Series comparison

-[PULL 00/27] aspeed queue
+[PULL 0/3] aspeed queue
-The following changes since commit 621745c4f349ac09b72706c46febee983abca916:
+The following changes since commit 527dede083d3e3e5a13ee996776926e0a0c4e258:
-  Merge tag 'trivial-branch-for-7.1-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-06-30 04:49:40 +0530)
+  Merge tag 'pull-request-2025-03-19' of https://gitlab.com/thuth/qemu into staging (2025-03-20 08:41:25 -0400)
 are available in the Git repository at:
-  https://github.com/legoater/qemu/ tags/pull-aspeed-20220630
+  https://github.com/legoater/qemu/ tags/pull-aspeed-20250323
-for you to fetch changes up to 55c57023b740c29151d42600af9ac43ba00e56cc:
+for you to fetch changes up to 78877b2e06464f49f777e086845e094ea7bc82ef:
-  hw/misc/aspeed: Add PECI controller (2022-06-30 09:21:14 +0200)
+  hw/misc/aspeed_hace: Fix buffer overflow in has_padding function (2025-03-23 18:42:16 +0100)
 ----------------------------------------------------------------
 aspeed queue:
-* m25p80 improvements (Iris)
+* Fix AST2700 SoC model
 * Code cleanup in preparation of multi SoC machine (Peter)
 * New MAX31785 model (Mahesh)
 * New Qualcomm machines (Jae and Graeme)
 * Core I2C slave mode (Klaus)
 * Aspeed I2C slave mode for old and new register interface (Peter and Klaus)
 * New Aspeed PECI model (Peter)
 * Various small fixes
 ----------------------------------------------------------------
-Cédric Le Goater (4):
+Jamin Lin (1):
-      aspeed: Set the dram container at the SoC level
+      hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
       aspeed/scu: Add trace events for read ops
       aspeed/i2c: Change trace event for NORMAL_STOP states
       aspeed/smc: Fix potential overflow
-Graeme Gregory (1):
+Steven Lee (1):
-      hw/arm/aspeed: add Qualcomm Firework BMC machine
+      hw/intc/aspeed: Fix IRQ handler mask check
-Iris Chen (2):
+Troy Lee (1):
-      hw: m25p80: add WP# pin and SRWD bit for write protection
+      aspeed: Fix maximum number of spi controller
       hw: m25p80: add tests for write protect (WP# and SRWD bit)
-Jae Hyun Yoo (2):
+ include/hw/arm/aspeed_soc.h | 2 +-
-      hw/arm/aspeed: add support for the Qualcomm DC-SCM v1 board
+ hw/intc/aspeed_intc.c       | 2 +-
-      hw/arm/aspeed: firework: add I2C MUXes for VR channels
+ hw/misc/aspeed_hace.c       | 5 +++++
+files changed, 7 insertions(+), 2 deletions(-)
 Joel Stanley (1):
       aspeed/hace: Accumulative mode supported
 Klaus Jensen (3):
       hw/i2c: support multiple masters
       hw/i2c: add asynchronous send
       hw/i2c/aspeed: add slave device in old register mode
 Maheswara Kurapati (4):
       hw/i2c: pmbus: Page #255 is valid page for read requests.
