Packet moved to RX FIFO"
       ftgmac100: Change interrupt status when a DMA error occurs
       ftgmac100: Check for invalid len and address before doing a DMA transfer
       ftgmac100: Fix integer overflow in ftgmac100_do_tx()
       ftgmac100: Improve software reset
       aspeed/sdmc: Simplify calculation of RAM bits
       aspeed/smc: Open AHB window of the second chip of the AST2600 FMC controller
-Erik Smit (1):
+Philippe Mathieu-Daudé (11):
-      hw/arm/aspeed: Add board model for Supermicro X11 BMC
+      hw/arm/aspeed: Extract code common to all boards to a common file
       hw/arm/aspeed: Rename aspeed_soc_init() as AST2400/2500 specific
       hw/arm/aspeed: Rename aspeed_soc_realize() as AST2400/2500 specific
       hw/arm/aspeed: Dynamically allocate AspeedMachineState::soc field
       hw/arm/aspeed: Introduce TYPE_ASPEED10X0_SOC
       hw/arm/aspeed: Introduce TYPE_ASPEED2600_SOC
       hw/arm/aspeed: Introduce TYPE_ASPEED2400_SOC
       hw/arm/aspeed: Check 'memory' link is set in common aspeed_soc_realize
       hw/arm/aspeed: Move AspeedSoCState::armv7m to Aspeed10x0SoCState
       hw/arm/aspeed: Move AspeedSoCState::a7mpcore to Aspeed2600SoCState
       hw/arm/aspeed: Move AspeedSoCState::cpu/vic to Aspeed2400SoCState
-Igor Kononenko (2):
+ MAINTAINERS                               |   2 +-
-      arm: aspeed: add strap define `25HZ` of AST2500
+ include/hw/arm/aspeed_soc.h               |  35 +++++-
-      hw: add a number of SPI-flash's of m25p80 family
+ hw/arm/aspeed.c                           | 101 +++++++--------
  hw/arm/aspeed_ast10x0.c                   |  53 ++++----
  hw/arm/{aspeed_soc.c => aspeed_ast2400.c} | 197 +++++++-----------------------
  hw/arm/aspeed_ast2600.c                   |  75 ++++++------
  hw/arm/aspeed_soc_common.c                | 154 +++++++++++++++++++++++
  hw/arm/fby35.c                            |  27 ++--
  hw/arm/meson.build                        |   3 +-
 files changed, 363 insertions(+), 284 deletions(-)
  rename hw/arm/{aspeed_soc.c => aspeed_ast2400.c} (76%)
  create mode 100644 hw/arm/aspeed_soc_common.c
-Joel Stanley (2):
-      aspeed/sdmc: Perform memory training
-      aspeed/sdmc: Allow writes to unprotected registers
- include/hw/misc/aspeed_scu.h  |   1 +
- include/hw/misc/aspeed_sdmc.h |  13 ++++-
- hw/arm/aspeed.c               |  35 ++++++++++++
- hw/block/m25p80.c             |   5 +-
- hw/misc/aspeed_scu.c          |   9 +--
- hw/misc/aspeed_sdmc.c         | 125 +++++++++++++++++++++++-------------------
- hw/net/ftgmac100.c            |  95 +++++++++++++++++++++++---------
- hw/sd/aspeed_sdhci.c          |  14 ++++-
- hw/ssi/aspeed_smc.c           |   6 +-
-files changed, 208 insertions(+), 95 deletions(-)

-[PULL 01/20] m25p80: Return the JEDEC ID twice for mx25l25635e
+Deleted patch
-The mx25l25635e returns the JEDEC ID twice when issuing a RDID command :
-  [    2.512027] aspeed-smc 1e630000.spi: reading JEDEC ID C2:20:19:C2:20:19
-This can break some firmware testing for this condition on the
-supermicrox11-bmc machine.
-Reported-by: Erik Smit <erik.lucas.smit@gmail.com>
-Message-Id: <20200819100956.2216690-2-clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/block/m25p80.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
-+++ b/hw/block/m25p80.c
-@@ -XXX,XX +XXX,XX @@ static const FlashPartInfo known_devices[] = {
-     { INFO("mx25l6405d",  0xc22017,      0,  64 << 10, 128, 0) },
-     { INFO("mx25l12805d", 0xc22018,      0,  64 << 10, 256, 0) },
-     { INFO("mx25l12855e", 0xc22618,      0,  64 << 10, 256, 0) },
--    { INFO("mx25l25635e", 0xc22019,      0,  64 << 10, 512, 0) },
-+    { INFO6("mx25l25635e", 0xc22019,     0xc22019,  64 << 10, 512, 0) },
-     { INFO("mx25l25655e", 0xc22619,      0,  64 << 10, 512, 0) },
-     { INFO("mx66u51235f", 0xc2253a,      0,  64 << 10, 1024, ER_4K | ER_32K) },
-     { INFO("mx66u1g45g",  0xc2253b,      0,  64 << 10, 2048, ER_4K | ER_32K) },
---
-.25.4

-[PULL 02/20] m25p80: Add support for n25q512ax3
+Deleted patch
-Datasheet available here :
-https://www.micron.com/-/media/client/global/Documents/Products/Data%20Sheet/NOR%20Flash/Serial%20NOR/N25Q/n25q_512mb_1ce_3v_65nm.pdf
-Reviewed-by: Joel Stanley <joel@jms.id.au>
-Message-Id: <20200819100956.2216690-4-clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/block/m25p80.c | 1 +
-file changed, 1 insertion(+)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
-+++ b/hw/block/m25p80.c
-@@ -XXX,XX +XXX,XX @@ static const FlashPartInfo known_devices[] = {
-     { INFO("n25q128",     0x20ba18,      0,  64 << 10, 256, 0) },
-     { INFO("n25q256a",    0x20ba19,      0,  64 << 10, 512, ER_4K) },
-     { INFO("n25q512a",    0x20ba20,      0,  64 << 10, 1024, ER_4K) },
-+    { INFO("n25q512ax3",  0x20ba20,  0x1000,  64 << 10, 1024, ER_4K) },
-     { INFO_STACKED("n25q00",    0x20ba21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
-     { INFO_STACKED("n25q00a",   0x20bb21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
-     { INFO_STACKED("mt25ql01g", 0x20ba21, 0x1040, 64 << 10, 2048, ER_4K, 2) },
---
-.25.4

-[PULL 11/20] ftgmac100: Change interrupt status when a DMA error occurs
+[PULL 01/12] MAINTAINERS: aspeed: Update Andrew's email address
-The model uses today the "Normal priority transmit buffer unavailable"
+From: Andrew Jeffery <andrew@codeconstruct.com.au>
 interrupt status which it is not appropriate. According to the Aspeed
 specs, no interrupts are raised in that case. An "AHB error" status
 seems like a better modeling choice for all implementations since it
 is covered by the Linux kernel.
-Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
+I've changed employers, have company email that deals with patch-based
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+workflows without too much of a headache, and am trying to steer some
-Message-Id: <20200819100956.2216690-13-clg@kaod.org>
+content out of my personal mail.
 Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/net/ftgmac100.c | 2 +-
+ MAINTAINERS | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
+--- a/MAINTAINERS
-+++ b/hw/net/ftgmac100.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
+@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/emcraft-sf2.rst
-         if (dma_memory_read(&address_space_memory, bd.des3, ptr, len)) {
+ ASPEED BMCs
-             qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to read packet @ 0x%x\n",
+ M: Cédric Le Goater <clg@kaod.org>
-                           __func__, bd.des3);
+ M: Peter Maydell <peter.maydell@linaro.org>
--            s->isr |= FTGMAC100_INT_NO_NPTXBUF;
+-R: Andrew Jeffery <andrew@aj.id.au>
-+            s->isr |= FTGMAC100_INT_AHB_ERR;
++R: Andrew Jeffery <andrew@codeconstruct.com.au>
-             break;
+ R: Joel Stanley <joel@jms.id.au>
-         }
+ L: qemu-arm@nongnu.org
+ S: Maintained
 --
-.25.4
+.41.0

-[PULL 13/20] ftgmac100: Fix integer overflow in ftgmac100_do_tx()
+[PULL 02/12] hw/arm/aspeed: Extract code common to all boards to a common file
-When inserting the VLAN tag in packets, memmove() can generate an
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-integer overflow for packets whose length is less than 12 bytes.
+aspeed_soc.c contains definitions specific to the AST2400
-Move the VLAN insertion when the last segment of the frame is reached
+and AST2500 SoCs, but also some definitions for other AST
-and check length against the size of the ethernet header (14 bytes) to
+SoCs: move them to a common file.
-avoid the crash. Return FTGMAC100_INT_XPKT_LOST status if the frame is
-too small. This seems like a good modeling choice even if Aspeed does
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-not specify anything in that case.
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
 Cc: Mauro Matteo Cascella <mcascell@redhat.com>
 Reported-by: Ziming Zhang <ezrakiez@gmail.com>
 Message-Id: <20200819100956.2216690-15-clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/net/ftgmac100.c | 55 ++++++++++++++++++++++++++++++++--------------
+ hw/arm/aspeed_soc.c        |  96 -------------------------------
-file changed, 39 insertions(+), 16 deletions(-)
+ hw/arm/aspeed_soc_common.c | 114 +++++++++++++++++++++++++++++++++++++
+ hw/arm/meson.build         |   1 +
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
+files changed, 115 insertions(+), 96 deletions(-)
  create mode 100644 hw/arm/aspeed_soc_common.c
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
+--- a/hw/arm/aspeed_soc.c
-+++ b/hw/net/ftgmac100.c
++++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@ static int ftgmac100_write_bd(FTGMAC100Desc *bd, dma_addr_t addr)
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_register_types(void)
-     return 0;
+ };
- }
+ type_init(aspeed_soc_register_types);
-+static int ftgmac100_insert_vlan(FTGMAC100State *s, int frame_size,
+-
-+                                  uint8_t vlan_tci)
+-qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev)
-+{
+-{
-+    uint8_t *vlan_hdr = s->frame + (ETH_ALEN * 2);
+-    return ASPEED_SOC_GET_CLASS(s)->get_irq(s, dev);
-+    uint8_t *payload = vlan_hdr + sizeof(struct vlan_header);
+-}
-+
+-
-+    if (frame_size < sizeof(struct eth_header)) {
+-bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp)
-+        qemu_log_mask(LOG_GUEST_ERROR,
+-{
-+                      "%s: frame too small for VLAN insertion : %d bytes\n",
+-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-+                      __func__, frame_size);
+-    SerialMM *smm;
-+        s->isr |= FTGMAC100_INT_XPKT_LOST;
+-
-+        goto out;
+-    for (int i = 0, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
 -        smm = &s->uart[i];
 -
 -        /* Chardev property is set by the machine. */
 -        qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
 -        qdev_prop_set_uint32(DEVICE(smm), "baudbase", 38400);
 -        qdev_set_legacy_instance_id(DEVICE(smm), sc->memmap[uart], 2);
 -        qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
 -        if (!sysbus_realize(SYS_BUS_DEVICE(smm), errp)) {
 -            return false;
 -        }
 -
 -        sysbus_connect_irq(SYS_BUS_DEVICE(smm), 0, aspeed_soc_get_irq(s, uart));
 -        aspeed_mmio_map(s, SYS_BUS_DEVICE(smm), 0, sc->memmap[uart]);
 -    }
 -
 -    return true;
 -}
 -
 -void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr)
 -{
 -    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 -    int i = dev - ASPEED_DEV_UART1;
 -
 -    g_assert(0 <= i && i < ARRAY_SIZE(s->uart) && i < sc->uarts_num);
 -    qdev_prop_set_chr(DEVICE(&s->uart[i]), "chardev", chr);
 -}
 -
 -/*
 - * SDMC should be realized first to get correct RAM size and max size
 - * values
 - */
 -bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp)
 -{
 -    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 -    ram_addr_t ram_size, max_ram_size;
 -
 -    ram_size = object_property_get_uint(OBJECT(&s->sdmc), "ram-size",
 -                                        &error_abort);
 -    max_ram_size = object_property_get_uint(OBJECT(&s->sdmc), "max-ram-size",
 -                                            &error_abort);
 -
 -    memory_region_init(&s->dram_container, OBJECT(s), "ram-container",
 -                       max_ram_size);
 -    memory_region_add_subregion(&s->dram_container, 0, s->dram_mr);
 -
 -    /*
 -     * Add a memory region beyond the RAM region to let firmwares scan
 -     * the address space with load/store and guess how much RAM the
 -     * SoC has.
 -     */
 -    if (ram_size < max_ram_size) {
 -        DeviceState *dev = qdev_new(TYPE_UNIMPLEMENTED_DEVICE);
 -
 -        qdev_prop_set_string(dev, "name", "ram-empty");
 -        qdev_prop_set_uint64(dev, "size", max_ram_size  - ram_size);
 -        if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp)) {
 -            return false;
 -        }
 -
 -        memory_region_add_subregion_overlap(&s->dram_container, ram_size,
 -                      sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0), -1000);
 -    }
 -
 -    memory_region_add_subregion(s->memory,
 -                      sc->memmap[ASPEED_DEV_SDRAM], &s->dram_container);
 -    return true;
 -}
 -
 -void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr)
 -{
 -    memory_region_add_subregion(s->memory, addr,
 -                                sysbus_mmio_get_region(dev, n));
 -}
 -
 -void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
 -                                   const char *name, hwaddr addr, uint64_t size)
 -{
 -    qdev_prop_set_string(DEVICE(dev), "name", name);
 -    qdev_prop_set_uint64(DEVICE(dev), "size", size);
 -    sysbus_realize(dev, &error_abort);
 -
 -    memory_region_add_subregion_overlap(s->memory, addr,
 -                                        sysbus_mmio_get_region(dev, 0), -1000);
 -}
 diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/aspeed_soc_common.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ASPEED SoC family
 + *
 + * Andrew Jeffery <andrew@aj.id.au>
 + * Jeremy Kerr <jk@ozlabs.org>
 + *
 + * Copyright 2016 IBM Corp.
 + *
 + * This code is licensed under the GPL version 2 or later.  See
 + * the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qapi/error.h"
 +#include "hw/misc/unimp.h"
 +#include "hw/arm/aspeed_soc.h"
 +#include "hw/char/serial.h"
 +
 +
 +qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev)
 +{
 +    return ASPEED_SOC_GET_CLASS(s)->get_irq(s, dev);
 +}
 +
 +bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp)
 +{
 +    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 +    SerialMM *smm;
 +
 +    for (int i = 0, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
 +        smm = &s->uart[i];
 +
 +        /* Chardev property is set by the machine. */
 +        qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
 +        qdev_prop_set_uint32(DEVICE(smm), "baudbase", 38400);
 +        qdev_set_legacy_instance_id(DEVICE(smm), sc->memmap[uart], 2);
 +        qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
 +        if (!sysbus_realize(SYS_BUS_DEVICE(smm), errp)) {
 +            return false;
 +        }
 +
 +        sysbus_connect_irq(SYS_BUS_DEVICE(smm), 0, aspeed_soc_get_irq(s, uart));
 +        aspeed_mmio_map(s, SYS_BUS_DEVICE(smm), 0, sc->memmap[uart]);
 +    }
 +
-+    if (frame_size + sizeof(struct vlan_header) > sizeof(s->frame)) {
++    return true;
-+        qemu_log_mask(LOG_GUEST_ERROR,
++}
-+                      "%s: frame too big : %d bytes\n",
++
-+                      __func__, frame_size);
++void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr)
-+        s->isr |= FTGMAC100_INT_XPKT_LOST;
++{
-+        frame_size -= sizeof(struct vlan_header);
++    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 +    int i = dev - ASPEED_DEV_UART1;
 +
 +    g_assert(0 <= i && i < ARRAY_SIZE(s->uart) && i < sc->uarts_num);
 +    qdev_prop_set_chr(DEVICE(&s->uart[i]), "chardev", chr);
 +}
 +
 +/*
 + * SDMC should be realized first to get correct RAM size and max size
 + * values
 + */
 +bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp)
 +{
 +    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 +    ram_addr_t ram_size, max_ram_size;
 +
 +    ram_size = object_property_get_uint(OBJECT(&s->sdmc), "ram-size",
 +                                        &error_abort);
 +    max_ram_size = object_property_get_uint(OBJECT(&s->sdmc), "max-ram-size",
 +                                            &error_abort);
 +
 +    memory_region_init(&s->dram_container, OBJECT(s), "ram-container",
 +                       max_ram_size);
 +    memory_region_add_subregion(&s->dram_container, 0, s->dram_mr);
 +
 +    /*
 +     * Add a memory region beyond the RAM region to let firmwares scan
 +     * the address space with load/store and guess how much RAM the
 +     * SoC has.
 +     */
 +    if (ram_size < max_ram_size) {
 +        DeviceState *dev = qdev_new(TYPE_UNIMPLEMENTED_DEVICE);
 +
 +        qdev_prop_set_string(dev, "name", "ram-empty");
 +        qdev_prop_set_uint64(dev, "size", max_ram_size  - ram_size);
 +        if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp)) {
 +            return false;
 +        }
 +
 +        memory_region_add_subregion_overlap(&s->dram_container, ram_size,
 +                      sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0), -1000);
 +    }
 +
-+    memmove(payload, vlan_hdr, frame_size - (ETH_ALEN * 2));
++    memory_region_add_subregion(s->memory,
-+    stw_be_p(vlan_hdr, ETH_P_VLAN);
++                      sc->memmap[ASPEED_DEV_SDRAM], &s->dram_container);
-+    stw_be_p(vlan_hdr + 2, vlan_tci);
++    return true;
-+    frame_size += sizeof(struct vlan_header);
++}
 +
-+out:
++void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr)
-+    return frame_size;
++{
-+}
++    memory_region_add_subregion(s->memory, addr,
-+
++                                sysbus_mmio_get_region(dev, n));
- static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
++}
-                             uint32_t tx_descriptor)
++
- {
++void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
-@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
++                                   const char *name, hwaddr addr, uint64_t size)
-             break;
++{
-         }
++    qdev_prop_set_string(DEVICE(dev), "name", name);
++    qdev_prop_set_uint64(DEVICE(dev), "size", size);
--        /* Check for VLAN */
++    sysbus_realize(dev, &error_abort);
--        if (bd.des0 & FTGMAC100_TXDES0_FTS &&
++
--            bd.des1 & FTGMAC100_TXDES1_INS_VLANTAG &&
++    memory_region_add_subregion_overlap(s->memory, addr,
--            be16_to_cpu(PKT_GET_ETH_HDR(ptr)->h_proto) != ETH_P_VLAN) {
++                                        sysbus_mmio_get_region(dev, 0), -1000);
--            if (frame_size + len + 4 > sizeof(s->frame)) {
++}
--                qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
+diff --git a/hw/arm/meson.build b/hw/arm/meson.build
--                              __func__, len);
+index XXXXXXX..XXXXXXX 100644
--                s->isr |= FTGMAC100_INT_XPKT_LOST;
+--- a/hw/arm/meson.build
--                len =  sizeof(s->frame) - frame_size - 4;
++++ b/hw/arm/meson.build
--            }
+@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'CONFIG_FSL_IMX6', if_true: files('fsl-imx6.c'))
--            memmove(ptr + 16, ptr + 12, len - 12);
+ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
--            stw_be_p(ptr + 12, ETH_P_VLAN);
+   'aspeed_soc.c',
--            stw_be_p(ptr + 14, bd.des1);
+   'aspeed.c',
--            len += 4;
++  'aspeed_soc_common.c',
--        }
+   'aspeed_ast2600.c',
--
+   'aspeed_ast10x0.c',
-         ptr += len;
+   'aspeed_eeprom.c',
          frame_size += len;
          if (bd.des0 & FTGMAC100_TXDES0_LTS) {
 +
 +            /* Check for VLAN */
 +            if (flags & FTGMAC100_TXDES1_INS_VLANTAG &&
 +                be16_to_cpu(PKT_GET_ETH_HDR(s->frame)->h_proto) != ETH_P_VLAN) {
 +                frame_size = ftgmac100_insert_vlan(s, frame_size,
 +                                            FTGMAC100_TXDES1_VLANTAG_CI(flags));
 +            }
 +
              if (flags & FTGMAC100_TXDES1_IP_CHKSUM) {
                  net_checksum_calculate(s->frame, frame_size);
              }
 --
-.25.4
+.41.0

-[PULL 20/20] hw: add a number of SPI-flash's of m25p80 family
+[PULL 03/12] hw/arm/aspeed: Rename aspeed_soc_init() as AST2400/2500 specific
-From: Igor Kononenko <i.kononenko@yadro.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Support a following SPI flashes:
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 * mx66l51235f
 * mt25ql512ab
 Signed-off-by: Igor Kononenko <i.kononenko@yadro.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20200811203724.20699-1-i.kononenko@yadro.com>
-Message-Id: <20200819100956.2216690-22-clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/block/m25p80.c | 2 ++
+ hw/arm/aspeed_soc.c | 6 +++---
-file changed, 2 insertions(+)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
+diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/hw/arm/aspeed_soc.c
-+++ b/hw/block/m25p80.c
++++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@ static const FlashPartInfo known_devices[] = {
+@@ -XXX,XX +XXX,XX @@ static qemu_irq aspeed_soc_ast2400_get_irq(AspeedSoCState *s, int dev)
-     { INFO("mx25l12855e", 0xc22618,      0,  64 << 10, 256, 0) },
+     return qdev_get_gpio_in(DEVICE(&s->vic), sc->irqmap[dev]);
-     { INFO6("mx25l25635e", 0xc22019,     0xc22019,  64 << 10, 512, 0) },
+ }
-     { INFO("mx25l25655e", 0xc22619,      0,  64 << 10, 512, 0) },
-+    { INFO("mx66l51235f", 0xc2201a,      0,  64 << 10, 1024, ER_4K | ER_32K) },
+-static void aspeed_soc_init(Object *obj)
-     { INFO("mx66u51235f", 0xc2253a,      0,  64 << 10, 1024, ER_4K | ER_32K) },
++static void aspeed_ast2400_soc_init(Object *obj)
-     { INFO("mx66u1g45g",  0xc2253b,      0,  64 << 10, 2048, ER_4K | ER_32K) },
+ {
-     { INFO("mx66l1g45g",  0xc2201b,      0,  64 << 10, 2048, ER_4K | ER_32K) },
+     AspeedSoCState *s = ASPEED_SOC(obj);
-@@ -XXX,XX +XXX,XX @@ static const FlashPartInfo known_devices[] = {
+     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-     { INFO("n25q256a",    0x20ba19,      0,  64 << 10, 512, ER_4K) },
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
-     { INFO("n25q512a",    0x20ba20,      0,  64 << 10, 1024, ER_4K) },
+ static const TypeInfo aspeed_soc_ast2400_type_info = {
-     { INFO("n25q512ax3",  0x20ba20,  0x1000,  64 << 10, 1024, ER_4K) },
+     .name           = "ast2400-a1",
-+    { INFO("mt25ql512ab", 0x20ba20, 0x1044, 64 << 10, 1024, ER_4K | ER_32K) },
+     .parent         = TYPE_ASPEED_SOC,
-     { INFO_STACKED("n25q00",    0x20ba21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
+-    .instance_init  = aspeed_soc_init,
-     { INFO_STACKED("n25q00a",   0x20bb21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
++    .instance_init  = aspeed_ast2400_soc_init,
-     { INFO_STACKED("mt25ql01g", 0x20ba21, 0x1040, 64 << 10, 2048, ER_4K, 2) },
+     .instance_size  = sizeof(AspeedSoCState),
      .class_init     = aspeed_soc_ast2400_class_init,
  };
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
  static const TypeInfo aspeed_soc_ast2500_type_info = {
      .name           = "ast2500-a1",
      .parent         = TYPE_ASPEED_SOC,
 -    .instance_init  = aspeed_soc_init,
 +    .instance_init  = aspeed_ast2400_soc_init,
      .instance_size  = sizeof(AspeedSoCState),
      .class_init     = aspeed_soc_ast2500_class_init,
  };
 --
-.25.4
+.41.0

-[PULL 19/20] arm: aspeed: add strap define `25HZ` of AST2500
+[PULL 04/12] hw/arm/aspeed: Rename aspeed_soc_realize() as AST2400/2500 specific
-From: Igor Kononenko <i.kononenko@yadro.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Provide a definition for the "25Hz reference clock input mode" strap
+Keep aspeed_soc_class_init() generic, set the realize handler
 to aspeed_ast2400_soc_realize() in each 2400/2500 class_init.
-Signed-off-by: Igor Kononenko <i.kononenko@yadro.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20200811203502.20382-1-i.kononenko@yadro.com>
-Message-Id: <20200819100956.2216690-21-clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- include/hw/misc/aspeed_scu.h | 1 +
+ hw/arm/aspeed_soc.c | 15 +++++++++++----
-file changed, 1 insertion(+)
+file changed, 11 insertions(+), 4 deletions(-)
-diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
+diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/aspeed_scu.h
+--- a/hw/arm/aspeed_soc.c
-+++ b/include/hw/misc/aspeed_scu.h
++++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@ uint32_t aspeed_scu_get_apb_freq(AspeedSCUState *s);
+@@ -XXX,XX +XXX,XX @@ static void aspeed_ast2400_soc_init(Object *obj)
- #define SCU_AST2500_HW_STRAP_ESPI_FLASH_ENABLE     (0x1 << 26)
+     object_initialize_child(obj, "video", &s->video, TYPE_UNIMPLEMENTED_DEVICE);
- #define SCU_AST2500_HW_STRAP_ESPI_ENABLE           (0x1 << 25)
+ }
- #define SCU_AST2500_HW_STRAP_DDR4_ENABLE           (0x1 << 24)
-+#define SCU_AST2500_HW_STRAP_25HZ_CLOCK_MODE       (0x1 << 23)
+-static void aspeed_soc_realize(DeviceState *dev, Error **errp)
++static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
- #define SCU_AST2500_HW_STRAP_ACPI_ENABLE           (0x1 << 19)
+ {
- #define SCU_AST2500_HW_STRAP_USBCKI_FREQ           (0x1 << 18)
+     int i;
      AspeedSoCState *s = ASPEED_SOC(dev);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 -    dc->realize = aspeed_soc_realize;
 -    /* Reason: Uses serial_hds and nd_table in realize() directly */
 -    dc->user_creatable = false;
      device_class_set_props(dc, aspeed_soc_properties);
  }
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_soc_type_info = {
  static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
  {
      AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
 +    DeviceClass *dc = DEVICE_CLASS(oc);
 +
 +    dc->realize = aspeed_ast2400_soc_realize;
 +    /* Reason: Uses serial_hds and nd_table in realize() directly */
 +    dc->user_creatable = false;
      sc->name         = "ast2400-a1";
      sc->cpu_type     = ARM_CPU_TYPE_NAME("arm926");
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_soc_ast2400_type_info = {
  static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
  {
      AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
 +    DeviceClass *dc = DEVICE_CLASS(oc);
 +
 +    dc->realize = aspeed_ast2400_soc_realize;
 +    /* Reason: Uses serial_hds and nd_table in realize() directly */
 +    dc->user_creatable = false;
      sc->name         = "ast2500-a1";
      sc->cpu_type     = ARM_CPU_TYPE_NAME("arm1176");
 --
-.25.4
+.41.0

-[PULL 04/20] hw/arm/aspeed: Add board model for Supermicro X11 BMC
+[PULL 05/12] hw/arm/aspeed: Dynamically allocate AspeedMachineState::soc field
-From: Erik Smit <erik.lucas.smit@gmail.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-The BMC Firmware can be downloaded from :
+We want to derivate the big AspeedSoCState object in some more
+SoC-specific ones. Since the object size will vary, allocate it
-  https://www.supermicro.com/en/products/motherboard/X11SSL-F
+dynamically.
-Signed-off-by: Erik Smit <erik.lucas.smit@gmail.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Joel Stanley <joel@jms.id.au>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
-[ clg: Prettified Erik's name in email
-       Modified commit log ]
-Message-Id: <20200715173418.186-1-erik.lucas.smit@gmail.com>
-Message-Id: <20200819100956.2216690-6-clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/arm/aspeed.c | 35 +++++++++++++++++++++++++++++++++++
+ hw/arm/aspeed.c | 101 +++++++++++++++++++++++++-----------------------
-file changed, 35 insertions(+)
+file changed, 52 insertions(+), 49 deletions(-)
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed.c
 +++ b/hw/arm/aspeed.c
 @@ -XXX,XX +XXX,XX @@ struct AspeedMachineState {
-         SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
+     MachineState parent_obj;
-         SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
+     /* Public */
-+/* TODO: Find the actual hardware value */
+-    AspeedSoCState soc;
-+#define SUPERMICROX11_BMC_HW_STRAP1 (                                   \
++    AspeedSoCState *soc;
-+        SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_128MB) |               \
+     MemoryRegion boot_rom;
-+        SCU_AST2400_HW_STRAP_DRAM_CONFIG(2) |                           \
+     bool mmio_exec;
-+        SCU_AST2400_HW_STRAP_ACPI_DIS |                                 \
+     uint32_t uart_chosen;
-+        SCU_AST2400_HW_STRAP_SET_CLK_SOURCE(AST2400_CLK_48M_IN) |       \
+@@ -XXX,XX +XXX,XX @@ static void write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
-+        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
+ static void aspeed_install_boot_rom(AspeedMachineState *bmc, BlockBackend *blk,
-+        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
+                                     uint64_t rom_size)
-+        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_M_S_EN) |                \
+ {
-+        SCU_AST2400_HW_STRAP_SET_CPU_AHB_RATIO(AST2400_CPU_AHB_RATIO_2_1) | \
+-    AspeedSoCState *soc = &bmc->soc;
-+        SCU_HW_STRAP_SPI_WIDTH |                                        \
++    AspeedSoCState *soc = bmc->soc;
-+        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
-+        SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
+     memory_region_init_rom(&bmc->boot_rom, NULL, "aspeed.boot_rom", rom_size,
-+
+                            &error_abort);
- /* AST2500 evb hardware value: 0xF100C2E6 */
+@@ -XXX,XX +XXX,XX @@ static void sdhci_attach_drive(SDHCIState *sdhci, DriveInfo *dinfo)
- #define AST2500_EVB_HW_STRAP1 ((                                        \
+ static void connect_serial_hds_to_uarts(AspeedMachineState *bmc)
-         AST2500_HW_STRAP1_DEFAULTS |                                    \
+ {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_palmetto_class_init(ObjectClass *oc, void *data)
+     AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(bmc);
-         aspeed_soc_num_cpus(amc->soc_name);
+-    AspeedSoCState *s = &bmc->soc;
- };
++    AspeedSoCState *s = bmc->soc;
+     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-+static void aspeed_machine_supermicrox11_bmc_class_init(ObjectClass *oc,
+     int uart_chosen = bmc->uart_chosen ? bmc->uart_chosen : amc->uart_default;
-+                                                        void *data)
-+{
+@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-+    MachineClass *mc = MACHINE_CLASS(oc);
+     int i;
-+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+     NICInfo *nd = &nd_table[0];
-+
-+    mc->desc       = "Supermicro X11 BMC (ARM926EJ-S)";
+-    object_initialize_child(OBJECT(machine), "soc", &bmc->soc, amc->soc_name);
-+    amc->soc_name  = "ast2400-a1";
+-
-+    amc->hw_strap1 = SUPERMICROX11_BMC_HW_STRAP1;
+-    sc = ASPEED_SOC_GET_CLASS(&bmc->soc);
-+    amc->fmc_model = "mx25l25635e";
++    bmc->soc = ASPEED_SOC(object_new(amc->soc_name));
-+    amc->spi_model = "mx25l25635e";
++    object_property_add_child(OBJECT(machine), "soc", OBJECT(bmc->soc));
-+    amc->num_cs    = 1;
++    object_unref(OBJECT(bmc->soc));
-+    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
++    sc = ASPEED_SOC_GET_CLASS(bmc->soc);
-+    amc->i2c_init  = palmetto_bmc_i2c_init;
-+    mc->default_ram_size = 256 * MiB;
+     /*
-+}
+      * This will error out if the RAM size is not supported by the
-+
+      * memory controller of the SoC.
- static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc, void *data)
+      */
- {
+-    object_property_set_uint(OBJECT(&bmc->soc), "ram-size", machine->ram_size,
-     MachineClass *mc = MACHINE_CLASS(oc);
++    object_property_set_uint(OBJECT(bmc->soc), "ram-size", machine->ram_size,
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
+                              &error_fatal);
-         .name          = MACHINE_TYPE_NAME("palmetto-bmc"),
-         .parent        = TYPE_ASPEED_MACHINE,
+     for (i = 0; i < sc->macs_num; i++) {
-         .class_init    = aspeed_machine_palmetto_class_init,
+         if ((amc->macs_mask & (1 << i)) && nd->used) {
-+    }, {
+             qemu_check_nic_model(nd, TYPE_FTGMAC100);
-+        .name          = MACHINE_TYPE_NAME("supermicrox11-bmc"),
+-            qdev_set_nic_properties(DEVICE(&bmc->soc.ftgmac100[i]), nd);
-+        .parent        = TYPE_ASPEED_MACHINE,
++            qdev_set_nic_properties(DEVICE(&bmc->soc->ftgmac100[i]), nd);
-+        .class_init    = aspeed_machine_supermicrox11_bmc_class_init,
+             nd++;
-     }, {
+         }
-         .name          = MACHINE_TYPE_NAME("ast2500-evb"),
+     }
-         .parent        = TYPE_ASPEED_MACHINE,
 -    object_property_set_int(OBJECT(&bmc->soc), "hw-strap1", amc->hw_strap1,
 +    object_property_set_int(OBJECT(bmc->soc), "hw-strap1", amc->hw_strap1,
                              &error_abort);
 -    object_property_set_int(OBJECT(&bmc->soc), "hw-strap2", amc->hw_strap2,
 +    object_property_set_int(OBJECT(bmc->soc), "hw-strap2", amc->hw_strap2,
                              &error_abort);
 -    object_property_set_link(OBJECT(&bmc->soc), "memory",
 +    object_property_set_link(OBJECT(bmc->soc), "memory",
                               OBJECT(get_system_memory()), &error_abort);
 -    object_property_set_link(OBJECT(&bmc->soc), "dram",
 +    object_property_set_link(OBJECT(bmc->soc), "dram",
                               OBJECT(machine->ram), &error_abort);
      if (machine->kernel_filename) {
          /*
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
           * that runs to unlock the SCU. In this case set the default to
           * be unlocked as the kernel expects
           */
 -        object_property_set_int(OBJECT(&bmc->soc), "hw-prot-key",
 +        object_property_set_int(OBJECT(bmc->soc), "hw-prot-key",
                                  ASPEED_SCU_PROT_KEY, &error_abort);
      }
      connect_serial_hds_to_uarts(bmc);
 -    qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
 +    qdev_realize(DEVICE(bmc->soc), NULL, &error_abort);
      if (defaults_enabled()) {
 -        aspeed_board_init_flashes(&bmc->soc.fmc,
 +        aspeed_board_init_flashes(&bmc->soc->fmc,
                                bmc->fmc_model ? bmc->fmc_model : amc->fmc_model,
                                amc->num_cs, 0);
 -        aspeed_board_init_flashes(&bmc->soc.spi[0],
 +        aspeed_board_init_flashes(&bmc->soc->spi[0],
                                bmc->spi_model ? bmc->spi_model : amc->spi_model,
 , amc->num_cs);
      }
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
          amc->i2c_init(bmc);
      }
 -    for (i = 0; i < bmc->soc.sdhci.num_slots; i++) {
 -        sdhci_attach_drive(&bmc->soc.sdhci.slots[i],
 +    for (i = 0; i < bmc->soc->sdhci.num_slots; i++) {
 +        sdhci_attach_drive(&bmc->soc->sdhci.slots[i],
                             drive_get(IF_SD, 0, i));
      }
 -    if (bmc->soc.emmc.num_slots) {
 -        sdhci_attach_drive(&bmc->soc.emmc.slots[0],
 -                           drive_get(IF_SD, 0, bmc->soc.sdhci.num_slots));
 +    if (bmc->soc->emmc.num_slots) {
 +        sdhci_attach_drive(&bmc->soc->emmc.slots[0],
 +                           drive_get(IF_SD, 0, bmc->soc->sdhci.num_slots));
      }
      if (!bmc->mmio_exec) {
 -        DeviceState *dev = ssi_get_cs(bmc->soc.fmc.spi, 0);
 +        DeviceState *dev = ssi_get_cs(bmc->soc->fmc.spi, 0);
          BlockBackend *fmc0 = dev ? m25p80_get_blk(dev) : NULL;
          if (fmc0) {
 -            uint64_t rom_size = memory_region_size(&bmc->soc.spi_boot);
 +            uint64_t rom_size = memory_region_size(&bmc->soc->spi_boot);
              aspeed_install_boot_rom(bmc, fmc0, rom_size);
          }
      }
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
  static void palmetto_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      DeviceState *dev;
      uint8_t *eeprom_buf = g_malloc0(32 * 1024);
@@ -XXX,XX +XXX,XX @@ static void palmetto_bmc_i2c_init(AspeedMachineState *bmc)
  static void quanta_q71l_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      /*
       * The quanta-q71l platform expects tmp75s which are compatible with
@@ -XXX,XX +XXX,XX @@ static void quanta_q71l_bmc_i2c_init(AspeedMachineState *bmc)
  static void ast2500_evb_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      uint8_t *eeprom_buf = g_malloc0(8 * 1024);
      smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 3), 0x50,
@@ -XXX,XX +XXX,XX @@ static void ast2500_evb_i2c_init(AspeedMachineState *bmc)
  static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      uint8_t *eeprom_buf = g_malloc0(8 * 1024);
      smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 7), 0x50,
@@ -XXX,XX +XXX,XX @@ static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
  static void yosemitev2_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x51, 128 * KiB);
      at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x51, 128 * KiB,
@@ -XXX,XX +XXX,XX @@ static void yosemitev2_bmc_i2c_init(AspeedMachineState *bmc)
  static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      /* The romulus board expects Epson RX8900 I2C RTC but a ds1338 is
       * good enough */
@@ -XXX,XX +XXX,XX @@ static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
  static void tiogapass_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54, 128 * KiB);
      at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 6), 0x54, 128 * KiB,
@@ -XXX,XX +XXX,XX @@ static void create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
  static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      /* bus 2 : */
      i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "tmp105", 0x48);
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
          {14, LED_COLOR_GREEN, "front-power-3",  GPIO_POLARITY_ACTIVE_LOW},
          {15, LED_COLOR_GREEN, "front-id-5",     GPIO_POLARITY_ACTIVE_LOW},
      };
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      uint8_t *eeprom_buf = g_malloc0(8 * 1024);
      DeviceState *dev;
      LEDState *led;
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
  static void g220a_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      DeviceState *dev;
      dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3),
@@ -XXX,XX +XXX,XX @@ static void g220a_bmc_i2c_init(AspeedMachineState *bmc)
  static void fp5280g2_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      I2CSlave *i2c_mux;
      /* The at24c256 */
@@ -XXX,XX +XXX,XX @@ static void fp5280g2_bmc_i2c_init(AspeedMachineState *bmc)
  static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      I2CSlave *i2c_mux;
      at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 0), 0x51, 32 * KiB);
@@ -XXX,XX +XXX,XX @@ static void get_pca9548_channels(I2CBus *bus, uint8_t mux_addr,
  static void fuji_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      I2CBus *i2c[144] = {};
      for (int i = 0; i < 16; i++) {
@@ -XXX,XX +XXX,XX @@ static void fuji_bmc_i2c_init(AspeedMachineState *bmc)
  static void bletchley_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      I2CBus *i2c[13] = {};
      for (int i = 0; i < 13; i++) {
          if ((i == 8) || (i == 11)) {
@@ -XXX,XX +XXX,XX @@ static void bletchley_bmc_i2c_init(AspeedMachineState *bmc)
  static void fby35_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      I2CBus *i2c[16];
      for (int i = 0; i < 16; i++) {
@@ -XXX,XX +XXX,XX @@ static void fby35_i2c_init(AspeedMachineState *bmc)
  static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
  }
  static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      I2CSlave *therm_mux, *cpuvr_mux;
      /* Create the generic DC-SCM hardware */
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_bletchley_class_init(ObjectClass *oc, void *data)
  static void fby35_reset(MachineState *state, ShutdownCause reason)
  {
      AspeedMachineState *bmc = ASPEED_MACHINE(state);
 -    AspeedGPIOState *gpio = &bmc->soc.gpio;
 +    AspeedGPIOState *gpio = &bmc->soc->gpio;
      qemu_devices_reset(reason);
@@ -XXX,XX +XXX,XX @@ static void aspeed_minibmc_machine_init(MachineState *machine)
      sysclk = clock_new(OBJECT(machine), "SYSCLK");
      clock_set_hz(sysclk, SYSCLK_FRQ);
 -    object_initialize_child(OBJECT(machine), "soc", &bmc->soc, amc->soc_name);
 -    qdev_connect_clock_in(DEVICE(&bmc->soc), "sysclk", sysclk);
 +    bmc->soc = ASPEED_SOC(object_new(amc->soc_name));
 +    object_property_add_child(OBJECT(machine), "soc", OBJECT(bmc->soc));
 +    object_unref(OBJECT(bmc->soc));
 +    qdev_connect_clock_in(DEVICE(bmc->soc), "sysclk", sysclk);
 -    object_property_set_link(OBJECT(&bmc->soc), "memory",
 +    object_property_set_link(OBJECT(bmc->soc), "memory",
                               OBJECT(get_system_memory()), &error_abort);
      connect_serial_hds_to_uarts(bmc);
 -    qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
 +    qdev_realize(DEVICE(bmc->soc), NULL, &error_abort);
 -    aspeed_board_init_flashes(&bmc->soc.fmc,
 +    aspeed_board_init_flashes(&bmc->soc->fmc,
                                bmc->fmc_model ? bmc->fmc_model : amc->fmc_model,
                                amc->num_cs,
 );
 -    aspeed_board_init_flashes(&bmc->soc.spi[0],
 +    aspeed_board_init_flashes(&bmc->soc->spi[0],
                                bmc->spi_model ? bmc->spi_model : amc->spi_model,
                                amc->num_cs, amc->num_cs);
 -    aspeed_board_init_flashes(&bmc->soc.spi[1],
 +    aspeed_board_init_flashes(&bmc->soc->spi[1],
                                bmc->spi_model ? bmc->spi_model : amc->spi_model,
                                amc->num_cs, (amc->num_cs * 2));
@@ -XXX,XX +XXX,XX @@ static void aspeed_minibmc_machine_init(MachineState *machine)
  static void ast1030_evb_i2c_init(AspeedMachineState *bmc)
  {
 -    AspeedSoCState *soc = &bmc->soc;
 +    AspeedSoCState *soc = bmc->soc;
      /* U10 24C08 connects to SDA/SCL Group 1 by default */
      uint8_t *eeprom_buf = g_malloc0(32 * 1024);
 --
-.25.4
+.41.0

-[PULL 18/20] aspeed/smc: Open AHB window of the second chip of the AST2600 FMC controller
+[PULL 06/12] hw/arm/aspeed: Introduce TYPE_ASPEED10X0_SOC
-This change works around the HW default values to be able to test the
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 Tacoma board with -kernel command line option. This was required when
 we had both flash chips enabled in the device tree, otherwise Linux
 would fail to probe the entire controller leaving it with no rootfs.
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+TYPE_ASPEED10X0_SOC inherits from TYPE_ASPEED_SOC.
-Message-Id: <20200819100956.2216690-20-clg@kaod.org>
+In few commits we'll add more fields, but to keep
 review process simple, don't add any yet.
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/ssi/aspeed_smc.c | 2 +-
+ include/hw/arm/aspeed_soc.h |  7 +++++++
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/arm/aspeed_ast10x0.c     | 26 +++++++++++++-------------
 files changed, 20 insertions(+), 13 deletions(-)
-diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/aspeed_smc.c
+--- a/include/hw/arm/aspeed_soc.h
-+++ b/hw/ssi/aspeed_smc.c
++++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reg_to_segment(const AspeedSMCState *s, uint32_t reg,
+@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
+ #define TYPE_ASPEED_SOC "aspeed-soc"
- static const AspeedSegments aspeed_segments_ast2600_fmc[] = {
+ OBJECT_DECLARE_TYPE(AspeedSoCState, AspeedSoCClass, ASPEED_SOC)
-     { 0x0, 128 * MiB }, /* start address is readonly */
--    { 0x0, 0 }, /* disabled */
++struct Aspeed10x0SoCState {
-+    { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
++    AspeedSoCState parent;
-     { 0x0, 0 }, /* disabled */
++};
 +
 +#define TYPE_ASPEED10X0_SOC "aspeed10x0-soc"
 +OBJECT_DECLARE_SIMPLE_TYPE(Aspeed10x0SoCState, ASPEED10X0_SOC)
 +
  struct AspeedSoCClass {
      DeviceClass parent_class;
 diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_ast10x0.c
 +++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_class_init(ObjectClass *klass, void *data)
      sc->get_irq = aspeed_soc_ast1030_get_irq;
  }
 -static const TypeInfo aspeed_soc_ast1030_type_info = {
 -    .name          = "ast1030-a1",
 -    .parent        = TYPE_ASPEED_SOC,
 -    .instance_size = sizeof(AspeedSoCState),
 -    .instance_init = aspeed_soc_ast1030_init,
 -    .class_init    = aspeed_soc_ast1030_class_init,
 -    .class_size    = sizeof(AspeedSoCClass),
 +static const TypeInfo aspeed_soc_ast10x0_types[] = {
 +    {
 +        .name           = TYPE_ASPEED10X0_SOC,
 +        .parent         = TYPE_ASPEED_SOC,
 +        .instance_size  = sizeof(Aspeed10x0SoCState),
 +        .abstract       = true,
 +    }, {
 +        .name           = "ast1030-a1",
 +        .parent         = TYPE_ASPEED10X0_SOC,
 +        .instance_init  = aspeed_soc_ast1030_init,
 +        .class_init     = aspeed_soc_ast1030_class_init,
 +    },
  };
+-static void aspeed_soc_register_types(void)
+-{
+-    type_register_static(&aspeed_soc_ast1030_type_info);
+-}
+-
+-type_init(aspeed_soc_register_types)
++DEFINE_TYPES(aspeed_soc_ast10x0_types)
 --
-.25.4
+.41.0