       hw/sensor: add Maxim MAX31785 device
       hw/arm/aspeed: Add MAX31785 Fan controllers
       hw/arm/aspeed: firework: Add Thermal Diodes
 Peter Delevoryas (10):
       aspeed: Set CPU memory property explicitly
       aspeed: Add memory property to Aspeed SoC
       aspeed: Remove usage of sysbus_mmio_map
       aspeed: Map unimplemented devices in SoC memory
       aspeed: Remove use of qemu_get_cpu
       hw/i2c/aspeed: Fix R_I2CD_FUN_CTRL reference
       hw/i2c/aspeed: Fix DMA len write-enable bit handling
       hw/i2c/aspeed: Fix MASTER_EN missing error message
       hw/i2c/aspeed: Add new-registers DMA slave mode RX support
       hw/misc/aspeed: Add PECI controller
  include/hw/arm/aspeed_soc.h   |  16 ++
  include/hw/i2c/aspeed_i2c.h   |  11 +
  include/hw/i2c/i2c.h          |  30 +++
  include/hw/misc/aspeed_peci.h |  29 +++
  hw/arm/aspeed.c               | 136 +++++++---
  hw/arm/aspeed_ast10x0.c       |  59 +++--
  hw/arm/aspeed_ast2600.c       | 104 +++++---
  hw/arm/aspeed_soc.c           | 143 ++++++++---
  hw/arm/pxa2xx.c               |   2 +
  hw/block/m25p80.c             |  82 ++++--
  hw/display/sii9022.c          |   2 +
  hw/display/ssd0303.c          |   2 +
  hw/i2c/aspeed_i2c.c           | 236 ++++++++++++++---
  hw/i2c/core.c                 |  70 +++++-
  hw/i2c/pmbus_device.c         |   6 +-
  hw/i2c/smbus_slave.c          |   4 +
  hw/misc/aspeed_hace.c         |   6 +-
  hw/misc/aspeed_peci.c         | 152 +++++++++++
  hw/misc/aspeed_scu.c          |   2 +
  hw/nvram/eeprom_at24c.c       |   2 +
  hw/sensor/lsm303dlhc_mag.c    |   2 +
  hw/sensor/max31785.c          | 573 ++++++++++++++++++++++++++++++++++++++++++
  hw/ssi/aspeed_smc.c           |   4 +-
  tests/qtest/aspeed_smc-test.c |  62 +++++
  hw/arm/Kconfig                |   2 +
  hw/i2c/trace-events           |   2 +
  hw/misc/meson.build           |   3 +-
  hw/misc/trace-events          |   6 +
  hw/sensor/Kconfig             |   4 +
  hw/sensor/meson.build         |   1 +
 files changed, 1573 insertions(+), 180 deletions(-)
  create mode 100644 include/hw/misc/aspeed_peci.h
  create mode 100644 hw/misc/aspeed_peci.c
  create mode 100644 hw/sensor/max31785.c

-[PULL 01/27] hw: m25p80: add WP# pin and SRWD bit for write protection
+Deleted patch
-From: Iris Chen <irischenlj@gmail.com>
-Signed-off-by: Iris Chen <irischenlj@gmail.com>
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-Message-Id: <20220621202427.2680413-1-irischenlj@fb.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/block/m25p80.c | 82 ++++++++++++++++++++++++++++++++++++++---------
-file changed, 67 insertions(+), 15 deletions(-)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
-+++ b/hw/block/m25p80.c
-@@ -XXX,XX +XXX,XX @@ struct Flash {
-     uint8_t spansion_cr2v;
-     uint8_t spansion_cr3v;
-     uint8_t spansion_cr4v;
-+    bool wp_level;
-     bool write_enable;
-     bool four_bytes_address_mode;
-     bool reset_enable;
-     bool quad_enable;
-     bool aai_enable;
-+    bool status_register_write_disabled;
-     uint8_t ear;
-     int64_t dirty_page;
-@@ -XXX,XX +XXX,XX @@ static void complete_collecting_data(Flash *s)
-         flash_erase(s, s->cur_addr, s->cmd_in_progress);
-         break;
-     case WRSR:
-+        s->status_register_write_disabled = extract32(s->data[0], 7, 1);
-+
-         switch (get_man(s)) {
-         case MAN_SPANSION:
-             s->quad_enable = !!(s->data[1] & 0x02);
-@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
-         break;
-     case WRSR:
--        if (s->write_enable) {
--            switch (get_man(s)) {
--            case MAN_SPANSION:
--                s->needed_bytes = 2;
--                s->state = STATE_COLLECTING_DATA;
--                break;
--            case MAN_MACRONIX:
--                s->needed_bytes = 2;
--                s->state = STATE_COLLECTING_VAR_LEN_DATA;
--                break;
--            default:
--                s->needed_bytes = 1;
--                s->state = STATE_COLLECTING_DATA;
--            }
--            s->pos = 0;
-+        /*
-+         * If WP# is low and status_register_write_disabled is high,
-+         * status register writes are disabled.