-[PULL 03/20] aspeed/scu: Fix valid access size on AST2400
+[PULL 07/12] hw/arm/aspeed: Introduce TYPE_ASPEED2600_SOC
-The read access size of the SCU registers can be 1/2/4 bytes and write
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 is 4 bytes and all Aspeed models would need a .valid.accepts() handler.
-For the moment, set the min access size to 1 byte to cover both read
+TYPE_ASPEED2600_SOC inherits from TYPE_ASPEED_SOC.
-and write operations on the AST2400 but keep the min access size of
+In few commits we'll add more fields, but to keep
-the other SoCs to 4 bytes as this is an unusual access size.
+review process simple, don't add any yet.
-This fixes support for some old firmware doing 2 bytes reads on the
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-AST2400 SoC.
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Reported-by: Erik Smit <erik.lucas.smit@gmail.com>
 Reviewed-by: Joel Stanley <joel@jms.id.au>
 Message-Id: <20200819100956.2216690-5-clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/misc/aspeed_scu.c | 7 ++++---
+ include/hw/arm/aspeed_soc.h |  7 +++++++
-file changed, 4 insertions(+), 3 deletions(-)
+ hw/arm/aspeed_ast2600.c     | 26 +++++++++++++-------------
 files changed, 20 insertions(+), 13 deletions(-)
-diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/aspeed_scu.c
+--- a/include/hw/arm/aspeed_soc.h
-+++ b/hw/misc/aspeed_scu.c
++++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_ast2400_scu_ops = {
+@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
-     .read = aspeed_scu_read,
+ #define TYPE_ASPEED_SOC "aspeed-soc"
-     .write = aspeed_ast2400_scu_write,
+ OBJECT_DECLARE_TYPE(AspeedSoCState, AspeedSoCClass, ASPEED_SOC)
-     .endianness = DEVICE_LITTLE_ENDIAN,
--    .valid.min_access_size = 4,
++struct Aspeed2600SoCState {
--    .valid.max_access_size = 4,
++    AspeedSoCState parent;
--    .valid.unaligned = false,
++};
-+    .valid = {
++
-+        .min_access_size = 1,
++#define TYPE_ASPEED2600_SOC "aspeed2600-soc"
-+        .max_access_size = 4,
++OBJECT_DECLARE_SIMPLE_TYPE(Aspeed2600SoCState, ASPEED2600_SOC)
 +
  struct Aspeed10x0SoCState {
      AspeedSoCState parent;
  };
 diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_ast2600.c
 +++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)
      sc->get_irq      = aspeed_soc_ast2600_get_irq;
  }
 -static const TypeInfo aspeed_soc_ast2600_type_info = {
 -    .name           = "ast2600-a3",
 -    .parent         = TYPE_ASPEED_SOC,
 -    .instance_size  = sizeof(AspeedSoCState),
 -    .instance_init  = aspeed_soc_ast2600_init,
 -    .class_init     = aspeed_soc_ast2600_class_init,
 -    .class_size     = sizeof(AspeedSoCClass),
 +static const TypeInfo aspeed_soc_ast2600_types[] = {
 +    {
 +        .name           = TYPE_ASPEED2600_SOC,
 +        .parent         = TYPE_ASPEED_SOC,
 +        .instance_size  = sizeof(Aspeed2600SoCState),
 +        .abstract       = true,
 +    }, {
 +        .name           = "ast2600-a3",
 +        .parent         = TYPE_ASPEED2600_SOC,
 +        .instance_init  = aspeed_soc_ast2600_init,
 +        .class_init     = aspeed_soc_ast2600_class_init,
 +    },
  };
- static const MemoryRegionOps aspeed_ast2500_scu_ops = {
+-static void aspeed_soc_register_types(void)
 -{
 -    type_register_static(&aspeed_soc_ast2600_type_info);
 -};
 -
 -type_init(aspeed_soc_register_types)
 +DEFINE_TYPES(aspeed_soc_ast2600_types)
 --
-.25.4
+.41.0

-[PULL 17/20] aspeed/sdmc: Simplify calculation of RAM bits
+[PULL 08/12] hw/arm/aspeed: Introduce TYPE_ASPEED2400_SOC
-Changes in commit 533eb415df2e ("arm/aspeed: actually check RAM size")
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 introduced a 'valid_ram_sizes' array which can be used to compute the
 associated bit field value encoding the RAM size. The field is simply
 the index of the array.
-Reviewed-by: Joel Stanley <joel@jms.id.au>
+TYPE_ASPEED2400_SOC inherits from TYPE_ASPEED_SOC.
-Message-Id: <20200819100956.2216690-19-clg@kaod.org>
+In few commits we'll add more fields, but to keep
 review process simple, don't add any yet.
 TYPE_ASPEED_SOC is common to various Aspeed SoCs,
 define it in aspeed_soc_common.c.
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/misc/aspeed_sdmc.c | 79 ++++++++++++++-----------------------------
+ include/hw/arm/aspeed_soc.h |  7 +++++
-file changed, 25 insertions(+), 54 deletions(-)
+ hw/arm/aspeed_soc.c         | 61 +++++++++++--------------------------
  hw/arm/aspeed_soc_common.c  | 29 ++++++++++++++++++
 files changed, 53 insertions(+), 44 deletions(-)
-diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/aspeed_sdmc.c
+--- a/include/hw/arm/aspeed_soc.h
-+++ b/hw/misc/aspeed_sdmc.c
++++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_sdmc_ops = {
+@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
-     .valid.max_access_size = 4,
+ #define TYPE_ASPEED_SOC "aspeed-soc"
  OBJECT_DECLARE_TYPE(AspeedSoCState, AspeedSoCClass, ASPEED_SOC)
 +struct Aspeed2400SoCState {
 +    AspeedSoCState parent;
 +};
 +
 +#define TYPE_ASPEED2400_SOC "aspeed2400-soc"
 +OBJECT_DECLARE_SIMPLE_TYPE(Aspeed2400SoCState, ASPEED2400_SOC)
 +
  struct Aspeed2600SoCState {
      AspeedSoCState parent;
  };
+diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
--static int ast2400_rambits(AspeedSDMCState *s)
+index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
                         aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
  }
 -static Property aspeed_soc_properties[] = {
 -    DEFINE_PROP_LINK("memory", AspeedSoCState, memory, TYPE_MEMORY_REGION,
 -                     MemoryRegion *),
 -    DEFINE_PROP_LINK("dram", AspeedSoCState, dram_mr, TYPE_MEMORY_REGION,
 -                     MemoryRegion *),
 -    DEFINE_PROP_END_OF_LIST(),
 -};
 -
 -static void aspeed_soc_class_init(ObjectClass *oc, void *data)
 -{
--    switch (s->ram_size >> 20) {
+-    DeviceClass *dc = DEVICE_CLASS(oc);
--    case 64:
+-
--        return ASPEED_SDMC_DRAM_64MB;
+-    device_class_set_props(dc, aspeed_soc_properties);
 -    case 128:
 -        return ASPEED_SDMC_DRAM_128MB;
 -    case 256:
 -        return ASPEED_SDMC_DRAM_256MB;
 -    case 512:
 -        return ASPEED_SDMC_DRAM_512MB;
 -    default:
 -        g_assert_not_reached();
 -        break;
 -    }
 -}
 -
--static int ast2500_rambits(AspeedSDMCState *s)
+-static const TypeInfo aspeed_soc_type_info = {
 -    .name           = TYPE_ASPEED_SOC,
 -    .parent         = TYPE_DEVICE,
 -    .instance_size  = sizeof(AspeedSoCState),
 -    .class_size     = sizeof(AspeedSoCClass),
 -    .class_init     = aspeed_soc_class_init,
 -    .abstract       = true,
 -};
  static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
  {
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
      sc->get_irq      = aspeed_soc_ast2400_get_irq;
  }
 -static const TypeInfo aspeed_soc_ast2400_type_info = {
 -    .name           = "ast2400-a1",
 -    .parent         = TYPE_ASPEED_SOC,
 -    .instance_init  = aspeed_ast2400_soc_init,
 -    .instance_size  = sizeof(AspeedSoCState),
 -    .class_init     = aspeed_soc_ast2400_class_init,
 -};
 -
  static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
  {
      AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
      sc->get_irq      = aspeed_soc_ast2400_get_irq;
  }
 -static const TypeInfo aspeed_soc_ast2500_type_info = {
 -    .name           = "ast2500-a1",
 -    .parent         = TYPE_ASPEED_SOC,
 -    .instance_init  = aspeed_ast2400_soc_init,
 -    .instance_size  = sizeof(AspeedSoCState),
 -    .class_init     = aspeed_soc_ast2500_class_init,
 -};
 -static void aspeed_soc_register_types(void)
 -{
--    switch (s->ram_size >> 20) {
+-    type_register_static(&aspeed_soc_type_info);
--    case 128:
+-    type_register_static(&aspeed_soc_ast2400_type_info);
--        return ASPEED_SDMC_AST2500_128MB;
+-    type_register_static(&aspeed_soc_ast2500_type_info);
--    case 256:
++static const TypeInfo aspeed_soc_ast2400_types[] = {
--        return ASPEED_SDMC_AST2500_256MB;
++    {
--    case 512:
++        .name           = TYPE_ASPEED2400_SOC,
--        return ASPEED_SDMC_AST2500_512MB;
++        .parent         = TYPE_ASPEED_SOC,
--    case 1024:
++        .instance_init  = aspeed_ast2400_soc_init,
--        return ASPEED_SDMC_AST2500_1024MB;
++        .instance_size  = sizeof(Aspeed2400SoCState),
--    default:
++        .abstract       = true,
--        g_assert_not_reached();
++    }, {
--        break;
++        .name           = "ast2400-a1",
--    }
++        .parent         = TYPE_ASPEED2400_SOC,
--}
++        .class_init     = aspeed_soc_ast2400_class_init,
--
++    }, {
--static int ast2600_rambits(AspeedSDMCState *s)
++        .name           = "ast2500-a1",
--{
++        .parent         = TYPE_ASPEED2400_SOC,
--    switch (s->ram_size >> 20) {
++        .class_init     = aspeed_soc_ast2500_class_init,
--    case 256:
++    },
 -        return ASPEED_SDMC_AST2600_256MB;
 -    case 512:
 -        return ASPEED_SDMC_AST2600_512MB;
 -    case 1024:
 -        return ASPEED_SDMC_AST2600_1024MB;
 -    case 2048:
 -        return ASPEED_SDMC_AST2600_2048MB;
 -    default:
 -        g_assert_not_reached();
 -        break;
 -    }
 -}
 -
  static void aspeed_sdmc_reset(DeviceState *dev)
  {
      AspeedSDMCState *s = ASPEED_SDMC(dev);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_sdmc_info = {
      .abstract   = true,
  };
-+static int aspeed_sdmc_get_ram_bits(AspeedSDMCState *s)
+-type_init(aspeed_soc_register_types);
 +DEFINE_TYPES(aspeed_soc_ast2400_types)
 diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc_common.c
 +++ b/hw/arm/aspeed_soc_common.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
 +#include "hw/qdev-properties.h"
  #include "hw/misc/unimp.h"
  #include "hw/arm/aspeed_soc.h"
  #include "hw/char/serial.h"
@@ -XXX,XX +XXX,XX @@ void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
      memory_region_add_subregion_overlap(s->memory, addr,
                                          sysbus_mmio_get_region(dev, 0), -1000);
  }
 +
 +static Property aspeed_soc_properties[] = {
 +    DEFINE_PROP_LINK("dram", AspeedSoCState, dram_mr, TYPE_MEMORY_REGION,
 +                     MemoryRegion *),
 +    DEFINE_PROP_LINK("memory", AspeedSoCState, memory, TYPE_MEMORY_REGION,
 +                     MemoryRegion *),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void aspeed_soc_class_init(ObjectClass *oc, void *data)
 +{
-+    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
++    DeviceClass *dc = DEVICE_CLASS(oc);
 +    int i;
 +
-+    /*
++    device_class_set_props(dc, aspeed_soc_properties);
 +     * The bitfield value encoding the RAM size is the index of the
 +     * possible RAM size array
 +     */
 +    for (i = 0; asc->valid_ram_sizes[i]; i++) {
 +        if (s->ram_size == asc->valid_ram_sizes[i]) {
 +            return i;
 +        }
 +    }
 +
 +    /*
 +     * Invalid RAM sizes should have been excluded when setting the
 +     * SoC RAM size.
 +     */
 +    g_assert_not_reached();
 +}
 +
- static uint32_t aspeed_2400_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
++static const TypeInfo aspeed_soc_types[] = {
- {
++    {
-     uint32_t fixed_conf = ASPEED_SDMC_VGA_COMPAT |
++        .name           = TYPE_ASPEED_SOC,
--        ASPEED_SDMC_DRAM_SIZE(ast2400_rambits(s));
++        .parent         = TYPE_DEVICE,
-+        ASPEED_SDMC_DRAM_SIZE(aspeed_sdmc_get_ram_bits(s));
++        .instance_size  = sizeof(AspeedSoCState),
++        .class_size     = sizeof(AspeedSoCClass),
-     /* Make sure readonly bits are kept */
++        .class_init     = aspeed_soc_class_init,
-     data &= ~ASPEED_SDMC_READONLY_MASK;
++        .abstract       = true,
-@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2500_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
++    },
-     uint32_t fixed_conf = ASPEED_SDMC_HW_VERSION(1) |
++};
-         ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
++
-         ASPEED_SDMC_CACHE_INITIAL_DONE |
++DEFINE_TYPES(aspeed_soc_types)
 -        ASPEED_SDMC_DRAM_SIZE(ast2500_rambits(s));
 +        ASPEED_SDMC_DRAM_SIZE(aspeed_sdmc_get_ram_bits(s));
      /* Make sure readonly bits are kept */
      data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2600_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
  {
      uint32_t fixed_conf = ASPEED_SDMC_HW_VERSION(3) |
          ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
 -        ASPEED_SDMC_DRAM_SIZE(ast2600_rambits(s));
 +        ASPEED_SDMC_DRAM_SIZE(aspeed_sdmc_get_ram_bits(s));
      /* Make sure readonly bits are kept (use ast2500 mask) */
      data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
 --
-.25.4
+.41.0

-[PULL 07/20] aspeed/sdhci: Fix reset sequence
+[PULL 09/12] hw/arm/aspeed: Check 'memory' link is set in common aspeed_soc_realize
-BIT(0) of the ASPEED_SDHCI_INFO register is set by SW and polled until
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 the bit is cleared by HW.
-Use the number of supported slots to define the default value of this
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-register (The AST2600 eMMC Controller only has one). Fix the reset
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
 sequence by clearing automatically the RESET bit.
 Cc: Eddie James <eajames@linux.ibm.com>
 Fixes: 2bea128c3d0b ("hw/sd/aspeed_sdhci: New device")
 Reviewed-by: Joel Stanley <joel@jms.id.au>
 Message-Id: <20200819100956.2216690-9-clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/sd/aspeed_sdhci.c | 14 ++++++++++++--
+ hw/arm/aspeed_soc_common.c | 11 +++++++++++
-file changed, 12 insertions(+), 2 deletions(-)
+file changed, 11 insertions(+)
-diff --git a/hw/sd/aspeed_sdhci.c b/hw/sd/aspeed_sdhci.c
+diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/aspeed_sdhci.c
+--- a/hw/arm/aspeed_soc_common.c
-+++ b/hw/sd/aspeed_sdhci.c
++++ b/hw/arm/aspeed_soc_common.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
- #include "hw/qdev-properties.h"
+                                         sysbus_mmio_get_region(dev, 0), -1000);
+ }
- #define ASPEED_SDHCI_INFO            0x00
--#define  ASPEED_SDHCI_INFO_RESET     0x00030000
++static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-+#define  ASPEED_SDHCI_INFO_SLOT1     (1 << 17)
++{
-+#define  ASPEED_SDHCI_INFO_SLOT0     (1 << 16)
++    AspeedSoCState *s = ASPEED_SOC(dev);
 +#define  ASPEED_SDHCI_INFO_RESET     (1 << 0)
  #define ASPEED_SDHCI_DEBOUNCE        0x04
  #define  ASPEED_SDHCI_DEBOUNCE_RESET 0x00000005
  #define ASPEED_SDHCI_BUS             0x08
@@ -XXX,XX +XXX,XX @@ static void aspeed_sdhci_write(void *opaque, hwaddr addr, uint64_t val,
      AspeedSDHCIState *sdhci = opaque;
      switch (addr) {
 +    case ASPEED_SDHCI_INFO:
 +        /* The RESET bit automatically clears. */
 +        sdhci->regs[TO_REG(addr)] = (uint32_t)val & ~ASPEED_SDHCI_INFO_RESET;
 +        break;
      case ASPEED_SDHCI_SDIO_140:
          sdhci->slots[0].capareg = (uint64_t)(uint32_t)val;
          break;
@@ -XXX,XX +XXX,XX @@ static void aspeed_sdhci_reset(DeviceState *dev)
      AspeedSDHCIState *sdhci = ASPEED_SDHCI(dev);
      memset(sdhci->regs, 0, ASPEED_SDHCI_REG_SIZE);
 -    sdhci->regs[TO_REG(ASPEED_SDHCI_INFO)] = ASPEED_SDHCI_INFO_RESET;
 +
-+    sdhci->regs[TO_REG(ASPEED_SDHCI_INFO)] = ASPEED_SDHCI_INFO_SLOT0;
++    if (!s->memory) {
-+    if (sdhci->num_slots == 2) {
++        error_setg(errp, "'memory' link is not set");
-+        sdhci->regs[TO_REG(ASPEED_SDHCI_INFO)] |= ASPEED_SDHCI_INFO_SLOT1;
++        return;
 +    }
-     sdhci->regs[TO_REG(ASPEED_SDHCI_DEBOUNCE)] = ASPEED_SDHCI_DEBOUNCE_RESET;
++}
 +
  static Property aspeed_soc_properties[] = {
      DEFINE_PROP_LINK("dram", AspeedSoCState, dram_mr, TYPE_MEMORY_REGION,
                       MemoryRegion *),
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 +    dc->realize = aspeed_soc_realize;
      device_class_set_props(dc, aspeed_soc_properties);
  }
 --
-.25.4
+.41.0

-[PULL 14/20] ftgmac100: Improve software reset
+[PULL 10/12] hw/arm/aspeed: Move AspeedSoCState::armv7m to Aspeed10x0SoCState
-The software reset of the MAC needs a finer granularity. Some settings
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 in MACCR are kept.
-Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
+The v7-M core is specific to the Aspeed 10x0 series,
-Fixes: bd44300d1afc ("net: add FTGMAC100 support")
+remove it from the common AspeedSoCState.
-Message-Id: <20200819100956.2216690-16-clg@kaod.org>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/net/ftgmac100.c | 18 +++++++++++++-----
+ include/hw/arm/aspeed_soc.h |  5 ++---
-file changed, 13 insertions(+), 5 deletions(-)
+ hw/arm/aspeed_ast10x0.c     | 27 +++++++++++++++------------
  hw/arm/fby35.c              | 13 ++++++++-----
 files changed, 25 insertions(+), 20 deletions(-)
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
+--- a/include/hw/arm/aspeed_soc.h
-+++ b/hw/net/ftgmac100.c
++++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@ static uint32_t ftgmac100_rxpoll(FTGMAC100State *s)
+@@ -XXX,XX +XXX,XX @@
-     return cnt / div[speed];
+ #define ASPEED_JTAG_NUM  2
  struct AspeedSoCState {
 -    /*< private >*/
      DeviceState parent;
 -    /*< public >*/
      ARMCPU cpu[ASPEED_CPUS_NUM];
      A15MPPrivState     a7mpcore;
 -    ARMv7MState        armv7m;
      MemoryRegion *memory;
      MemoryRegion *dram_mr;
      MemoryRegion dram_container;
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Aspeed2600SoCState, ASPEED2600_SOC)
  struct Aspeed10x0SoCState {
      AspeedSoCState parent;
 +
 +    ARMv7MState armv7m;
  };
  #define TYPE_ASPEED10X0_SOC "aspeed10x0-soc"
 diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_ast10x0.c
 +++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast1030_irqmap[] = {
  static qemu_irq aspeed_soc_ast1030_get_irq(AspeedSoCState *s, int dev)
  {
 +    Aspeed10x0SoCState *a = ASPEED10X0_SOC(s);
      AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 -    return qdev_get_gpio_in(DEVICE(&s->armv7m), sc->irqmap[dev]);
 +    return qdev_get_gpio_in(DEVICE(&a->armv7m), sc->irqmap[dev]);
  }
--static void ftgmac100_reset(DeviceState *d)
+ static void aspeed_soc_ast1030_init(Object *obj)
 +static void ftgmac100_do_reset(FTGMAC100State *s, bool sw_reset)
  {
--    FTGMAC100State *s = FTGMAC100(d);
++    Aspeed10x0SoCState *a = ASPEED10X0_SOC(obj);
--
+     AspeedSoCState *s = ASPEED_SOC(obj);
-     /* Reset the FTGMAC100 */
+     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-     s->isr = 0;
+     char socname[8];
-     s->ier = 0;
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_init(Object *obj)
-@@ -XXX,XX +XXX,XX @@ static void ftgmac100_reset(DeviceState *d)
+         g_assert_not_reached();
-     s->fear1 = 0;
+     }
-     s->tpafcr = 0xf1;
+-    object_initialize_child(obj, "armv7m", &s->armv7m, TYPE_ARMV7M);
--    s->maccr = 0;
++    object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
-+    if (sw_reset) {
-+        s->maccr &= FTGMAC100_MACCR_GIGA_MODE | FTGMAC100_MACCR_FAST_MODE;
+     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
-+    } else {
-+        s->maccr = 0;
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_init(Object *obj)
-+    }
  static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
  {
 +    Aspeed10x0SoCState *a = ASPEED10X0_SOC(dev_soc);
      AspeedSoCState *s = ASPEED_SOC(dev_soc);
      AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
      DeviceState *armv7m;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
 x40000);
      /* AST1030 CPU Core */
 -    armv7m = DEVICE(&s->armv7m);
 +    armv7m = DEVICE(&a->armv7m);
      qdev_prop_set_uint32(armv7m, "num-irq", 256);
      qdev_prop_set_string(armv7m, "cpu-type", sc->cpu_type);
      qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
 -    object_property_set_link(OBJECT(&s->armv7m), "memory",
 +    object_property_set_link(OBJECT(&a->armv7m), "memory",
                               OBJECT(s->memory), &error_abort);
 -    sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), &error_abort);
 +    sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
      /* Internal SRAM */
      sram_name = g_strdup_printf("aspeed.sram.%d",
 -                                CPU(s->armv7m.cpu)->cpu_index);
 +                                CPU(a->armv7m.cpu)->cpu_index);
      memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size, &err);
      if (err != NULL) {
          error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
      }
      aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
      for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
 -        qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->armv7m),
 +        qemu_irq irq = qdev_get_gpio_in(DEVICE(&a->armv7m),
                                          sc->irqmap[ASPEED_DEV_I2C] + i);
          /* The AST1030 I2C controller has one IRQ per bus. */
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c.busses[i]), 0, irq);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
      }
      aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i3c), 0, sc->memmap[ASPEED_DEV_I3C]);
      for (i = 0; i < ASPEED_I3C_NR_DEVICES; i++) {
 -        qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->armv7m),
 +        qemu_irq irq = qdev_get_gpio_in(DEVICE(&a->armv7m),
                                          sc->irqmap[ASPEED_DEV_I3C] + i);
          /* The AST1030 I3C controller has one IRQ per bus. */
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->i3c.devices[i]), 0, irq);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
       * On the AST1030 LPC subdevice IRQs are connected straight to the GIC.
       */
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_1,
 -                       qdev_get_gpio_in(DEVICE(&s->armv7m),
 +                       qdev_get_gpio_in(DEVICE(&a->armv7m),
                                  sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_1));
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_2,
 -                       qdev_get_gpio_in(DEVICE(&s->armv7m),
 +                       qdev_get_gpio_in(DEVICE(&a->armv7m),
                                  sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_2));
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_3,
 -                       qdev_get_gpio_in(DEVICE(&s->armv7m),
 +                       qdev_get_gpio_in(DEVICE(&a->armv7m),
                                  sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_3));
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_4,
 -                       qdev_get_gpio_in(DEVICE(&s->armv7m),
 +                       qdev_get_gpio_in(DEVICE(&a->armv7m),
                                  sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_4));
      /* UART */
 diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fby35.c
 +++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@ struct Fby35State {
      Clock *bic_sysclk;
      AspeedSoCState bmc;
 -    AspeedSoCState bic;
 +    Aspeed10x0SoCState bic;
      bool mmio_exec;
  };
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
  static void fby35_bic_init(Fby35State *s)
  {
 +    AspeedSoCState *soc;
 +
-     s->phycr = 0;
+     s->bic_sysclk = clock_new(OBJECT(s), "SYSCLK");
-     s->phydata = 0;
+     clock_set_hz(s->bic_sysclk, 200000000ULL);
-     s->fcr = 0x400;
-@@ -XXX,XX +XXX,XX @@ static void ftgmac100_reset(DeviceState *d)
+     object_initialize_child(OBJECT(s), "bic", &s->bic, "ast1030-a1");
-     phy_reset(s);
++    soc = ASPEED_SOC(&s->bic);
      memory_region_init(&s->bic_memory, OBJECT(&s->bic), "bic-memory",
                         UINT64_MAX);
@@ -XXX,XX +XXX,XX @@ static void fby35_bic_init(Fby35State *s)
      qdev_connect_clock_in(DEVICE(&s->bic), "sysclk", s->bic_sysclk);
      object_property_set_link(OBJECT(&s->bic), "memory", OBJECT(&s->bic_memory),
                               &error_abort);
 -    aspeed_soc_uart_set_chr(&s->bic, ASPEED_DEV_UART5, serial_hd(1));
 +    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART5, serial_hd(1));
      qdev_realize(DEVICE(&s->bic), NULL, &error_abort);
 -    aspeed_board_init_flashes(&s->bic.fmc, "sst25vf032b", 2, 2);
 -    aspeed_board_init_flashes(&s->bic.spi[0], "sst25vf032b", 2, 4);
 -    aspeed_board_init_flashes(&s->bic.spi[1], "sst25vf032b", 2, 6);
 +    aspeed_board_init_flashes(&soc->fmc, "sst25vf032b", 2, 2);
 +    aspeed_board_init_flashes(&soc->spi[0], "sst25vf032b", 2, 4);
 +    aspeed_board_init_flashes(&soc->spi[1], "sst25vf032b", 2, 6);
  }
-+static void ftgmac100_reset(DeviceState *d)
+ static void fby35_init(MachineState *machine)
 +{
 +    ftgmac100_do_reset(FTGMAC100(d), false);
 +}
 +
  static uint64_t ftgmac100_read(void *opaque, hwaddr addr, unsigned size)
  {
      FTGMAC100State *s = FTGMAC100(opaque);
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_write(void *opaque, hwaddr addr,
      case FTGMAC100_MACCR: /* MAC Device control */
          s->maccr = value;
          if (value & FTGMAC100_MACCR_SW_RST) {
 -            ftgmac100_reset(DEVICE(s));
 +            ftgmac100_do_reset(s, true);
          }
          if (ftgmac100_can_receive(qemu_get_queue(s->nic))) {
 --
-.25.4
+.41.0

-[PULL 05/20] aspeed/smc: Fix MemoryRegionOps definition
+[PULL 11/12] hw/arm/aspeed: Move AspeedSoCState::a7mpcore to Aspeed2600SoCState
-Unaligned access support is a leftover from the initial commit. There
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-is no such need on this device register mapping. Remove it.
+The v7-A cluster is specific to the Aspeed 2600 series,
-Cc: Michael S. Tsirkin <mst@redhat.com>
+remove it from the common AspeedSoCState.
-Reviewed-by: Joel Stanley <joel@jms.id.au>
-Message-Id: <20200819100956.2216690-7-clg@kaod.org>
+The ARM cores belong to the MP cluster, but the array
 is currently used by TYPE_ASPEED2600_SOC. We'll clean
 that soon, but for now keep it in Aspeed2600SoCState.
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/ssi/aspeed_smc.c | 2 --
+ include/hw/arm/aspeed_soc.h |  4 ++-
-file changed, 2 deletions(-)
+ hw/arm/aspeed_ast2600.c     | 49 ++++++++++++++++++++-----------------
+ hw/arm/fby35.c              | 14 ++++++-----
-diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
+files changed, 37 insertions(+), 30 deletions(-)
 diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/aspeed_smc.c
+--- a/include/hw/arm/aspeed_soc.h
-+++ b/hw/ssi/aspeed_smc.c
++++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_smc_ops = {
+@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
-     .read = aspeed_smc_read,
+     DeviceState parent;
-     .write = aspeed_smc_write,
-     .endianness = DEVICE_LITTLE_ENDIAN,
+     ARMCPU cpu[ASPEED_CPUS_NUM];
--    .valid.unaligned = true,
+-    A15MPPrivState     a7mpcore;
      MemoryRegion *memory;
      MemoryRegion *dram_mr;
      MemoryRegion dram_container;
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Aspeed2400SoCState, ASPEED2400_SOC)
  struct Aspeed2600SoCState {
      AspeedSoCState parent;
 +
 +    A15MPPrivState a7mpcore;
 +    ARMCPU cpu[ASPEED_CPUS_NUM]; /* XXX belong to a7mpcore */
  };
--
+ #define TYPE_ASPEED2600_SOC "aspeed2600-soc"
- /*
+diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
-  * Initialize the custom address spaces for DMAs
+index XXXXXXX..XXXXXXX 100644
-  */
+--- a/hw/arm/aspeed_ast2600.c
 +++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2600_irqmap[] = {
  static qemu_irq aspeed_soc_ast2600_get_irq(AspeedSoCState *s, int dev)
  {
 +    Aspeed2600SoCState *a = ASPEED2600_SOC(s);
      AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 -    return qdev_get_gpio_in(DEVICE(&s->a7mpcore), sc->irqmap[dev]);
 +    return qdev_get_gpio_in(DEVICE(&a->a7mpcore), sc->irqmap[dev]);
  }
  static void aspeed_soc_ast2600_init(Object *obj)
  {
 +    Aspeed2600SoCState *a = ASPEED2600_SOC(obj);
      AspeedSoCState *s = ASPEED_SOC(obj);
      AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
      int i;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
      }
      for (i = 0; i < sc->num_cpus; i++) {
 -        object_initialize_child(obj, "cpu[*]", &s->cpu[i], sc->cpu_type);
 +        object_initialize_child(obj, "cpu[*]", &a->cpu[i], sc->cpu_type);
      }
      snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
      object_property_add_alias(obj, "hw-prot-key", OBJECT(&s->scu),
                                "hw-prot-key");
 -    object_initialize_child(obj, "a7mpcore", &s->a7mpcore,
 +    object_initialize_child(obj, "a7mpcore", &a->a7mpcore,
                              TYPE_A15MPCORE_PRIV);
      object_initialize_child(obj, "rtc", &s->rtc, TYPE_ASPEED_RTC);
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_calc_affinity(int cpu)
  static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
  {
      int i;
 +    Aspeed2600SoCState *a = ASPEED2600_SOC(dev);
      AspeedSoCState *s = ASPEED_SOC(dev);
      AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
      Error *err = NULL;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
      /* CPU */
      for (i = 0; i < sc->num_cpus; i++) {
          if (sc->num_cpus > 1) {
 -            object_property_set_int(OBJECT(&s->cpu[i]), "reset-cbar",
 +            object_property_set_int(OBJECT(&a->cpu[i]), "reset-cbar",
                                      ASPEED_A7MPCORE_ADDR, &error_abort);
          }
 -        object_property_set_int(OBJECT(&s->cpu[i]), "mp-affinity",
 +        object_property_set_int(OBJECT(&a->cpu[i]), "mp-affinity",
                                  aspeed_calc_affinity(i), &error_abort);
 -        object_property_set_int(OBJECT(&s->cpu[i]), "cntfrq", 1125000000,
 +        object_property_set_int(OBJECT(&a->cpu[i]), "cntfrq", 1125000000,
                                  &error_abort);
 -        object_property_set_bool(OBJECT(&s->cpu[i]), "neon", false,
 +        object_property_set_bool(OBJECT(&a->cpu[i]), "neon", false,
                                  &error_abort);
 -        object_property_set_bool(OBJECT(&s->cpu[i]), "vfp-d32", false,
 +        object_property_set_bool(OBJECT(&a->cpu[i]), "vfp-d32", false,
                                  &error_abort);
 -        object_property_set_link(OBJECT(&s->cpu[i]), "memory",
 +        object_property_set_link(OBJECT(&a->cpu[i]), "memory",
                                   OBJECT(s->memory), &error_abort);
 -        if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
 +        if (!qdev_realize(DEVICE(&a->cpu[i]), NULL, errp)) {
              return;
          }
      }
      /* A7MPCORE */
 -    object_property_set_int(OBJECT(&s->a7mpcore), "num-cpu", sc->num_cpus,
 +    object_property_set_int(OBJECT(&a->a7mpcore), "num-cpu", sc->num_cpus,
                              &error_abort);
 -    object_property_set_int(OBJECT(&s->a7mpcore), "num-irq",
 +    object_property_set_int(OBJECT(&a->a7mpcore), "num-irq",
                              ROUND_UP(AST2600_MAX_IRQ + GIC_INTERNAL, 32),
                              &error_abort);
 -    sysbus_realize(SYS_BUS_DEVICE(&s->a7mpcore), &error_abort);
 -    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->a7mpcore), 0, ASPEED_A7MPCORE_ADDR);
 +    sysbus_realize(SYS_BUS_DEVICE(&a->a7mpcore), &error_abort);
 +    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->a7mpcore), 0, ASPEED_A7MPCORE_ADDR);
      for (i = 0; i < sc->num_cpus; i++) {
 -        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->a7mpcore);
 -        DeviceState  *d   = DEVICE(&s->cpu[i]);
 +        SysBusDevice *sbd = SYS_BUS_DEVICE(&a->a7mpcore);
 +        DeviceState  *d   = DEVICE(&a->cpu[i]);
          irq = qdev_get_gpio_in(d, ARM_CPU_IRQ);
          sysbus_connect_irq(sbd, i, irq);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
      }
      /* SRAM */
 -    sram_name = g_strdup_printf("aspeed.sram.%d", CPU(&s->cpu[0])->cpu_index);
 +    sram_name = g_strdup_printf("aspeed.sram.%d", CPU(&a->cpu[0])->cpu_index);
      memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size, &err);
      if (err) {
          error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
      }
      aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
      for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
 -        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 +        irq = qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                 sc->irqmap[ASPEED_DEV_I2C] + i);
          /* The AST2600 I2C controller has one IRQ per bus. */
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c.busses[i]), 0, irq);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
       * offset 0.
       */
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_1,
 -                       qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 +                       qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                  sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_1));
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_2,
 -                       qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 +                       qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                  sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_2));
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_3,
 -                       qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 +                       qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                  sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_3));
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_4,
 -                       qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 +                       qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                  sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_4));
      /* HACE */
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
      }
      aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i3c), 0, sc->memmap[ASPEED_DEV_I3C]);
      for (i = 0; i < ASPEED_I3C_NR_DEVICES; i++) {
 -        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore),
 +        irq = qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                 sc->irqmap[ASPEED_DEV_I3C] + i);
          /* The AST2600 I3C controller has one IRQ per bus. */
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->i3c.devices[i]), 0, irq);
 diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fby35.c
 +++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@ struct Fby35State {
      MemoryRegion bic_memory;
      Clock *bic_sysclk;
 -    AspeedSoCState bmc;
 +    Aspeed2600SoCState bmc;
      Aspeed10x0SoCState bic;
      bool mmio_exec;
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_write_boot_rom(DriveInfo *dinfo, MemoryRegion *mr,
  static void fby35_bmc_init(Fby35State *s)
  {
 +    AspeedSoCState *soc;
 +
      object_initialize_child(OBJECT(s), "bmc", &s->bmc, "ast2600-a3");
 +    soc = ASPEED_SOC(&s->bmc);
      memory_region_init(&s->bmc_memory, OBJECT(&s->bmc), "bmc-memory",
                         UINT64_MAX);
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
                              &error_abort);
      object_property_set_int(OBJECT(&s->bmc), "hw-strap2", 0x00000003,
                              &error_abort);
 -    aspeed_soc_uart_set_chr(&s->bmc, ASPEED_DEV_UART5, serial_hd(0));
 +    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART5, serial_hd(0));
      qdev_realize(DEVICE(&s->bmc), NULL, &error_abort);
 -    aspeed_board_init_flashes(&s->bmc.fmc, "n25q00", 2, 0);
 +    aspeed_board_init_flashes(&soc->fmc, "n25q00", 2, 0);
      /* Install first FMC flash content as a boot rom. */
      if (!s->mmio_exec) {
          DriveInfo *mtd0 = drive_get(IF_MTD, 0, 0);
          if (mtd0) {
 -            AspeedSoCState *bmc = &s->bmc;
 -            uint64_t rom_size = memory_region_size(&bmc->spi_boot);
 +            uint64_t rom_size = memory_region_size(&soc->spi_boot);
              memory_region_init_rom(&s->bmc_boot_rom, NULL, "aspeed.boot_rom",
                                     rom_size, &error_abort);
 -            memory_region_add_subregion_overlap(&bmc->spi_boot_container, 0,
 +            memory_region_add_subregion_overlap(&soc->spi_boot_container, 0,
                                                  &s->bmc_boot_rom, 1);
              fby35_bmc_write_boot_rom(mtd0, &s->bmc_boot_rom,
 --
-.25.4
+.41.0

-[PULL 06/20] aspeed/smc: Fix max_slaves of the legacy SMC device
+Deleted patch
-The legacy controller only has one slave.
-Reviewed-by: Joel Stanley <joel@jms.id.au>
-Message-Id: <20200819100956.2216690-8-clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/ssi/aspeed_smc.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/aspeed_smc.c
-+++ b/hw/ssi/aspeed_smc.c
-@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
-         .r_timings         = R_TIMINGS,
-         .nregs_timings     = 1,
-         .conf_enable_w0    = CONF_ENABLE_W0,
--        .max_slaves        = 5,
-+        .max_slaves        = 1,
-         .segments          = aspeed_segments_legacy,
-         .flash_window_base = ASPEED_SOC_SMC_FLASH_BASE,
-         .flash_window_size = 0x6000000,
---
-.25.4

-[PULL 08/20] ftgmac100: Fix registers that can be read
+Deleted patch
-Receive Ring Base Address Register (RXR_BADR) and the Normal Priority
-Transmit Receive Ring Base Address Register (NPTXR_BADR) can also be
-read.
-Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
-Message-Id: <20200819100956.2216690-10-clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/net/ftgmac100.c | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
-+++ b/hw/net/ftgmac100.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t ftgmac100_read(void *opaque, hwaddr addr, unsigned size)
-         return s->math[0];
-     case FTGMAC100_MATH1:
-         return s->math[1];
-+    case FTGMAC100_RXR_BADR:
-+        return s->rx_ring;
-+    case FTGMAC100_NPTXR_BADR:
-+        return s->tx_ring;
-     case FTGMAC100_ITC:
-         return s->itc;
-     case FTGMAC100_DBLAC:
---
-.25.4

-[PULL 09/20] ftgmac100: Fix interrupt status "Packet transmitted on ethernet"
+Deleted patch
-The second field of the TX descriptor has a set of flags to choose
-when the transmit interrupt is raised : after the packet has been sent
-on the ethernet or after it has been moved into the TX FIFO. But we
-don't model that today.
-Simply raise the "Packet transmitted on ethernet" interrupt status bit
-as soon as the packet is sent by QEMU.
-Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
-Message-Id: <20200819100956.2216690-11-clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/net/ftgmac100.c | 4 +---
-file changed, 1 insertion(+), 3 deletions(-)
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
-+++ b/hw/net/ftgmac100.c
-@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
-             qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size);
-             ptr = s->frame;
-             frame_size = 0;
--            if (flags & FTGMAC100_TXDES1_TXIC) {
--                s->isr |= FTGMAC100_INT_XPKT_ETH;
--            }
-+            s->isr |= FTGMAC100_INT_XPKT_ETH;
-         }
-         if (flags & FTGMAC100_TXDES1_TX2FIC) {
---
-.25.4

-[PULL 10/20] ftgmac100: Fix interrupt status "Packet moved to RX FIFO"
+Deleted patch
-As we don't model the RX or TX FIFO, raise the "Packet moved to RX
-FIFO" interrupt status bit as soon as we are handling a RX packet.
-Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
-Message-Id: <20200819100956.2216690-12-clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/net/ftgmac100.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
-+++ b/hw/net/ftgmac100.c
-@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
-         break;
-     }
-+    s->isr |= FTGMAC100_INT_RPKT_FIFO;
-     addr = s->rx_descriptor;
-     while (size > 0) {
-         if (!ftgmac100_can_receive(nc)) {
-@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
-             /* Last buffer in frame.  */
-             bd.des0 |= flags | FTGMAC100_RXDES0_LRS;
-             s->isr |= FTGMAC100_INT_RPKT_BUF;
--        } else {
--            s->isr |= FTGMAC100_INT_RPKT_FIFO;
-         }
-         ftgmac100_write_bd(&bd, addr);
-         if (bd.des0 & s->rxdes0_edorr) {
---
-.25.4

-[PULL 12/20] ftgmac100: Check for invalid len and address before doing a DMA transfer
+Deleted patch
-According to the Aspeed specs, no interrupts are raised in that case
-but a "Tx-packets lost" status seems like a good modeling choice for
-all implementations. It is covered by the Linux kernel.
-Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
-Message-Id: <20200819100956.2216690-14-clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/net/ftgmac100.c | 9 +++++++++
-file changed, 9 insertions(+)
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
-+++ b/hw/net/ftgmac100.c
-@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
-         }
-         len = FTGMAC100_TXDES0_TXBUF_SIZE(bd.des0);
-+        if (!len) {
-+            /*
-+             * 0 is an invalid size, however the HW does not raise any
-+             * interrupt. Flag an error because the guest is buggy.
-+             */
-+            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid segment size\n",
-+                          __func__);
-+        }
-+
-         if (frame_size + len > sizeof(s->frame)) {
-             qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
-                           __func__, len);
---
-.25.4

-[PULL 15/20] aspeed/sdmc: Perform memory training
+[PULL 12/12] hw/arm/aspeed: Move AspeedSoCState::cpu/vic to Aspeed2400SoCState
-From: Joel Stanley <joel@jms.id.au>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-This allows qemu to run the "normal" power on reset boot path through
+The ARM array and VIC peripheral are only used by the
-u-boot, where the DDR is trained.
+series, remove them from the common AspeedSoCState.
-An enhancement would be to have the SCU bit stick across qemu reboots,
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-but be unset on initial boot.
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Proper modelling would be to discard all writes to the phy setting regs
 at offset 0x100 - 0x400 and to model the phy status regs at offset
 x400.
 The status regs model would only need to account for offets 0x00,
 x50, 0x68 and 0x7c.
 Signed-off-by: Joel Stanley <joel@jms.id.au>
 [ clg: checkpatch fixes ]
 Message-Id: <20200819100956.2216690-17-clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- include/hw/misc/aspeed_sdmc.h | 13 ++++++++++++-
+ include/hw/arm/aspeed_soc.h               |  5 +++--
- hw/misc/aspeed_scu.c          |  2 +-
+ hw/arm/{aspeed_soc.c => aspeed_ast2400.c} | 27 +++++++++++++----------
- hw/misc/aspeed_sdmc.c         | 19 +++++++++++++++++--
+ hw/arm/meson.build                        |  2 +-
-files changed, 30 insertions(+), 4 deletions(-)
+files changed, 19 insertions(+), 15 deletions(-)
  rename hw/arm/{aspeed_soc.c => aspeed_ast2400.c} (95%)
-diff --git a/include/hw/misc/aspeed_sdmc.h b/include/hw/misc/aspeed_sdmc.h
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/aspeed_sdmc.h
+--- a/include/hw/arm/aspeed_soc.h
-+++ b/include/hw/misc/aspeed_sdmc.h
++++ b/include/hw/arm/aspeed_soc.h
 @@ -XXX,XX +XXX,XX @@
- #define TYPE_ASPEED_2500_SDMC TYPE_ASPEED_SDMC "-ast2500"
+ struct AspeedSoCState {
- #define TYPE_ASPEED_2600_SDMC TYPE_ASPEED_SDMC "-ast2600"
+     DeviceState parent;
--#define ASPEED_SDMC_NR_REGS (0x174 >> 2)
+-    ARMCPU cpu[ASPEED_CPUS_NUM];
-+/*
+     MemoryRegion *memory;
-+ * SDMC has 174 documented registers. In addition the u-boot device tree
+     MemoryRegion *dram_mr;
-+ * describes the following regions:
+     MemoryRegion dram_container;
-+ *  - PHY status regs at offset 0x400, length 0x200
+     MemoryRegion sram;
-+ *  - PHY setting regs at offset 0x100, length 0x300
+     MemoryRegion spi_boot_container;
-+ *
+     MemoryRegion spi_boot;
-+ * There are two sets of MRS (Mode Registers) configuration in ast2600 memory
+-    AspeedVICState vic;
-+ * system: one is in the SDRAM MC (memory controller) which is used in run
+     AspeedRtcState rtc;
-+ * time, and the other is in the DDR-PHY IP which is used during DDR-PHY
+     AspeedTimerCtrlState timerctrl;
-+ * training.
+     AspeedI2CState i2c;
-+ */
+@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(AspeedSoCState, AspeedSoCClass, ASPEED_SOC)
-+#define ASPEED_SDMC_NR_REGS (0x500 >> 2)
+ struct Aspeed2400SoCState {
- typedef struct AspeedSDMCState {
+     AspeedSoCState parent;
-     /*< private >*/
++
-diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
++    ARMCPU cpu[ASPEED_CPUS_NUM];
 +    AspeedVICState vic;
  };
  #define TYPE_ASPEED2400_SOC "aspeed2400-soc"
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_ast2400.c
 similarity index 95%
 rename from hw/arm/aspeed_soc.c
 rename to hw/arm/aspeed_ast2400.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/aspeed_scu.c
+--- a/hw/arm/aspeed_soc.c
-+++ b/hw/misc/aspeed_scu.c
++++ b/hw/arm/aspeed_ast2400.c
-@@ -XXX,XX +XXX,XX @@ static const uint32_t ast2600_a1_resets[ASPEED_AST2600_SCU_NR_REGS] = {
+@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2400_irqmap[] = {
-     [AST2600_SYS_RST_CTRL2]     = 0xFFFFFFFC,
-     [AST2600_CLK_STOP_CTRL]     = 0xFFFF7F8A,
+ static qemu_irq aspeed_soc_ast2400_get_irq(AspeedSoCState *s, int dev)
-     [AST2600_CLK_STOP_CTRL2]    = 0xFFF0FFF0,
+ {
--    [AST2600_SDRAM_HANDSHAKE]   = 0x00000040,  /* SoC completed DRAM init */
++    Aspeed2400SoCState *a = ASPEED2400_SOC(s);
-+    [AST2600_SDRAM_HANDSHAKE]   = 0x00000000,
+     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-     [AST2600_HPLL_PARAM]        = 0x1000405F,
-     [AST2600_CHIP_ID0]          = 0x1234ABCD,
+-    return qdev_get_gpio_in(DEVICE(&s->vic), sc->irqmap[dev]);
-     [AST2600_CHIP_ID1]          = 0x88884444,
++    return qdev_get_gpio_in(DEVICE(&a->vic), sc->irqmap[dev]);
-diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
+ }
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/aspeed_sdmc.c
+ static void aspeed_ast2400_soc_init(Object *obj)
-+++ b/hw/misc/aspeed_sdmc.c
+ {
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_sdmc_read(void *opaque, hwaddr addr, unsigned size)
++    Aspeed2400SoCState *a = ASPEED2400_SOC(obj);
-     if (addr >= ARRAY_SIZE(s->regs)) {
+     AspeedSoCState *s = ASPEED_SOC(obj);
-         qemu_log_mask(LOG_GUEST_ERROR,
+     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-                       "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
+     int i;
--                      __func__, addr);
+@@ -XXX,XX +XXX,XX @@ static void aspeed_ast2400_soc_init(Object *obj)
 +                      __func__, addr * 4);
          return 0;
      }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_reset(DeviceState *dev)
+     for (i = 0; i < sc->num_cpus; i++) {
+-        object_initialize_child(obj, "cpu[*]", &s->cpu[i], sc->cpu_type);
-     /* Set ram size bit and defaults values */
++        object_initialize_child(obj, "cpu[*]", &a->cpu[i], sc->cpu_type);
      s->regs[R_CONF] = asc->compute_conf(s, 0);
 +
 +    /*
 +     * PHY status:
 +     *  - set phy status ok (set bit 1)
 +     *  - initial PVT calibration ok (clear bit 3)
 +     *  - runtime calibration ok (clear bit 5)
 +     */
 +    s->regs[0x100] = BIT(1);
 +
 +    /* PHY eye window: set all as passing */
 +    s->regs[0x100 | (0x68 / 4)] = 0xff;
 +    s->regs[0x100 | (0x7c / 4)] = 0xff;
 +    s->regs[0x100 | (0x50 / 4)] = 0xfffffff;
  }
  static void aspeed_sdmc_get_ram_size(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void aspeed_2600_sdmc_write(AspeedSDMCState *s, uint32_t reg,
      }
-     if (reg != R_PROT && s->regs[R_PROT] == PROT_SOFTLOCKED) {
+     snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
--        qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);
+@@ -XXX,XX +XXX,XX @@ static void aspeed_ast2400_soc_init(Object *obj)
-+        qemu_log_mask(LOG_GUEST_ERROR,
+     object_property_add_alias(obj, "hw-prot-key", OBJECT(&s->scu),
-+                      "%s: SDMC is locked! (write to MCR%02x blocked)\n",
+                               "hw-prot-key");
-+                      __func__, reg * 4);
 -    object_initialize_child(obj, "vic", &s->vic, TYPE_ASPEED_VIC);
 +    object_initialize_child(obj, "vic", &a->vic, TYPE_ASPEED_VIC);
      object_initialize_child(obj, "rtc", &s->rtc, TYPE_ASPEED_RTC);
@@ -XXX,XX +XXX,XX @@ static void aspeed_ast2400_soc_init(Object *obj)
  static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
  {
      int i;
 +    Aspeed2400SoCState *a = ASPEED2400_SOC(dev);
      AspeedSoCState *s = ASPEED_SOC(dev);
      AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
      Error *err = NULL;
@@ -XXX,XX +XXX,XX @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
      /* CPU */
      for (i = 0; i < sc->num_cpus; i++) {
 -        object_property_set_link(OBJECT(&s->cpu[i]), "memory",
 +        object_property_set_link(OBJECT(&a->cpu[i]), "memory",
                                   OBJECT(s->memory), &error_abort);
 -        if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
 +        if (!qdev_realize(DEVICE(&a->cpu[i]), NULL, errp)) {
              return;
          }
      }
      /* SRAM */
 -    sram_name = g_strdup_printf("aspeed.sram.%d", CPU(&s->cpu[0])->cpu_index);
 +    sram_name = g_strdup_printf("aspeed.sram.%d", CPU(&a->cpu[0])->cpu_index);
      memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size, &err);
      if (err) {
          error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
      aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
      /* VIC */
 -    if (!sysbus_realize(SYS_BUS_DEVICE(&s->vic), errp)) {
 +    if (!sysbus_realize(SYS_BUS_DEVICE(&a->vic), errp)) {
          return;
      }
+-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->vic), 0, sc->memmap[ASPEED_DEV_VIC]);
 -    sysbus_connect_irq(SYS_BUS_DEVICE(&s->vic), 0,
 -                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ));
 -    sysbus_connect_irq(SYS_BUS_DEVICE(&s->vic), 1,
 -                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_FIQ));
 +    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->vic), 0, sc->memmap[ASPEED_DEV_VIC]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&a->vic), 0,
 +                       qdev_get_gpio_in(DEVICE(&a->cpu), ARM_CPU_IRQ));
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&a->vic), 1,
 +                       qdev_get_gpio_in(DEVICE(&a->cpu), ARM_CPU_FIQ));
      /* RTC */
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->rtc), errp)) {
 diff --git a/hw/arm/meson.build b/hw/arm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/meson.build
 +++ b/hw/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'CONFIG_FSL_IMX25', if_true: files('fsl-imx25.c', 'imx25_pdk.c'
  arm_ss.add(when: 'CONFIG_FSL_IMX31', if_true: files('fsl-imx31.c', 'kzm.c'))
  arm_ss.add(when: 'CONFIG_FSL_IMX6', if_true: files('fsl-imx6.c'))
  arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
 -  'aspeed_soc.c',
    'aspeed.c',
    'aspeed_soc_common.c',
 +  'aspeed_ast2400.c',
    'aspeed_ast2600.c',
    'aspeed_ast10x0.c',
    'aspeed_eeprom.c',
 --
-.25.4
+.41.0

-[PULL 16/20] aspeed/sdmc: Allow writes to unprotected registers
+Deleted patch
-From: Joel Stanley <joel@jms.id.au>
-A subset of registers are not protected by the lock behaviour, so allow
-unconditionally writing to those.
-Signed-off-by: Joel Stanley <joel@jms.id.au>
-Message-Id: <20200819100956.2216690-18-clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/misc/aspeed_sdmc.c | 27 +++++++++++++++++++++++++++
-file changed, 27 insertions(+)
-diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/aspeed_sdmc.c
-+++ b/hw/misc/aspeed_sdmc.c
-@@ -XXX,XX +XXX,XX @@
- /* Configuration Register */
- #define R_CONF            (0x04 / 4)
-+/* Interrupt control/status */
-+#define R_ISR             (0x50 / 4)
-+
- /* Control/Status Register #1 (ast2500) */
- #define R_STATUS1         (0x60 / 4)
- #define   PHY_BUSY_STATE      BIT(0)
- #define   PHY_PLL_LOCK_STATUS BIT(4)
-+/* Reserved */
-+#define R_MCR6C           (0x6c / 4)
-+
- #define R_ECC_TEST_CTRL   (0x70 / 4)
- #define   ECC_TEST_FINISHED   BIT(12)
- #define   ECC_TEST_FAIL       BIT(13)
-+#define R_TEST_START_LEN  (0x74 / 4)
-+#define R_TEST_FAIL_DQ    (0x78 / 4)
-+#define R_TEST_INIT_VAL   (0x7c / 4)
-+#define R_DRAM_SW         (0x88 / 4)
-+#define R_DRAM_TIME       (0x8c / 4)
-+#define R_ECC_ERR_INJECT  (0xb4 / 4)
-+
- /*
-  * Configuration register Ox4 (for Aspeed AST2400 SOC)
-  *
-@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2600_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
- static void aspeed_2600_sdmc_write(AspeedSDMCState *s, uint32_t reg,
-                                    uint32_t data)
- {
-+    /* Unprotected registers */
-+    switch (reg) {
-+    case R_ISR:
-+    case R_MCR6C:
-+    case R_TEST_START_LEN:
-+    case R_TEST_FAIL_DQ:
-+    case R_TEST_INIT_VAL:
-+    case R_DRAM_SW:
-+    case R_DRAM_TIME:
-+    case R_ECC_ERR_INJECT:
-+        s->regs[reg] = data;
-+        return;
-+    }
-+
-     if (s->regs[R_PROT] == PROT_HARDLOCKED) {
-         qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked until system reset!\n",
-                 __func__);
---
-.25.4

The following changes since commit 2f4c51c0f384d7888a04b4815861e6d5fd244d75:

Merge remote-tracking branch 'remotes/kraxel/tags/usb-20200831-pull-request' into staging (2020-08-31 19:39:13 +0100)

are available in the Git repository at:

https://github.com/legoater/qemu/ tags/pull-aspeed-20200901

for you to fetch changes up to ddd8ab19749b8639fc08bfe4d0df0204eec049f0:

hw: add a number of SPI-flash's of m25p80 family (2020-09-01 14:21:51 +0200)

----------------------------------------------------------------
Various fixes of Aspeed machines :

* New Supermicro X11 BMC machine (Erik)
* Fixed valid access size on AST2400 SCU
* Improved robustness of the ftgmac100 model.
* New flash models in m25p80 (Igor)
* Fixed reset sequence of SDHCI/eMMC controllers
* Improved support of the AST2600 SDMC  (Joel)
* Couple of SMC cleanups

----------------------------------------------------------------
Cédric Le Goater (15):
      m25p80: Return the JEDEC ID twice for mx25l25635e
      m25p80: Add support for n25q512ax3
      aspeed/scu: Fix valid access size on AST2400
      aspeed/smc: Fix MemoryRegionOps definition
      aspeed/smc: Fix max_slaves of the legacy SMC device
      aspeed/sdhci: Fix reset sequence
      ftgmac100: Fix registers that can be read
      ftgmac100: Fix interrupt status "Packet transmitted on ethernet"
      ftgmac100: Fix interrupt status "Packet moved to RX FIFO"
      ftgmac100: Change interrupt status when a DMA error occurs
      ftgmac100: Check for invalid len and address before doing a DMA transfer
      ftgmac100: Fix integer overflow in ftgmac100_do_tx()
      ftgmac100: Improve software reset
      aspeed/sdmc: Simplify calculation of RAM bits
      aspeed/smc: Open AHB window of the second chip of the AST2600 FMC controller

Erik Smit (1):
      hw/arm/aspeed: Add board model for Supermicro X11 BMC

Igor Kononenko (2):
      arm: aspeed: add strap define `25HZ` of AST2500
      hw: add a number of SPI-flash's of m25p80 family

Joel Stanley (2):
      aspeed/sdmc: Perform memory training
      aspeed/sdmc: Allow writes to unprotected registers

The mx25l25635e returns the JEDEC ID twice when issuing a RDID command :

[    2.512027] aspeed-smc 1e630000.spi: reading JEDEC ID C2:20:19:C2:20:19

This can break some firmware testing for this condition on the
supermicrox11-bmc machine.

Reported-by: Erik Smit <erik.lucas.smit@gmail.com>
Message-Id: <20200819100956.2216690-2-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/block/m25p80.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Datasheet available here :

https://www.micron.com/-/media/client/global/Documents/Products/Data%20Sheet/NOR%20Flash/Serial%20NOR/N25Q/n25q_512mb_1ce_3v_65nm.pdf

Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20200819100956.2216690-4-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/block/m25p80.c | 1 +
 1 file changed, 1 insertion(+)

The read access size of the SCU registers can be 1/2/4 bytes and write
is 4 bytes and all Aspeed models would need a .valid.accepts() handler.

For the moment, set the min access size to 1 byte to cover both read
and write operations on the AST2400 but keep the min access size of
the other SoCs to 4 bytes as this is an unusual access size.

This fixes support for some old firmware doing 2 bytes reads on the
AST2400 SoC.

Reported-by: Erik Smit <erik.lucas.smit@gmail.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20200819100956.2216690-5-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/misc/aspeed_scu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_ast2400_scu_ops = {
     .read = aspeed_scu_read,
     .write = aspeed_ast2400_scu_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
-    .valid.min_access_size = 4,
-    .valid.max_access_size = 4,
-    .valid.unaligned = false,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 4,
+    },
 };
 
 static const MemoryRegionOps aspeed_ast2500_scu_ops = {
-- 
2.25.4

From: Erik Smit <erik.lucas.smit@gmail.com>

The BMC Firmware can be downloaded from :

https://www.supermicro.com/en/products/motherboard/X11SSL-F

Signed-off-by: Erik Smit <erik.lucas.smit@gmail.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
[ clg: Prettified Erik's name in email
       Modified commit log ]
Message-Id: <20200715173418.186-1-erik.lucas.smit@gmail.com>
Message-Id: <20200819100956.2216690-6-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ struct AspeedMachineState {
         SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
         SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
 
+/* TODO: Find the actual hardware value */
+#define SUPERMICROX11_BMC_HW_STRAP1 (                                   \
+        SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_128MB) |               \
+        SCU_AST2400_HW_STRAP_DRAM_CONFIG(2) |                           \
+        SCU_AST2400_HW_STRAP_ACPI_DIS |                                 \
+        SCU_AST2400_HW_STRAP_SET_CLK_SOURCE(AST2400_CLK_48M_IN) |       \
+        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
+        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
+        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_M_S_EN) |                \
+        SCU_AST2400_HW_STRAP_SET_CPU_AHB_RATIO(AST2400_CPU_AHB_RATIO_2_1) | \
+        SCU_HW_STRAP_SPI_WIDTH |                                        \
+        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
+        SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
+
 /* AST2500 evb hardware value: 0xF100C2E6 */
 #define AST2500_EVB_HW_STRAP1 ((                                        \
         AST2500_HW_STRAP1_DEFAULTS |                                    \
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_palmetto_class_init(ObjectClass *oc, void *data)
         aspeed_soc_num_cpus(amc->soc_name);
 };
 
+static void aspeed_machine_supermicrox11_bmc_class_init(ObjectClass *oc,
+                                                        void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Supermicro X11 BMC (ARM926EJ-S)";
+    amc->soc_name  = "ast2400-a1";
+    amc->hw_strap1 = SUPERMICROX11_BMC_HW_STRAP1;
+    amc->fmc_model = "mx25l25635e";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 1;
+    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
+    amc->i2c_init  = palmetto_bmc_i2c_init;
+    mc->default_ram_size = 256 * MiB;
+}
+
 static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
         .name          = MACHINE_TYPE_NAME("palmetto-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_palmetto_class_init,
+    }, {
+        .name          = MACHINE_TYPE_NAME("supermicrox11-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_supermicrox11_bmc_class_init,
     }, {
         .name          = MACHINE_TYPE_NAME("ast2500-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
-- 
2.25.4

BIT(0) of the ASPEED_SDHCI_INFO register is set by SW and polled until
the bit is cleared by HW.

Use the number of supported slots to define the default value of this
register (The AST2600 eMMC Controller only has one). Fix the reset
sequence by clearing automatically the RESET bit.

Cc: Eddie James <eajames@linux.ibm.com>
Fixes: 2bea128c3d0b ("hw/sd/aspeed_sdhci: New device")
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20200819100956.2216690-9-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/sd/aspeed_sdhci.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/hw/sd/aspeed_sdhci.c b/hw/sd/aspeed_sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/aspeed_sdhci.c
+++ b/hw/sd/aspeed_sdhci.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 
 #define ASPEED_SDHCI_INFO            0x00
-#define  ASPEED_SDHCI_INFO_RESET     0x00030000
+#define  ASPEED_SDHCI_INFO_SLOT1     (1 << 17)
+#define  ASPEED_SDHCI_INFO_SLOT0     (1 << 16)
+#define  ASPEED_SDHCI_INFO_RESET     (1 << 0)
 #define ASPEED_SDHCI_DEBOUNCE        0x04
 #define  ASPEED_SDHCI_DEBOUNCE_RESET 0x00000005
 #define ASPEED_SDHCI_BUS             0x08
@@ -XXX,XX +XXX,XX @@ static void aspeed_sdhci_write(void *opaque, hwaddr addr, uint64_t val,
     AspeedSDHCIState *sdhci = opaque;
 
     switch (addr) {
+    case ASPEED_SDHCI_INFO:
+        /* The RESET bit automatically clears. */
+        sdhci->regs[TO_REG(addr)] = (uint32_t)val & ~ASPEED_SDHCI_INFO_RESET;
+        break;
     case ASPEED_SDHCI_SDIO_140:
         sdhci->slots[0].capareg = (uint64_t)(uint32_t)val;
         break;
@@ -XXX,XX +XXX,XX @@ static void aspeed_sdhci_reset(DeviceState *dev)
     AspeedSDHCIState *sdhci = ASPEED_SDHCI(dev);
 
     memset(sdhci->regs, 0, ASPEED_SDHCI_REG_SIZE);
-    sdhci->regs[TO_REG(ASPEED_SDHCI_INFO)] = ASPEED_SDHCI_INFO_RESET;
+
+    sdhci->regs[TO_REG(ASPEED_SDHCI_INFO)] = ASPEED_SDHCI_INFO_SLOT0;
+    if (sdhci->num_slots == 2) {
+        sdhci->regs[TO_REG(ASPEED_SDHCI_INFO)] |= ASPEED_SDHCI_INFO_SLOT1;
+    }
     sdhci->regs[TO_REG(ASPEED_SDHCI_DEBOUNCE)] = ASPEED_SDHCI_DEBOUNCE_RESET;
 }
 
-- 
2.25.4

The second field of the TX descriptor has a set of flags to choose
when the transmit interrupt is raised : after the packet has been sent
on the ethernet or after it has been moved into the TX FIFO. But we
don't model that today.

Simply raise the "Packet transmitted on ethernet" interrupt status bit
as soon as the packet is sent by QEMU.

Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20200819100956.2216690-11-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/net/ftgmac100.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
             qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size);
             ptr = s->frame;
             frame_size = 0;
-            if (flags & FTGMAC100_TXDES1_TXIC) {
-                s->isr |= FTGMAC100_INT_XPKT_ETH;
-            }
+            s->isr |= FTGMAC100_INT_XPKT_ETH;
         }
 
         if (flags & FTGMAC100_TXDES1_TX2FIC) {
-- 
2.25.4

As we don't model the RX or TX FIFO, raise the "Packet moved to RX
FIFO" interrupt status bit as soon as we are handling a RX packet.

Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20200819100956.2216690-12-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/net/ftgmac100.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
         break;
     }
 
+    s->isr |= FTGMAC100_INT_RPKT_FIFO;
     addr = s->rx_descriptor;
     while (size > 0) {
         if (!ftgmac100_can_receive(nc)) {
@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
             /* Last buffer in frame.  */
             bd.des0 |= flags | FTGMAC100_RXDES0_LRS;
             s->isr |= FTGMAC100_INT_RPKT_BUF;
-        } else {
-            s->isr |= FTGMAC100_INT_RPKT_FIFO;
         }
         ftgmac100_write_bd(&bd, addr);
         if (bd.des0 & s->rxdes0_edorr) {
-- 
2.25.4

The model uses today the "Normal priority transmit buffer unavailable"
interrupt status which it is not appropriate. According to the Aspeed
specs, no interrupts are raised in that case. An "AHB error" status
seems like a better modeling choice for all implementations since it
is covered by the Linux kernel.

Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20200819100956.2216690-13-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/net/ftgmac100.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
         if (dma_memory_read(&address_space_memory, bd.des3, ptr, len)) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to read packet @ 0x%x\n",
                           __func__, bd.des3);
-            s->isr |= FTGMAC100_INT_NO_NPTXBUF;
+            s->isr |= FTGMAC100_INT_AHB_ERR;
             break;
         }
 
-- 
2.25.4

According to the Aspeed specs, no interrupts are raised in that case
but a "Tx-packets lost" status seems like a good modeling choice for
all implementations. It is covered by the Linux kernel.

Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20200819100956.2216690-14-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/net/ftgmac100.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
         }
 
         len = FTGMAC100_TXDES0_TXBUF_SIZE(bd.des0);
+        if (!len) {
+            /*
+             * 0 is an invalid size, however the HW does not raise any
+             * interrupt. Flag an error because the guest is buggy.
+             */
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid segment size\n",
+                          __func__);
+        }
+
         if (frame_size + len > sizeof(s->frame)) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
                           __func__, len);
-- 
2.25.4

When inserting the VLAN tag in packets, memmove() can generate an
integer overflow for packets whose length is less than 12 bytes.

Move the VLAN insertion when the last segment of the frame is reached
and check length against the size of the ethernet header (14 bytes) to
avoid the crash. Return FTGMAC100_INT_XPKT_LOST status if the frame is
too small. This seems like a good modeling choice even if Aspeed does
not specify anything in that case.

Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
Cc: Mauro Matteo Cascella <mcascell@redhat.com>
Reported-by: Ziming Zhang <ezrakiez@gmail.com>
Message-Id: <20200819100956.2216690-15-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/net/ftgmac100.c | 55 ++++++++++++++++++++++++++++++++--------------
 1 file changed, 39 insertions(+), 16 deletions(-)

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@ static int ftgmac100_write_bd(FTGMAC100Desc *bd, dma_addr_t addr)
     return 0;
 }
 
+static int ftgmac100_insert_vlan(FTGMAC100State *s, int frame_size,
+                                  uint8_t vlan_tci)
+{
+    uint8_t *vlan_hdr = s->frame + (ETH_ALEN * 2);
+    uint8_t *payload = vlan_hdr + sizeof(struct vlan_header);
+
+    if (frame_size < sizeof(struct eth_header)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: frame too small for VLAN insertion : %d bytes\n",
+                      __func__, frame_size);
+        s->isr |= FTGMAC100_INT_XPKT_LOST;
+        goto out;
+    }
+
+    if (frame_size + sizeof(struct vlan_header) > sizeof(s->frame)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: frame too big : %d bytes\n",
+                      __func__, frame_size);
+        s->isr |= FTGMAC100_INT_XPKT_LOST;
+        frame_size -= sizeof(struct vlan_header);
+    }
+
+    memmove(payload, vlan_hdr, frame_size - (ETH_ALEN * 2));
+    stw_be_p(vlan_hdr, ETH_P_VLAN);
+    stw_be_p(vlan_hdr + 2, vlan_tci);
+    frame_size += sizeof(struct vlan_header);
+
+out:
+    return frame_size;
+}
+
 static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
                             uint32_t tx_descriptor)
 {
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
             break;
         }
 
-        /* Check for VLAN */
-        if (bd.des0 & FTGMAC100_TXDES0_FTS &&
-            bd.des1 & FTGMAC100_TXDES1_INS_VLANTAG &&
-            be16_to_cpu(PKT_GET_ETH_HDR(ptr)->h_proto) != ETH_P_VLAN) {
-            if (frame_size + len + 4 > sizeof(s->frame)) {
-                qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
-                              __func__, len);
-                s->isr |= FTGMAC100_INT_XPKT_LOST;
-                len =  sizeof(s->frame) - frame_size - 4;
-            }
-            memmove(ptr + 16, ptr + 12, len - 12);
-            stw_be_p(ptr + 12, ETH_P_VLAN);
-            stw_be_p(ptr + 14, bd.des1);
-            len += 4;
-        }
-
         ptr += len;
         frame_size += len;
         if (bd.des0 & FTGMAC100_TXDES0_LTS) {
+
+            /* Check for VLAN */
+            if (flags & FTGMAC100_TXDES1_INS_VLANTAG &&
+                be16_to_cpu(PKT_GET_ETH_HDR(s->frame)->h_proto) != ETH_P_VLAN) {
+                frame_size = ftgmac100_insert_vlan(s, frame_size,
+                                            FTGMAC100_TXDES1_VLANTAG_CI(flags));
+            }
+
             if (flags & FTGMAC100_TXDES1_IP_CHKSUM) {
                 net_checksum_calculate(s->frame, frame_size);
             }
-- 
2.25.4

The software reset of the MAC needs a finer granularity. Some settings
in MACCR are kept.

Cc: Frederic Konrad <konrad.frederic@yahoo.fr>
Fixes: bd44300d1afc ("net: add FTGMAC100 support")
Message-Id: <20200819100956.2216690-16-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/net/ftgmac100.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@ static uint32_t ftgmac100_rxpoll(FTGMAC100State *s)
     return cnt / div[speed];
 }
 
-static void ftgmac100_reset(DeviceState *d)
+static void ftgmac100_do_reset(FTGMAC100State *s, bool sw_reset)
 {
-    FTGMAC100State *s = FTGMAC100(d);
-
     /* Reset the FTGMAC100 */
     s->isr = 0;
     s->ier = 0;
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_reset(DeviceState *d)
     s->fear1 = 0;
     s->tpafcr = 0xf1;
 
-    s->maccr = 0;
+    if (sw_reset) {
+        s->maccr &= FTGMAC100_MACCR_GIGA_MODE | FTGMAC100_MACCR_FAST_MODE;
+    } else {
+        s->maccr = 0;
+    }
+
     s->phycr = 0;
     s->phydata = 0;
     s->fcr = 0x400;
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_reset(DeviceState *d)
     phy_reset(s);
 }
 
+static void ftgmac100_reset(DeviceState *d)
+{
+    ftgmac100_do_reset(FTGMAC100(d), false);
+}
+
 static uint64_t ftgmac100_read(void *opaque, hwaddr addr, unsigned size)
 {
     FTGMAC100State *s = FTGMAC100(opaque);
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_write(void *opaque, hwaddr addr,
     case FTGMAC100_MACCR: /* MAC Device control */
         s->maccr = value;
         if (value & FTGMAC100_MACCR_SW_RST) {
-            ftgmac100_reset(DEVICE(s));
+            ftgmac100_do_reset(s, true);
         }
 
         if (ftgmac100_can_receive(qemu_get_queue(s->nic))) {
-- 
2.25.4

From: Joel Stanley <joel@jms.id.au>

This allows qemu to run the "normal" power on reset boot path through
u-boot, where the DDR is trained.

An enhancement would be to have the SCU bit stick across qemu reboots,
but be unset on initial boot.

Proper modelling would be to discard all writes to the phy setting regs
at offset 0x100 - 0x400 and to model the phy status regs at offset
0x400.

The status regs model would only need to account for offets 0x00,
0x50, 0x68 and 0x7c.

Signed-off-by: Joel Stanley <joel@jms.id.au>
[ clg: checkpatch fixes ]
Message-Id: <20200819100956.2216690-17-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/misc/aspeed_sdmc.h | 13 ++++++++++++-
 hw/misc/aspeed_scu.c          |  2 +-
 hw/misc/aspeed_sdmc.c         | 19 +++++++++++++++++--
 3 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/include/hw/misc/aspeed_sdmc.h b/include/hw/misc/aspeed_sdmc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/aspeed_sdmc.h
+++ b/include/hw/misc/aspeed_sdmc.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_ASPEED_2500_SDMC TYPE_ASPEED_SDMC "-ast2500"
 #define TYPE_ASPEED_2600_SDMC TYPE_ASPEED_SDMC "-ast2600"
 
-#define ASPEED_SDMC_NR_REGS (0x174 >> 2)
+/*
+ * SDMC has 174 documented registers. In addition the u-boot device tree
+ * describes the following regions:
+ *  - PHY status regs at offset 0x400, length 0x200
+ *  - PHY setting regs at offset 0x100, length 0x300
+ *
+ * There are two sets of MRS (Mode Registers) configuration in ast2600 memory
+ * system: one is in the SDRAM MC (memory controller) which is used in run
+ * time, and the other is in the DDR-PHY IP which is used during DDR-PHY
+ * training.
+ */
+#define ASPEED_SDMC_NR_REGS (0x500 >> 2)
 
 typedef struct AspeedSDMCState {
     /*< private >*/
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -XXX,XX +XXX,XX @@ static const uint32_t ast2600_a1_resets[ASPEED_AST2600_SCU_NR_REGS] = {
     [AST2600_SYS_RST_CTRL2]     = 0xFFFFFFFC,
     [AST2600_CLK_STOP_CTRL]     = 0xFFFF7F8A,
     [AST2600_CLK_STOP_CTRL2]    = 0xFFF0FFF0,
-    [AST2600_SDRAM_HANDSHAKE]   = 0x00000040,  /* SoC completed DRAM init */
+    [AST2600_SDRAM_HANDSHAKE]   = 0x00000000,
     [AST2600_HPLL_PARAM]        = 0x1000405F,
     [AST2600_CHIP_ID0]          = 0x1234ABCD,
     [AST2600_CHIP_ID1]          = 0x88884444,
diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_sdmc.c
+++ b/hw/misc/aspeed_sdmc.c
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_sdmc_read(void *opaque, hwaddr addr, unsigned size)
     if (addr >= ARRAY_SIZE(s->regs)) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
-                      __func__, addr);
+                      __func__, addr * 4);
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_reset(DeviceState *dev)
 
     /* Set ram size bit and defaults values */
     s->regs[R_CONF] = asc->compute_conf(s, 0);
+
+    /*
+     * PHY status:
+     *  - set phy status ok (set bit 1)
+     *  - initial PVT calibration ok (clear bit 3)
+     *  - runtime calibration ok (clear bit 5)
+     */
+    s->regs[0x100] = BIT(1);
+
+    /* PHY eye window: set all as passing */
+    s->regs[0x100 | (0x68 / 4)] = 0xff;
+    s->regs[0x100 | (0x7c / 4)] = 0xff;
+    s->regs[0x100 | (0x50 / 4)] = 0xfffffff;
 }
 
 static void aspeed_sdmc_get_ram_size(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void aspeed_2600_sdmc_write(AspeedSDMCState *s, uint32_t reg,
     }
 
     if (reg != R_PROT && s->regs[R_PROT] == PROT_SOFTLOCKED) {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: SDMC is locked! (write to MCR%02x blocked)\n",
+                      __func__, reg * 4);
         return;
     }
 
-- 
2.25.4

From: Joel Stanley <joel@jms.id.au>

A subset of registers are not protected by the lock behaviour, so allow
unconditionally writing to those.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20200819100956.2216690-18-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/misc/aspeed_sdmc.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_sdmc.c
+++ b/hw/misc/aspeed_sdmc.c
@@ -XXX,XX +XXX,XX @@
 /* Configuration Register */
 #define R_CONF            (0x04 / 4)
 
+/* Interrupt control/status */
+#define R_ISR             (0x50 / 4)
+
 /* Control/Status Register #1 (ast2500) */
 #define R_STATUS1         (0x60 / 4)
 #define   PHY_BUSY_STATE      BIT(0)
 #define   PHY_PLL_LOCK_STATUS BIT(4)
 
+/* Reserved */
+#define R_MCR6C           (0x6c / 4)
+
 #define R_ECC_TEST_CTRL   (0x70 / 4)
 #define   ECC_TEST_FINISHED   BIT(12)
 #define   ECC_TEST_FAIL       BIT(13)
 
+#define R_TEST_START_LEN  (0x74 / 4)
+#define R_TEST_FAIL_DQ    (0x78 / 4)
+#define R_TEST_INIT_VAL   (0x7c / 4)
+#define R_DRAM_SW         (0x88 / 4)
+#define R_DRAM_TIME       (0x8c / 4)
+#define R_ECC_ERR_INJECT  (0xb4 / 4)
+
 /*
  * Configuration register Ox4 (for Aspeed AST2400 SOC)
  *
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2600_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
 static void aspeed_2600_sdmc_write(AspeedSDMCState *s, uint32_t reg,
                                    uint32_t data)
 {
+    /* Unprotected registers */
+    switch (reg) {
+    case R_ISR:
+    case R_MCR6C:
+    case R_TEST_START_LEN:
+    case R_TEST_FAIL_DQ:
+    case R_TEST_INIT_VAL:
+    case R_DRAM_SW:
+    case R_DRAM_TIME:
+    case R_ECC_ERR_INJECT:
+        s->regs[reg] = data;
+        return;
+    }
+
     if (s->regs[R_PROT] == PROT_HARDLOCKED) {
         qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked until system reset!\n",
                 __func__);
-- 
2.25.4

Changes in commit 533eb415df2e ("arm/aspeed: actually check RAM size")
introduced a 'valid_ram_sizes' array which can be used to compute the
associated bit field value encoding the RAM size. The field is simply
the index of the array.

Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20200819100956.2216690-19-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/misc/aspeed_sdmc.c | 79 ++++++++++++++-----------------------------
 1 file changed, 25 insertions(+), 54 deletions(-)

diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_sdmc.c
+++ b/hw/misc/aspeed_sdmc.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_sdmc_ops = {
     .valid.max_access_size = 4,
 };
 
-static int ast2400_rambits(AspeedSDMCState *s)
-{
-    switch (s->ram_size >> 20) {
-    case 64:
-        return ASPEED_SDMC_DRAM_64MB;
-    case 128:
-        return ASPEED_SDMC_DRAM_128MB;
-    case 256:
-        return ASPEED_SDMC_DRAM_256MB;
-    case 512:
-        return ASPEED_SDMC_DRAM_512MB;
-    default:
-        g_assert_not_reached();
-        break;
-    }
-}
-
-static int ast2500_rambits(AspeedSDMCState *s)
-{
-    switch (s->ram_size >> 20) {
-    case 128:
-        return ASPEED_SDMC_AST2500_128MB;
-    case 256:
-        return ASPEED_SDMC_AST2500_256MB;
-    case 512:
-        return ASPEED_SDMC_AST2500_512MB;
-    case 1024:
-        return ASPEED_SDMC_AST2500_1024MB;
-    default:
-        g_assert_not_reached();
-        break;
-    }
-}
-
-static int ast2600_rambits(AspeedSDMCState *s)
-{
-    switch (s->ram_size >> 20) {
-    case 256:
-        return ASPEED_SDMC_AST2600_256MB;
-    case 512:
-        return ASPEED_SDMC_AST2600_512MB;
-    case 1024:
-        return ASPEED_SDMC_AST2600_1024MB;
-    case 2048:
-        return ASPEED_SDMC_AST2600_2048MB;
-    default:
-        g_assert_not_reached();
-        break;
-    }
-}
-
 static void aspeed_sdmc_reset(DeviceState *dev)
 {
     AspeedSDMCState *s = ASPEED_SDMC(dev);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_sdmc_info = {
     .abstract   = true,
 };
 
+static int aspeed_sdmc_get_ram_bits(AspeedSDMCState *s)
+{
+    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
+    int i;
+
+    /*
+     * The bitfield value encoding the RAM size is the index of the
+     * possible RAM size array
+     */
+    for (i = 0; asc->valid_ram_sizes[i]; i++) {
+        if (s->ram_size == asc->valid_ram_sizes[i]) {
+            return i;
+        }
+    }
+
+    /*
+     * Invalid RAM sizes should have been excluded when setting the
+     * SoC RAM size.
+     */
+    g_assert_not_reached();
+}
+
 static uint32_t aspeed_2400_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
 {
     uint32_t fixed_conf = ASPEED_SDMC_VGA_COMPAT |
-        ASPEED_SDMC_DRAM_SIZE(ast2400_rambits(s));
+        ASPEED_SDMC_DRAM_SIZE(aspeed_sdmc_get_ram_bits(s));
 
     /* Make sure readonly bits are kept */
     data &= ~ASPEED_SDMC_READONLY_MASK;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2500_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
     uint32_t fixed_conf = ASPEED_SDMC_HW_VERSION(1) |
         ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
         ASPEED_SDMC_CACHE_INITIAL_DONE |
-        ASPEED_SDMC_DRAM_SIZE(ast2500_rambits(s));
+        ASPEED_SDMC_DRAM_SIZE(aspeed_sdmc_get_ram_bits(s));
 
     /* Make sure readonly bits are kept */
     data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2600_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
 {
     uint32_t fixed_conf = ASPEED_SDMC_HW_VERSION(3) |
         ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
-        ASPEED_SDMC_DRAM_SIZE(ast2600_rambits(s));
+        ASPEED_SDMC_DRAM_SIZE(aspeed_sdmc_get_ram_bits(s));
 
     /* Make sure readonly bits are kept (use ast2500 mask) */
     data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
-- 
2.25.4

This change works around the HW default values to be able to test the
Tacoma board with -kernel command line option. This was required when
we had both flash chips enabled in the device tree, otherwise Linux
would fail to probe the entire controller leaving it with no rootfs.

Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20200819100956.2216690-20-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ssi/aspeed_smc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reg_to_segment(const AspeedSMCState *s, uint32_t reg,
 
 static const AspeedSegments aspeed_segments_ast2600_fmc[] = {
     { 0x0, 128 * MiB }, /* start address is readonly */
-    { 0x0, 0 }, /* disabled */
+    { 128 * MiB, 128 * MiB }, /* default is disabled but needed for -kernel */
     { 0x0, 0 }, /* disabled */
 };
 
-- 
2.25.4

From: Igor Kononenko <i.kononenko@yadro.com>

Provide a definition for the "25Hz reference clock input mode" strap

Signed-off-by: Igor Kononenko <i.kononenko@yadro.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200811203502.20382-1-i.kononenko@yadro.com>
Message-Id: <20200819100956.2216690-21-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/misc/aspeed_scu.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -XXX,XX +XXX,XX @@ uint32_t aspeed_scu_get_apb_freq(AspeedSCUState *s);
 #define SCU_AST2500_HW_STRAP_ESPI_FLASH_ENABLE     (0x1 << 26)
 #define SCU_AST2500_HW_STRAP_ESPI_ENABLE           (0x1 << 25)
 #define SCU_AST2500_HW_STRAP_DDR4_ENABLE           (0x1 << 24)
+#define SCU_AST2500_HW_STRAP_25HZ_CLOCK_MODE       (0x1 << 23)
 
 #define SCU_AST2500_HW_STRAP_ACPI_ENABLE           (0x1 << 19)
 #define SCU_AST2500_HW_STRAP_USBCKI_FREQ           (0x1 << 18)
-- 
2.25.4

From: Igor Kononenko <i.kononenko@yadro.com>

Support a following SPI flashes:
* mx66l51235f
* mt25ql512ab

Signed-off-by: Igor Kononenko <i.kononenko@yadro.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20200811203724.20699-1-i.kononenko@yadro.com>
Message-Id: <20200819100956.2216690-22-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/block/m25p80.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@ static const FlashPartInfo known_devices[] = {
     { INFO("mx25l12855e", 0xc22618,      0,  64 << 10, 256, 0) },
     { INFO6("mx25l25635e", 0xc22019,     0xc22019,  64 << 10, 512, 0) },
     { INFO("mx25l25655e", 0xc22619,      0,  64 << 10, 512, 0) },
+    { INFO("mx66l51235f", 0xc2201a,      0,  64 << 10, 1024, ER_4K | ER_32K) },
     { INFO("mx66u51235f", 0xc2253a,      0,  64 << 10, 1024, ER_4K | ER_32K) },
     { INFO("mx66u1g45g",  0xc2253b,      0,  64 << 10, 2048, ER_4K | ER_32K) },
     { INFO("mx66l1g45g",  0xc2201b,      0,  64 << 10, 2048, ER_4K | ER_32K) },
@@ -XXX,XX +XXX,XX @@ static const FlashPartInfo known_devices[] = {
     { INFO("n25q256a",    0x20ba19,      0,  64 << 10, 512, ER_4K) },
     { INFO("n25q512a",    0x20ba20,      0,  64 << 10, 1024, ER_4K) },
     { INFO("n25q512ax3",  0x20ba20,  0x1000,  64 << 10, 1024, ER_4K) },
+    { INFO("mt25ql512ab", 0x20ba20, 0x1044, 64 << 10, 1024, ER_4K | ER_32K) },
     { INFO_STACKED("n25q00",    0x20ba21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
     { INFO_STACKED("n25q00a",   0x20bb21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
     { INFO_STACKED("mt25ql01g", 0x20ba21, 0x1040, 64 << 10, 2048, ER_4K, 2) },
-- 
2.25.4

The following changes since commit a95260486aa7e78d7c7194eba65cf03311ad94ad:

Merge tag 'pull-tcg-20231023' of https://gitlab.com/rth7680/qemu into staging (2023-10-23 14:45:46 -0700)

are available in the Git repository at:

https://github.com/legoater/qemu/ tags/pull-aspeed-20231025

for you to fetch changes up to dd41ce7a6f13ad4f45ebaf52b9fa91fe5fc961df:

hw/arm/aspeed: Move AspeedSoCState::cpu/vic to Aspeed2400SoCState (2023-10-25 09:52:44 +0200)

----------------------------------------------------------------
aspeed queue:

* Update of Andrew's email
* Split of AspeedSoCState per 2400/2600/10x0

----------------------------------------------------------------
Andrew Jeffery (1):
      MAINTAINERS: aspeed: Update Andrew's email address

Philippe Mathieu-Daudé (11):
      hw/arm/aspeed: Extract code common to all boards to a common file
      hw/arm/aspeed: Rename aspeed_soc_init() as AST2400/2500 specific
      hw/arm/aspeed: Rename aspeed_soc_realize() as AST2400/2500 specific
      hw/arm/aspeed: Dynamically allocate AspeedMachineState::soc field
      hw/arm/aspeed: Introduce TYPE_ASPEED10X0_SOC
      hw/arm/aspeed: Introduce TYPE_ASPEED2600_SOC
      hw/arm/aspeed: Introduce TYPE_ASPEED2400_SOC
      hw/arm/aspeed: Check 'memory' link is set in common aspeed_soc_realize
      hw/arm/aspeed: Move AspeedSoCState::armv7m to Aspeed10x0SoCState
      hw/arm/aspeed: Move AspeedSoCState::a7mpcore to Aspeed2600SoCState
      hw/arm/aspeed: Move AspeedSoCState::cpu/vic to Aspeed2400SoCState

MAINTAINERS                               |   2 +-
 include/hw/arm/aspeed_soc.h               |  35 +++++-
 hw/arm/aspeed.c                           | 101 +++++++--------
 hw/arm/aspeed_ast10x0.c                   |  53 ++++----
 hw/arm/{aspeed_soc.c => aspeed_ast2400.c} | 197 +++++++-----------------------
 hw/arm/aspeed_ast2600.c                   |  75 ++++++------
 hw/arm/aspeed_soc_common.c                | 154 +++++++++++++++++++++++
 hw/arm/fby35.c                            |  27 ++--
 hw/arm/meson.build                        |   3 +-
 9 files changed, 363 insertions(+), 284 deletions(-)
 rename hw/arm/{aspeed_soc.c => aspeed_ast2400.c} (76%)
 create mode 100644 hw/arm/aspeed_soc_common.c

From: Philippe Mathieu-Daudé <philmd@linaro.org>

aspeed_soc.c contains definitions specific to the AST2400
and AST2500 SoCs, but also some definitions for other AST
SoCs: move them to a common file.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed_soc.c        |  96 -------------------------------
 hw/arm/aspeed_soc_common.c | 114 +++++++++++++++++++++++++++++++++++++
 hw/arm/meson.build         |   1 +
 3 files changed, 115 insertions(+), 96 deletions(-)
 create mode 100644 hw/arm/aspeed_soc_common.c

diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_register_types(void)
 };
 
 type_init(aspeed_soc_register_types);
-
-qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev)
-{
-    return ASPEED_SOC_GET_CLASS(s)->get_irq(s, dev);
-}
-
-bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp)
-{
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-    SerialMM *smm;
-
-    for (int i = 0, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
-        smm = &s->uart[i];
-
-        /* Chardev property is set by the machine. */
-        qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
-        qdev_prop_set_uint32(DEVICE(smm), "baudbase", 38400);
-        qdev_set_legacy_instance_id(DEVICE(smm), sc->memmap[uart], 2);
-        qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
-        if (!sysbus_realize(SYS_BUS_DEVICE(smm), errp)) {
-            return false;
-        }
-
-        sysbus_connect_irq(SYS_BUS_DEVICE(smm), 0, aspeed_soc_get_irq(s, uart));
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(smm), 0, sc->memmap[uart]);
-    }
-
-    return true;
-}
-
-void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr)
-{
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-    int i = dev - ASPEED_DEV_UART1;
-
-    g_assert(0 <= i && i < ARRAY_SIZE(s->uart) && i < sc->uarts_num);
-    qdev_prop_set_chr(DEVICE(&s->uart[i]), "chardev", chr);
-}
-
-/*
- * SDMC should be realized first to get correct RAM size and max size
- * values
- */
-bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp)
-{
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-    ram_addr_t ram_size, max_ram_size;
-
-    ram_size = object_property_get_uint(OBJECT(&s->sdmc), "ram-size",
-                                        &error_abort);
-    max_ram_size = object_property_get_uint(OBJECT(&s->sdmc), "max-ram-size",
-                                            &error_abort);
-
-    memory_region_init(&s->dram_container, OBJECT(s), "ram-container",
-                       max_ram_size);
-    memory_region_add_subregion(&s->dram_container, 0, s->dram_mr);
-
-    /*
-     * Add a memory region beyond the RAM region to let firmwares scan
-     * the address space with load/store and guess how much RAM the
-     * SoC has.
-     */
-    if (ram_size < max_ram_size) {
-        DeviceState *dev = qdev_new(TYPE_UNIMPLEMENTED_DEVICE);
-
-        qdev_prop_set_string(dev, "name", "ram-empty");
-        qdev_prop_set_uint64(dev, "size", max_ram_size  - ram_size);
-        if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp)) {
-            return false;
-        }
-
-        memory_region_add_subregion_overlap(&s->dram_container, ram_size,
-                      sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0), -1000);
-    }
-
-    memory_region_add_subregion(s->memory,
-                      sc->memmap[ASPEED_DEV_SDRAM], &s->dram_container);
-    return true;
-}
-
-void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr)
-{
-    memory_region_add_subregion(s->memory, addr,
-                                sysbus_mmio_get_region(dev, n));
-}
-
-void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
-                                   const char *name, hwaddr addr, uint64_t size)
-{
-    qdev_prop_set_string(DEVICE(dev), "name", name);
-    qdev_prop_set_uint64(DEVICE(dev), "size", size);
-    sysbus_realize(dev, &error_abort);
-
-    memory_region_add_subregion_overlap(s->memory, addr,
-                                        sysbus_mmio_get_region(dev, 0), -1000);
-}
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/aspeed_soc_common.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ASPEED SoC family
+ *
+ * Andrew Jeffery <andrew@aj.id.au>
+ * Jeremy Kerr <jk@ozlabs.org>
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * This code is licensed under the GPL version 2 or later.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/misc/unimp.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/char/serial.h"
+
+
+qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev)
+{
+    return ASPEED_SOC_GET_CLASS(s)->get_irq(s, dev);
+}
+
+bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp)
+{
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    SerialMM *smm;
+
+    for (int i = 0, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
+        smm = &s->uart[i];
+
+        /* Chardev property is set by the machine. */
+        qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
+        qdev_prop_set_uint32(DEVICE(smm), "baudbase", 38400);
+        qdev_set_legacy_instance_id(DEVICE(smm), sc->memmap[uart], 2);
+        qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
+        if (!sysbus_realize(SYS_BUS_DEVICE(smm), errp)) {
+            return false;
+        }
+
+        sysbus_connect_irq(SYS_BUS_DEVICE(smm), 0, aspeed_soc_get_irq(s, uart));
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(smm), 0, sc->memmap[uart]);
+    }
+
+    return true;
+}
+
+void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr)
+{
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    int i = dev - ASPEED_DEV_UART1;
+
+    g_assert(0 <= i && i < ARRAY_SIZE(s->uart) && i < sc->uarts_num);
+    qdev_prop_set_chr(DEVICE(&s->uart[i]), "chardev", chr);
+}
+
+/*
+ * SDMC should be realized first to get correct RAM size and max size
+ * values
+ */
+bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp)
+{
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    ram_addr_t ram_size, max_ram_size;
+
+    ram_size = object_property_get_uint(OBJECT(&s->sdmc), "ram-size",
+                                        &error_abort);
+    max_ram_size = object_property_get_uint(OBJECT(&s->sdmc), "max-ram-size",
+                                            &error_abort);
+
+    memory_region_init(&s->dram_container, OBJECT(s), "ram-container",
+                       max_ram_size);
+    memory_region_add_subregion(&s->dram_container, 0, s->dram_mr);
+
+    /*
+     * Add a memory region beyond the RAM region to let firmwares scan
+     * the address space with load/store and guess how much RAM the
+     * SoC has.
+     */
+    if (ram_size < max_ram_size) {
+        DeviceState *dev = qdev_new(TYPE_UNIMPLEMENTED_DEVICE);
+
+        qdev_prop_set_string(dev, "name", "ram-empty");
+        qdev_prop_set_uint64(dev, "size", max_ram_size  - ram_size);
+        if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp)) {
+            return false;
+        }
+
+        memory_region_add_subregion_overlap(&s->dram_container, ram_size,
+                      sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0), -1000);
+    }
+
+    memory_region_add_subregion(s->memory,
+                      sc->memmap[ASPEED_DEV_SDRAM], &s->dram_container);
+    return true;
+}
+
+void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr)
+{
+    memory_region_add_subregion(s->memory, addr,
+                                sysbus_mmio_get_region(dev, n));
+}
+
+void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
+                                   const char *name, hwaddr addr, uint64_t size)
+{
+    qdev_prop_set_string(DEVICE(dev), "name", name);
+    qdev_prop_set_uint64(DEVICE(dev), "size", size);
+    sysbus_realize(dev, &error_abort);
+
+    memory_region_add_subregion_overlap(s->memory, addr,
+                                        sysbus_mmio_get_region(dev, 0), -1000);
+}
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'CONFIG_FSL_IMX6', if_true: files('fsl-imx6.c'))
 arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_soc.c',
   'aspeed.c',
+  'aspeed_soc_common.c',
   'aspeed_ast2600.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',
-- 
2.41.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static qemu_irq aspeed_soc_ast2400_get_irq(AspeedSoCState *s, int dev)
     return qdev_get_gpio_in(DEVICE(&s->vic), sc->irqmap[dev]);
 }
 
-static void aspeed_soc_init(Object *obj)
+static void aspeed_ast2400_soc_init(Object *obj)
 {
     AspeedSoCState *s = ASPEED_SOC(obj);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
 static const TypeInfo aspeed_soc_ast2400_type_info = {
     .name           = "ast2400-a1",
     .parent         = TYPE_ASPEED_SOC,
-    .instance_init  = aspeed_soc_init,
+    .instance_init  = aspeed_ast2400_soc_init,
     .instance_size  = sizeof(AspeedSoCState),
     .class_init     = aspeed_soc_ast2400_class_init,
 };
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
 static const TypeInfo aspeed_soc_ast2500_type_info = {
     .name           = "ast2500-a1",
     .parent         = TYPE_ASPEED_SOC,
-    .instance_init  = aspeed_soc_init,
+    .instance_init  = aspeed_ast2400_soc_init,
     .instance_size  = sizeof(AspeedSoCState),
     .class_init     = aspeed_soc_ast2500_class_init,
 };
-- 
2.41.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Keep aspeed_soc_class_init() generic, set the realize handler
to aspeed_ast2400_soc_realize() in each 2400/2500 class_init.

diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_ast2400_soc_init(Object *obj)
     object_initialize_child(obj, "video", &s->video, TYPE_UNIMPLEMENTED_DEVICE);
 }
 
-static void aspeed_soc_realize(DeviceState *dev, Error **errp)
+static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
 {
     int i;
     AspeedSoCState *s = ASPEED_SOC(dev);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
-    dc->realize = aspeed_soc_realize;
-    /* Reason: Uses serial_hds and nd_table in realize() directly */
-    dc->user_creatable = false;
     device_class_set_props(dc, aspeed_soc_properties);
 }
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_soc_type_info = {
 static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
 {
     AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = aspeed_ast2400_soc_realize;
+    /* Reason: Uses serial_hds and nd_table in realize() directly */
+    dc->user_creatable = false;
 
     sc->name         = "ast2400-a1";
     sc->cpu_type     = ARM_CPU_TYPE_NAME("arm926");
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_soc_ast2400_type_info = {
 static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
 {
     AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = aspeed_ast2400_soc_realize;
+    /* Reason: Uses serial_hds and nd_table in realize() directly */
+    dc->user_creatable = false;
 
     sc->name         = "ast2500-a1";
     sc->cpu_type     = ARM_CPU_TYPE_NAME("arm1176");
-- 
2.41.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

We want to derivate the big AspeedSoCState object in some more
SoC-specific ones. Since the object size will vary, allocate it
dynamically.

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ struct AspeedMachineState {
     MachineState parent_obj;
     /* Public */
 
-    AspeedSoCState soc;
+    AspeedSoCState *soc;
     MemoryRegion boot_rom;
     bool mmio_exec;
     uint32_t uart_chosen;
@@ -XXX,XX +XXX,XX @@ static void write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
 static void aspeed_install_boot_rom(AspeedMachineState *bmc, BlockBackend *blk,
                                     uint64_t rom_size)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
 
     memory_region_init_rom(&bmc->boot_rom, NULL, "aspeed.boot_rom", rom_size,
                            &error_abort);
@@ -XXX,XX +XXX,XX @@ static void sdhci_attach_drive(SDHCIState *sdhci, DriveInfo *dinfo)
 static void connect_serial_hds_to_uarts(AspeedMachineState *bmc)
 {
     AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(bmc);
-    AspeedSoCState *s = &bmc->soc;
+    AspeedSoCState *s = bmc->soc;
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     int uart_chosen = bmc->uart_chosen ? bmc->uart_chosen : amc->uart_default;
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
     int i;
     NICInfo *nd = &nd_table[0];
 
-    object_initialize_child(OBJECT(machine), "soc", &bmc->soc, amc->soc_name);
-
-    sc = ASPEED_SOC_GET_CLASS(&bmc->soc);
+    bmc->soc = ASPEED_SOC(object_new(amc->soc_name));
+    object_property_add_child(OBJECT(machine), "soc", OBJECT(bmc->soc));
+    object_unref(OBJECT(bmc->soc));
+    sc = ASPEED_SOC_GET_CLASS(bmc->soc);
 
     /*
      * This will error out if the RAM size is not supported by the
      * memory controller of the SoC.
      */
-    object_property_set_uint(OBJECT(&bmc->soc), "ram-size", machine->ram_size,
+    object_property_set_uint(OBJECT(bmc->soc), "ram-size", machine->ram_size,
                              &error_fatal);
 
     for (i = 0; i < sc->macs_num; i++) {
         if ((amc->macs_mask & (1 << i)) && nd->used) {
             qemu_check_nic_model(nd, TYPE_FTGMAC100);
-            qdev_set_nic_properties(DEVICE(&bmc->soc.ftgmac100[i]), nd);
+            qdev_set_nic_properties(DEVICE(&bmc->soc->ftgmac100[i]), nd);
             nd++;
         }
     }
 
-    object_property_set_int(OBJECT(&bmc->soc), "hw-strap1", amc->hw_strap1,
+    object_property_set_int(OBJECT(bmc->soc), "hw-strap1", amc->hw_strap1,
                             &error_abort);
-    object_property_set_int(OBJECT(&bmc->soc), "hw-strap2", amc->hw_strap2,
+    object_property_set_int(OBJECT(bmc->soc), "hw-strap2", amc->hw_strap2,
                             &error_abort);
-    object_property_set_link(OBJECT(&bmc->soc), "memory",
+    object_property_set_link(OBJECT(bmc->soc), "memory",
                              OBJECT(get_system_memory()), &error_abort);
-    object_property_set_link(OBJECT(&bmc->soc), "dram",
+    object_property_set_link(OBJECT(bmc->soc), "dram",
                              OBJECT(machine->ram), &error_abort);
     if (machine->kernel_filename) {
         /*
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
          * that runs to unlock the SCU. In this case set the default to
          * be unlocked as the kernel expects
          */
-        object_property_set_int(OBJECT(&bmc->soc), "hw-prot-key",
+        object_property_set_int(OBJECT(bmc->soc), "hw-prot-key",
                                 ASPEED_SCU_PROT_KEY, &error_abort);
     }
     connect_serial_hds_to_uarts(bmc);
-    qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
+    qdev_realize(DEVICE(bmc->soc), NULL, &error_abort);
 
     if (defaults_enabled()) {
-        aspeed_board_init_flashes(&bmc->soc.fmc,
+        aspeed_board_init_flashes(&bmc->soc->fmc,
                               bmc->fmc_model ? bmc->fmc_model : amc->fmc_model,
                               amc->num_cs, 0);
-        aspeed_board_init_flashes(&bmc->soc.spi[0],
+        aspeed_board_init_flashes(&bmc->soc->spi[0],
                               bmc->spi_model ? bmc->spi_model : amc->spi_model,
                               1, amc->num_cs);
     }
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
         amc->i2c_init(bmc);
     }
 
-    for (i = 0; i < bmc->soc.sdhci.num_slots; i++) {
-        sdhci_attach_drive(&bmc->soc.sdhci.slots[i],
+    for (i = 0; i < bmc->soc->sdhci.num_slots; i++) {
+        sdhci_attach_drive(&bmc->soc->sdhci.slots[i],
                            drive_get(IF_SD, 0, i));
     }
 
-    if (bmc->soc.emmc.num_slots) {
-        sdhci_attach_drive(&bmc->soc.emmc.slots[0],
-                           drive_get(IF_SD, 0, bmc->soc.sdhci.num_slots));
+    if (bmc->soc->emmc.num_slots) {
+        sdhci_attach_drive(&bmc->soc->emmc.slots[0],
+                           drive_get(IF_SD, 0, bmc->soc->sdhci.num_slots));
     }
 
     if (!bmc->mmio_exec) {
-        DeviceState *dev = ssi_get_cs(bmc->soc.fmc.spi, 0);
+        DeviceState *dev = ssi_get_cs(bmc->soc->fmc.spi, 0);
         BlockBackend *fmc0 = dev ? m25p80_get_blk(dev) : NULL;
 
         if (fmc0) {
-            uint64_t rom_size = memory_region_size(&bmc->soc.spi_boot);
+            uint64_t rom_size = memory_region_size(&bmc->soc->spi_boot);
             aspeed_install_boot_rom(bmc, fmc0, rom_size);
         }
     }
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
 
 static void palmetto_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
     DeviceState *dev;
     uint8_t *eeprom_buf = g_malloc0(32 * 1024);
 
@@ -XXX,XX +XXX,XX @@ static void palmetto_bmc_i2c_init(AspeedMachineState *bmc)
 
 static void quanta_q71l_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
 
     /*
      * The quanta-q71l platform expects tmp75s which are compatible with
@@ -XXX,XX +XXX,XX @@ static void quanta_q71l_bmc_i2c_init(AspeedMachineState *bmc)
 
 static void ast2500_evb_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
     uint8_t *eeprom_buf = g_malloc0(8 * 1024);
 
     smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 3), 0x50,
@@ -XXX,XX +XXX,XX @@ static void ast2500_evb_i2c_init(AspeedMachineState *bmc)
 
 static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
     uint8_t *eeprom_buf = g_malloc0(8 * 1024);
 
     smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 7), 0x50,
@@ -XXX,XX +XXX,XX @@ static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
 
 static void yosemitev2_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
 
     at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x51, 128 * KiB);
     at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x51, 128 * KiB,
@@ -XXX,XX +XXX,XX @@ static void yosemitev2_bmc_i2c_init(AspeedMachineState *bmc)
 
 static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
 
     /* The romulus board expects Epson RX8900 I2C RTC but a ds1338 is
      * good enough */
@@ -XXX,XX +XXX,XX @@ static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
 
 static void tiogapass_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
 
     at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54, 128 * KiB);
     at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 6), 0x54, 128 * KiB,
@@ -XXX,XX +XXX,XX @@ static void create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
 
 static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
 
     /* bus 2 : */
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "tmp105", 0x48);
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
         {14, LED_COLOR_GREEN, "front-power-3",  GPIO_POLARITY_ACTIVE_LOW},
         {15, LED_COLOR_GREEN, "front-id-5",     GPIO_POLARITY_ACTIVE_LOW},
     };
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
     uint8_t *eeprom_buf = g_malloc0(8 * 1024);
     DeviceState *dev;
     LEDState *led;
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
 
 static void g220a_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
     DeviceState *dev;
 
     dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3),
@@ -XXX,XX +XXX,XX @@ static void g220a_bmc_i2c_init(AspeedMachineState *bmc)
 
 static void fp5280g2_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
     I2CSlave *i2c_mux;
 
     /* The at24c256 */
@@ -XXX,XX +XXX,XX @@ static void fp5280g2_bmc_i2c_init(AspeedMachineState *bmc)
 
 static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
     I2CSlave *i2c_mux;
 
     at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 0), 0x51, 32 * KiB);
@@ -XXX,XX +XXX,XX @@ static void get_pca9548_channels(I2CBus *bus, uint8_t mux_addr,
 
 static void fuji_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
     I2CBus *i2c[144] = {};
 
     for (int i = 0; i < 16; i++) {
@@ -XXX,XX +XXX,XX @@ static void fuji_bmc_i2c_init(AspeedMachineState *bmc)
 
 static void bletchley_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
     I2CBus *i2c[13] = {};
     for (int i = 0; i < 13; i++) {
         if ((i == 8) || (i == 11)) {
@@ -XXX,XX +XXX,XX @@ static void bletchley_bmc_i2c_init(AspeedMachineState *bmc)
 
 static void fby35_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
     I2CBus *i2c[16];
 
     for (int i = 0; i < 16; i++) {
@@ -XXX,XX +XXX,XX @@ static void fby35_i2c_init(AspeedMachineState *bmc)
 
 static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
 
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
 }
 
 static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
     I2CSlave *therm_mux, *cpuvr_mux;
 
     /* Create the generic DC-SCM hardware */
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_bletchley_class_init(ObjectClass *oc, void *data)
 static void fby35_reset(MachineState *state, ShutdownCause reason)
 {
     AspeedMachineState *bmc = ASPEED_MACHINE(state);
-    AspeedGPIOState *gpio = &bmc->soc.gpio;
+    AspeedGPIOState *gpio = &bmc->soc->gpio;
 
     qemu_devices_reset(reason);
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_minibmc_machine_init(MachineState *machine)
     sysclk = clock_new(OBJECT(machine), "SYSCLK");
     clock_set_hz(sysclk, SYSCLK_FRQ);
 
-    object_initialize_child(OBJECT(machine), "soc", &bmc->soc, amc->soc_name);
-    qdev_connect_clock_in(DEVICE(&bmc->soc), "sysclk", sysclk);
+    bmc->soc = ASPEED_SOC(object_new(amc->soc_name));
+    object_property_add_child(OBJECT(machine), "soc", OBJECT(bmc->soc));
+    object_unref(OBJECT(bmc->soc));
+    qdev_connect_clock_in(DEVICE(bmc->soc), "sysclk", sysclk);
 
-    object_property_set_link(OBJECT(&bmc->soc), "memory",
+    object_property_set_link(OBJECT(bmc->soc), "memory",
                              OBJECT(get_system_memory()), &error_abort);
     connect_serial_hds_to_uarts(bmc);
-    qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
+    qdev_realize(DEVICE(bmc->soc), NULL, &error_abort);
 
-    aspeed_board_init_flashes(&bmc->soc.fmc,
+    aspeed_board_init_flashes(&bmc->soc->fmc,
                               bmc->fmc_model ? bmc->fmc_model : amc->fmc_model,
                               amc->num_cs,
                               0);
 
-    aspeed_board_init_flashes(&bmc->soc.spi[0],
+    aspeed_board_init_flashes(&bmc->soc->spi[0],
                               bmc->spi_model ? bmc->spi_model : amc->spi_model,
                               amc->num_cs, amc->num_cs);
 
-    aspeed_board_init_flashes(&bmc->soc.spi[1],
+    aspeed_board_init_flashes(&bmc->soc->spi[1],
                               bmc->spi_model ? bmc->spi_model : amc->spi_model,
                               amc->num_cs, (amc->num_cs * 2));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_minibmc_machine_init(MachineState *machine)
 
 static void ast1030_evb_i2c_init(AspeedMachineState *bmc)
 {
-    AspeedSoCState *soc = &bmc->soc;
+    AspeedSoCState *soc = bmc->soc;
 
     /* U10 24C08 connects to SDA/SCL Group 1 by default */
     uint8_t *eeprom_buf = g_malloc0(32 * 1024);
-- 
2.41.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

TYPE_ASPEED10X0_SOC inherits from TYPE_ASPEED_SOC.
In few commits we'll add more fields, but to keep
review process simple, don't add any yet.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  7 +++++++
 hw/arm/aspeed_ast10x0.c     | 26 +++++++++++++-------------
 2 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
 #define TYPE_ASPEED_SOC "aspeed-soc"
 OBJECT_DECLARE_TYPE(AspeedSoCState, AspeedSoCClass, ASPEED_SOC)
 
+struct Aspeed10x0SoCState {
+    AspeedSoCState parent;
+};
+
+#define TYPE_ASPEED10X0_SOC "aspeed10x0-soc"
+OBJECT_DECLARE_SIMPLE_TYPE(Aspeed10x0SoCState, ASPEED10X0_SOC)
+
 struct AspeedSoCClass {
     DeviceClass parent_class;
 
diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_class_init(ObjectClass *klass, void *data)
     sc->get_irq = aspeed_soc_ast1030_get_irq;
 }
 
-static const TypeInfo aspeed_soc_ast1030_type_info = {
-    .name          = "ast1030-a1",
-    .parent        = TYPE_ASPEED_SOC,
-    .instance_size = sizeof(AspeedSoCState),
-    .instance_init = aspeed_soc_ast1030_init,
-    .class_init    = aspeed_soc_ast1030_class_init,
-    .class_size    = sizeof(AspeedSoCClass),
+static const TypeInfo aspeed_soc_ast10x0_types[] = {
+    {
+        .name           = TYPE_ASPEED10X0_SOC,
+        .parent         = TYPE_ASPEED_SOC,
+        .instance_size  = sizeof(Aspeed10x0SoCState),
+        .abstract       = true,
+    }, {
+        .name           = "ast1030-a1",
+        .parent         = TYPE_ASPEED10X0_SOC,
+        .instance_init  = aspeed_soc_ast1030_init,
+        .class_init     = aspeed_soc_ast1030_class_init,
+    },
 };
 
-static void aspeed_soc_register_types(void)
-{
-    type_register_static(&aspeed_soc_ast1030_type_info);
-}
-
-type_init(aspeed_soc_register_types)
+DEFINE_TYPES(aspeed_soc_ast10x0_types)
-- 
2.41.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

TYPE_ASPEED2600_SOC inherits from TYPE_ASPEED_SOC.
In few commits we'll add more fields, but to keep
review process simple, don't add any yet.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  7 +++++++
 hw/arm/aspeed_ast2600.c     | 26 +++++++++++++-------------
 2 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
 #define TYPE_ASPEED_SOC "aspeed-soc"
 OBJECT_DECLARE_TYPE(AspeedSoCState, AspeedSoCClass, ASPEED_SOC)
 
+struct Aspeed2600SoCState {
+    AspeedSoCState parent;
+};
+
+#define TYPE_ASPEED2600_SOC "aspeed2600-soc"
+OBJECT_DECLARE_SIMPLE_TYPE(Aspeed2600SoCState, ASPEED2600_SOC)
+
 struct Aspeed10x0SoCState {
     AspeedSoCState parent;
 };
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)
     sc->get_irq      = aspeed_soc_ast2600_get_irq;
 }
 
-static const TypeInfo aspeed_soc_ast2600_type_info = {
-    .name           = "ast2600-a3",
-    .parent         = TYPE_ASPEED_SOC,
-    .instance_size  = sizeof(AspeedSoCState),
-    .instance_init  = aspeed_soc_ast2600_init,
-    .class_init     = aspeed_soc_ast2600_class_init,
-    .class_size     = sizeof(AspeedSoCClass),
+static const TypeInfo aspeed_soc_ast2600_types[] = {
+    {
+        .name           = TYPE_ASPEED2600_SOC,
+        .parent         = TYPE_ASPEED_SOC,
+        .instance_size  = sizeof(Aspeed2600SoCState),
+        .abstract       = true,
+    }, {
+        .name           = "ast2600-a3",
+        .parent         = TYPE_ASPEED2600_SOC,
+        .instance_init  = aspeed_soc_ast2600_init,
+        .class_init     = aspeed_soc_ast2600_class_init,
+    },
 };
 
-static void aspeed_soc_register_types(void)
-{
-    type_register_static(&aspeed_soc_ast2600_type_info);
-};
-
-type_init(aspeed_soc_register_types)
+DEFINE_TYPES(aspeed_soc_ast2600_types)
-- 
2.41.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

TYPE_ASPEED2400_SOC inherits from TYPE_ASPEED_SOC.
In few commits we'll add more fields, but to keep
review process simple, don't add any yet.

TYPE_ASPEED_SOC is common to various Aspeed SoCs,
define it in aspeed_soc_common.c.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  7 +++++
 hw/arm/aspeed_soc.c         | 61 +++++++++++--------------------------
 hw/arm/aspeed_soc_common.c  | 29 ++++++++++++++++++
 3 files changed, 53 insertions(+), 44 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
 #define TYPE_ASPEED_SOC "aspeed-soc"
 OBJECT_DECLARE_TYPE(AspeedSoCState, AspeedSoCClass, ASPEED_SOC)
 
+struct Aspeed2400SoCState {
+    AspeedSoCState parent;
+};
+
+#define TYPE_ASPEED2400_SOC "aspeed2400-soc"
+OBJECT_DECLARE_SIMPLE_TYPE(Aspeed2400SoCState, ASPEED2400_SOC)
+
 struct Aspeed2600SoCState {
     AspeedSoCState parent;
 };
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
 }
-static Property aspeed_soc_properties[] = {
-    DEFINE_PROP_LINK("memory", AspeedSoCState, memory, TYPE_MEMORY_REGION,
-                     MemoryRegion *),
-    DEFINE_PROP_LINK("dram", AspeedSoCState, dram_mr, TYPE_MEMORY_REGION,
-                     MemoryRegion *),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void aspeed_soc_class_init(ObjectClass *oc, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(oc);
-
-    device_class_set_props(dc, aspeed_soc_properties);
-}
-
-static const TypeInfo aspeed_soc_type_info = {
-    .name           = TYPE_ASPEED_SOC,
-    .parent         = TYPE_DEVICE,
-    .instance_size  = sizeof(AspeedSoCState),
-    .class_size     = sizeof(AspeedSoCClass),
-    .class_init     = aspeed_soc_class_init,
-    .abstract       = true,
-};
 
 static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
 {
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2400_class_init(ObjectClass *oc, void *data)
     sc->get_irq      = aspeed_soc_ast2400_get_irq;
 }
 
-static const TypeInfo aspeed_soc_ast2400_type_info = {
-    .name           = "ast2400-a1",
-    .parent         = TYPE_ASPEED_SOC,
-    .instance_init  = aspeed_ast2400_soc_init,
-    .instance_size  = sizeof(AspeedSoCState),
-    .class_init     = aspeed_soc_ast2400_class_init,
-};
-
 static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
 {
     AspeedSoCClass *sc = ASPEED_SOC_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2500_class_init(ObjectClass *oc, void *data)
     sc->get_irq      = aspeed_soc_ast2400_get_irq;
 }
 
-static const TypeInfo aspeed_soc_ast2500_type_info = {
-    .name           = "ast2500-a1",
-    .parent         = TYPE_ASPEED_SOC,
-    .instance_init  = aspeed_ast2400_soc_init,
-    .instance_size  = sizeof(AspeedSoCState),
-    .class_init     = aspeed_soc_ast2500_class_init,
-};
-static void aspeed_soc_register_types(void)
-{
-    type_register_static(&aspeed_soc_type_info);
-    type_register_static(&aspeed_soc_ast2400_type_info);
-    type_register_static(&aspeed_soc_ast2500_type_info);
+static const TypeInfo aspeed_soc_ast2400_types[] = {
+    {
+        .name           = TYPE_ASPEED2400_SOC,
+        .parent         = TYPE_ASPEED_SOC,
+        .instance_init  = aspeed_ast2400_soc_init,
+        .instance_size  = sizeof(Aspeed2400SoCState),
+        .abstract       = true,
+    }, {
+        .name           = "ast2400-a1",
+        .parent         = TYPE_ASPEED2400_SOC,
+        .class_init     = aspeed_soc_ast2400_class_init,
+    }, {
+        .name           = "ast2500-a1",
+        .parent         = TYPE_ASPEED2400_SOC,
+        .class_init     = aspeed_soc_ast2500_class_init,
+    },
 };
 
-type_init(aspeed_soc_register_types);
+DEFINE_TYPES(aspeed_soc_ast2400_types)
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
+#include "hw/qdev-properties.h"
 #include "hw/misc/unimp.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/char/serial.h"
@@ -XXX,XX +XXX,XX @@ void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
     memory_region_add_subregion_overlap(s->memory, addr,
                                         sysbus_mmio_get_region(dev, 0), -1000);
 }
+
+static Property aspeed_soc_properties[] = {
+    DEFINE_PROP_LINK("dram", AspeedSoCState, dram_mr, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_LINK("memory", AspeedSoCState, memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void aspeed_soc_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    device_class_set_props(dc, aspeed_soc_properties);
+}
+
+static const TypeInfo aspeed_soc_types[] = {
+    {
+        .name           = TYPE_ASPEED_SOC,
+        .parent         = TYPE_DEVICE,
+        .instance_size  = sizeof(AspeedSoCState),
+        .class_size     = sizeof(AspeedSoCClass),
+        .class_init     = aspeed_soc_class_init,
+        .abstract       = true,
+    },
+};
+
+DEFINE_TYPES(aspeed_soc_types)
-- 
2.41.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -XXX,XX +XXX,XX @@ void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
                                         sysbus_mmio_get_region(dev, 0), -1000);
 }
 
+static void aspeed_soc_realize(DeviceState *dev, Error **errp)
+{
+    AspeedSoCState *s = ASPEED_SOC(dev);
+
+    if (!s->memory) {
+        error_setg(errp, "'memory' link is not set");
+        return;
+    }
+}
+
 static Property aspeed_soc_properties[] = {
     DEFINE_PROP_LINK("dram", AspeedSoCState, dram_mr, TYPE_MEMORY_REGION,
                      MemoryRegion *),
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
 
+    dc->realize = aspeed_soc_realize;
     device_class_set_props(dc, aspeed_soc_properties);
 }
 
-- 
2.41.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The v7-M core is specific to the Aspeed 10x0 series,
remove it from the common AspeedSoCState.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  5 ++---
 hw/arm/aspeed_ast10x0.c     | 27 +++++++++++++++------------
 hw/arm/fby35.c              | 13 ++++++++-----
 3 files changed, 25 insertions(+), 20 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_JTAG_NUM  2
 
 struct AspeedSoCState {
-    /*< private >*/
     DeviceState parent;
 
-    /*< public >*/
     ARMCPU cpu[ASPEED_CPUS_NUM];
     A15MPPrivState     a7mpcore;
-    ARMv7MState        armv7m;
     MemoryRegion *memory;
     MemoryRegion *dram_mr;
     MemoryRegion dram_container;
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Aspeed2600SoCState, ASPEED2600_SOC)
 
 struct Aspeed10x0SoCState {
     AspeedSoCState parent;
+
+    ARMv7MState armv7m;
 };
 
 #define TYPE_ASPEED10X0_SOC "aspeed10x0-soc"
diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast1030_irqmap[] = {
 
 static qemu_irq aspeed_soc_ast1030_get_irq(AspeedSoCState *s, int dev)
 {
+    Aspeed10x0SoCState *a = ASPEED10X0_SOC(s);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 
-    return qdev_get_gpio_in(DEVICE(&s->armv7m), sc->irqmap[dev]);
+    return qdev_get_gpio_in(DEVICE(&a->armv7m), sc->irqmap[dev]);
 }
 
 static void aspeed_soc_ast1030_init(Object *obj)
 {
+    Aspeed10x0SoCState *a = ASPEED10X0_SOC(obj);
     AspeedSoCState *s = ASPEED_SOC(obj);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     char socname[8];
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_init(Object *obj)
         g_assert_not_reached();
     }
 
-    object_initialize_child(obj, "armv7m", &s->armv7m, TYPE_ARMV7M);
+    object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
 
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_init(Object *obj)
 
 static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
 {
+    Aspeed10x0SoCState *a = ASPEED10X0_SOC(dev_soc);
     AspeedSoCState *s = ASPEED_SOC(dev_soc);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     DeviceState *armv7m;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
                                   0x40000);
 
     /* AST1030 CPU Core */
-    armv7m = DEVICE(&s->armv7m);
+    armv7m = DEVICE(&a->armv7m);
     qdev_prop_set_uint32(armv7m, "num-irq", 256);
     qdev_prop_set_string(armv7m, "cpu-type", sc->cpu_type);
     qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
-    object_property_set_link(OBJECT(&s->armv7m), "memory",
+    object_property_set_link(OBJECT(&a->armv7m), "memory",
                              OBJECT(s->memory), &error_abort);
-    sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), &error_abort);
+    sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
 
     /* Internal SRAM */
     sram_name = g_strdup_printf("aspeed.sram.%d",
-                                CPU(s->armv7m.cpu)->cpu_index);
+                                CPU(a->armv7m.cpu)->cpu_index);
     memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size, &err);
     if (err != NULL) {
         error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     }
     aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
     for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
-        qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->armv7m),
+        qemu_irq irq = qdev_get_gpio_in(DEVICE(&a->armv7m),
                                         sc->irqmap[ASPEED_DEV_I2C] + i);
         /* The AST1030 I2C controller has one IRQ per bus. */
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c.busses[i]), 0, irq);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     }
     aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i3c), 0, sc->memmap[ASPEED_DEV_I3C]);
     for (i = 0; i < ASPEED_I3C_NR_DEVICES; i++) {
-        qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->armv7m),
+        qemu_irq irq = qdev_get_gpio_in(DEVICE(&a->armv7m),
                                         sc->irqmap[ASPEED_DEV_I3C] + i);
         /* The AST1030 I3C controller has one IRQ per bus. */
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->i3c.devices[i]), 0, irq);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
      * On the AST1030 LPC subdevice IRQs are connected straight to the GIC.
      */
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_1,
-                       qdev_get_gpio_in(DEVICE(&s->armv7m),
+                       qdev_get_gpio_in(DEVICE(&a->armv7m),
                                 sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_1));
 
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_2,
-                       qdev_get_gpio_in(DEVICE(&s->armv7m),
+                       qdev_get_gpio_in(DEVICE(&a->armv7m),
                                 sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_2));
 
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_3,
-                       qdev_get_gpio_in(DEVICE(&s->armv7m),
+                       qdev_get_gpio_in(DEVICE(&a->armv7m),
                                 sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_3));
 
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_4,
-                       qdev_get_gpio_in(DEVICE(&s->armv7m),
+                       qdev_get_gpio_in(DEVICE(&a->armv7m),
                                 sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_4));
 
     /* UART */
diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@ struct Fby35State {
     Clock *bic_sysclk;
 
     AspeedSoCState bmc;
-    AspeedSoCState bic;
+    Aspeed10x0SoCState bic;
 
     bool mmio_exec;
 };
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
 
 static void fby35_bic_init(Fby35State *s)
 {
+    AspeedSoCState *soc;
+
     s->bic_sysclk = clock_new(OBJECT(s), "SYSCLK");
     clock_set_hz(s->bic_sysclk, 200000000ULL);
 
     object_initialize_child(OBJECT(s), "bic", &s->bic, "ast1030-a1");
+    soc = ASPEED_SOC(&s->bic);
 
     memory_region_init(&s->bic_memory, OBJECT(&s->bic), "bic-memory",
                        UINT64_MAX);
@@ -XXX,XX +XXX,XX @@ static void fby35_bic_init(Fby35State *s)
     qdev_connect_clock_in(DEVICE(&s->bic), "sysclk", s->bic_sysclk);
     object_property_set_link(OBJECT(&s->bic), "memory", OBJECT(&s->bic_memory),
                              &error_abort);
-    aspeed_soc_uart_set_chr(&s->bic, ASPEED_DEV_UART5, serial_hd(1));
+    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART5, serial_hd(1));
     qdev_realize(DEVICE(&s->bic), NULL, &error_abort);
 
-    aspeed_board_init_flashes(&s->bic.fmc, "sst25vf032b", 2, 2);
-    aspeed_board_init_flashes(&s->bic.spi[0], "sst25vf032b", 2, 4);
-    aspeed_board_init_flashes(&s->bic.spi[1], "sst25vf032b", 2, 6);
+    aspeed_board_init_flashes(&soc->fmc, "sst25vf032b", 2, 2);
+    aspeed_board_init_flashes(&soc->spi[0], "sst25vf032b", 2, 4);
+    aspeed_board_init_flashes(&soc->spi[1], "sst25vf032b", 2, 6);
 }
 
 static void fby35_init(MachineState *machine)
-- 
2.41.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The v7-A cluster is specific to the Aspeed 2600 series,
remove it from the common AspeedSoCState.

The ARM cores belong to the MP cluster, but the array
is currently used by TYPE_ASPEED2600_SOC. We'll clean
that soon, but for now keep it in Aspeed2600SoCState.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  4 ++-
 hw/arm/aspeed_ast2600.c     | 49 ++++++++++++++++++++-----------------
 hw/arm/fby35.c              | 14 ++++++-----
 3 files changed, 37 insertions(+), 30 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
     DeviceState parent;
 
     ARMCPU cpu[ASPEED_CPUS_NUM];
-    A15MPPrivState     a7mpcore;
     MemoryRegion *memory;
     MemoryRegion *dram_mr;
     MemoryRegion dram_container;
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Aspeed2400SoCState, ASPEED2400_SOC)
 
 struct Aspeed2600SoCState {
     AspeedSoCState parent;
+
+    A15MPPrivState a7mpcore;
+    ARMCPU cpu[ASPEED_CPUS_NUM]; /* XXX belong to a7mpcore */
 };
 
 #define TYPE_ASPEED2600_SOC "aspeed2600-soc"
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2600_irqmap[] = {
 
 static qemu_irq aspeed_soc_ast2600_get_irq(AspeedSoCState *s, int dev)
 {
+    Aspeed2600SoCState *a = ASPEED2600_SOC(s);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 
-    return qdev_get_gpio_in(DEVICE(&s->a7mpcore), sc->irqmap[dev]);
+    return qdev_get_gpio_in(DEVICE(&a->a7mpcore), sc->irqmap[dev]);
 }
 
 static void aspeed_soc_ast2600_init(Object *obj)
 {
+    Aspeed2600SoCState *a = ASPEED2600_SOC(obj);
     AspeedSoCState *s = ASPEED_SOC(obj);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     int i;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
     }
 
     for (i = 0; i < sc->num_cpus; i++) {
-        object_initialize_child(obj, "cpu[*]", &s->cpu[i], sc->cpu_type);
+        object_initialize_child(obj, "cpu[*]", &a->cpu[i], sc->cpu_type);
     }
 
     snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
     object_property_add_alias(obj, "hw-prot-key", OBJECT(&s->scu),
                               "hw-prot-key");
 
-    object_initialize_child(obj, "a7mpcore", &s->a7mpcore,
+    object_initialize_child(obj, "a7mpcore", &a->a7mpcore,
                             TYPE_A15MPCORE_PRIV);
 
     object_initialize_child(obj, "rtc", &s->rtc, TYPE_ASPEED_RTC);
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_calc_affinity(int cpu)
 static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
 {
     int i;
+    Aspeed2600SoCState *a = ASPEED2600_SOC(dev);
     AspeedSoCState *s = ASPEED_SOC(dev);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     Error *err = NULL;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     /* CPU */
     for (i = 0; i < sc->num_cpus; i++) {
         if (sc->num_cpus > 1) {
-            object_property_set_int(OBJECT(&s->cpu[i]), "reset-cbar",
+            object_property_set_int(OBJECT(&a->cpu[i]), "reset-cbar",
                                     ASPEED_A7MPCORE_ADDR, &error_abort);
         }
-        object_property_set_int(OBJECT(&s->cpu[i]), "mp-affinity",
+        object_property_set_int(OBJECT(&a->cpu[i]), "mp-affinity",
                                 aspeed_calc_affinity(i), &error_abort);
 
-        object_property_set_int(OBJECT(&s->cpu[i]), "cntfrq", 1125000000,
+        object_property_set_int(OBJECT(&a->cpu[i]), "cntfrq", 1125000000,
                                 &error_abort);
-        object_property_set_bool(OBJECT(&s->cpu[i]), "neon", false,
+        object_property_set_bool(OBJECT(&a->cpu[i]), "neon", false,
                                 &error_abort);
-        object_property_set_bool(OBJECT(&s->cpu[i]), "vfp-d32", false,
+        object_property_set_bool(OBJECT(&a->cpu[i]), "vfp-d32", false,
                                 &error_abort);
-        object_property_set_link(OBJECT(&s->cpu[i]), "memory",
+        object_property_set_link(OBJECT(&a->cpu[i]), "memory",
                                  OBJECT(s->memory), &error_abort);
 
-        if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
+        if (!qdev_realize(DEVICE(&a->cpu[i]), NULL, errp)) {
             return;
         }
     }
 
     /* A7MPCORE */
-    object_property_set_int(OBJECT(&s->a7mpcore), "num-cpu", sc->num_cpus,
+    object_property_set_int(OBJECT(&a->a7mpcore), "num-cpu", sc->num_cpus,
                             &error_abort);
-    object_property_set_int(OBJECT(&s->a7mpcore), "num-irq",
+    object_property_set_int(OBJECT(&a->a7mpcore), "num-irq",
                             ROUND_UP(AST2600_MAX_IRQ + GIC_INTERNAL, 32),
                             &error_abort);
 
-    sysbus_realize(SYS_BUS_DEVICE(&s->a7mpcore), &error_abort);
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->a7mpcore), 0, ASPEED_A7MPCORE_ADDR);
+    sysbus_realize(SYS_BUS_DEVICE(&a->a7mpcore), &error_abort);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->a7mpcore), 0, ASPEED_A7MPCORE_ADDR);
 
     for (i = 0; i < sc->num_cpus; i++) {
-        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->a7mpcore);
-        DeviceState  *d   = DEVICE(&s->cpu[i]);
+        SysBusDevice *sbd = SYS_BUS_DEVICE(&a->a7mpcore);
+        DeviceState  *d   = DEVICE(&a->cpu[i]);
 
         irq = qdev_get_gpio_in(d, ARM_CPU_IRQ);
         sysbus_connect_irq(sbd, i, irq);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     }
 
     /* SRAM */
-    sram_name = g_strdup_printf("aspeed.sram.%d", CPU(&s->cpu[0])->cpu_index);
+    sram_name = g_strdup_printf("aspeed.sram.%d", CPU(&a->cpu[0])->cpu_index);
     memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size, &err);
     if (err) {
         error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     }
     aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
     for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
-        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+        irq = qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                sc->irqmap[ASPEED_DEV_I2C] + i);
         /* The AST2600 I2C controller has one IRQ per bus. */
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c.busses[i]), 0, irq);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
      * offset 0.
      */
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_1,
-                       qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+                       qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                 sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_1));
 
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_2,
-                       qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+                       qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                 sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_2));
 
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_3,
-                       qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+                       qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                 sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_3));
 
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 1 + aspeed_lpc_kcs_4,
-                       qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+                       qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                 sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_4));
 
     /* HACE */
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     }
     aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i3c), 0, sc->memmap[ASPEED_DEV_I3C]);
     for (i = 0; i < ASPEED_I3C_NR_DEVICES; i++) {
-        irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore),
+        irq = qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                sc->irqmap[ASPEED_DEV_I3C] + i);
         /* The AST2600 I3C controller has one IRQ per bus. */
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->i3c.devices[i]), 0, irq);
diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@ struct Fby35State {
     MemoryRegion bic_memory;
     Clock *bic_sysclk;
 
-    AspeedSoCState bmc;
+    Aspeed2600SoCState bmc;
     Aspeed10x0SoCState bic;
 
     bool mmio_exec;
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_write_boot_rom(DriveInfo *dinfo, MemoryRegion *mr,
 
 static void fby35_bmc_init(Fby35State *s)
 {
+    AspeedSoCState *soc;
+
     object_initialize_child(OBJECT(s), "bmc", &s->bmc, "ast2600-a3");
+    soc = ASPEED_SOC(&s->bmc);
 
     memory_region_init(&s->bmc_memory, OBJECT(&s->bmc), "bmc-memory",
                        UINT64_MAX);
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
                             &error_abort);
     object_property_set_int(OBJECT(&s->bmc), "hw-strap2", 0x00000003,
                             &error_abort);
-    aspeed_soc_uart_set_chr(&s->bmc, ASPEED_DEV_UART5, serial_hd(0));
+    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART5, serial_hd(0));
     qdev_realize(DEVICE(&s->bmc), NULL, &error_abort);
 
-    aspeed_board_init_flashes(&s->bmc.fmc, "n25q00", 2, 0);
+    aspeed_board_init_flashes(&soc->fmc, "n25q00", 2, 0);
 
     /* Install first FMC flash content as a boot rom. */
     if (!s->mmio_exec) {
         DriveInfo *mtd0 = drive_get(IF_MTD, 0, 0);
 
         if (mtd0) {
-            AspeedSoCState *bmc = &s->bmc;
-            uint64_t rom_size = memory_region_size(&bmc->spi_boot);
+            uint64_t rom_size = memory_region_size(&soc->spi_boot);
 
             memory_region_init_rom(&s->bmc_boot_rom, NULL, "aspeed.boot_rom",
                                    rom_size, &error_abort);
-            memory_region_add_subregion_overlap(&bmc->spi_boot_container, 0,
+            memory_region_add_subregion_overlap(&soc->spi_boot_container, 0,
                                                 &s->bmc_boot_rom, 1);
 
             fby35_bmc_write_boot_rom(mtd0, &s->bmc_boot_rom,
-- 
2.41.0

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The ARM array and VIC peripheral are only used by the
2400 series, remove them from the common AspeedSoCState.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h               |  5 +++--
 hw/arm/{aspeed_soc.c => aspeed_ast2400.c} | 27 +++++++++++++----------
 hw/arm/meson.build                        |  2 +-
 3 files changed, 19 insertions(+), 15 deletions(-)
 rename hw/arm/{aspeed_soc.c => aspeed_ast2400.c} (95%)