-+         * This is also called "hardware protected mode" (HPM). All other
-+         * combinations of the two states are called "software protected mode"
-+         * (SPM), and status register writes are permitted.
-+         */
-+        if ((s->wp_level == 0 && s->status_register_write_disabled)
-+            || !s->write_enable) {
-+            qemu_log_mask(LOG_GUEST_ERROR,
-+                          "M25P80: Status register write is disabled!\n");
-+            break;
-+        }
-+
-+        switch (get_man(s)) {
-+        case MAN_SPANSION:
-+            s->needed_bytes = 2;
-+            s->state = STATE_COLLECTING_DATA;
-+            break;
-+        case MAN_MACRONIX:
-+            s->needed_bytes = 2;
-+            s->state = STATE_COLLECTING_VAR_LEN_DATA;
-+            break;
-+        default:
-+            s->needed_bytes = 1;
-+            s->state = STATE_COLLECTING_DATA;
-         }
-+        s->pos = 0;
-         break;
-     case WRDI:
-@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
-     case RDSR:
-         s->data[0] = (!!s->write_enable) << 1;
-+        s->data[0] |= (!!s->status_register_write_disabled) << 7;
-+
-         if (get_man(s) == MAN_MACRONIX || get_man(s) == MAN_ISSI) {
-             s->data[0] |= (!!s->quad_enable) << 6;
-         }
-@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSIPeripheral *ss, uint32_t tx)
-     return r;
- }
-+static void m25p80_write_protect_pin_irq_handler(void *opaque, int n, int level)
-+{
-+    Flash *s = M25P80(opaque);
-+    /* WP# is just a single pin. */
-+    assert(n == 0);
-+    s->wp_level = !!level;
-+}
-+
- static void m25p80_realize(SSIPeripheral *ss, Error **errp)
- {
-     Flash *s = M25P80(ss);
-@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSIPeripheral *ss, Error **errp)
-         s->storage = blk_blockalign(NULL, s->size);
-         memset(s->storage, 0xFF, s->size);
-     }
-+
-+    qdev_init_gpio_in_named(DEVICE(s),
-+                            m25p80_write_protect_pin_irq_handler, "WP#", 1);
- }
- static void m25p80_reset(DeviceState *d)
- {
-     Flash *s = M25P80(d);
-+    s->wp_level = true;
-+    s->status_register_write_disabled = false;
-+
-     reset_memory(s);
- }
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m25p80_aai_enable = {
-     }
- };
-+static bool m25p80_wp_level_srwd_needed(void *opaque)
-+{
-+    Flash *s = (Flash *)opaque;
-+
-+    return !s->wp_level || s->status_register_write_disabled;
-+}
-+
-+static const VMStateDescription vmstate_m25p80_write_protect = {
-+    .name = "m25p80/write_protect",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .needed = m25p80_wp_level_srwd_needed,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_BOOL(wp_level, Flash),
-+        VMSTATE_BOOL(status_register_write_disabled, Flash),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
- static const VMStateDescription vmstate_m25p80 = {
-     .name = "m25p80",
-     .version_id = 0,
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m25p80 = {
-     .subsections = (const VMStateDescription * []) {
-         &vmstate_m25p80_data_read_loop,
-         &vmstate_m25p80_aai_enable,
-+        &vmstate_m25p80_write_protect,
-         NULL
-     }
- };
---
-.35.3

-[PULL 02/27] hw: m25p80: add tests for write protect (WP# and SRWD bit)
+Deleted patch
-From: Iris Chen <irischenlj@fb.com>
-Signed-off-by: Iris Chen <irischenlj@fb.com>
-Message-Id: <20220624183016.2125264-1-irischenlj@fb.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- tests/qtest/aspeed_smc-test.c | 62 +++++++++++++++++++++++++++++++++++
-file changed, 62 insertions(+)
-diff --git a/tests/qtest/aspeed_smc-test.c b/tests/qtest/aspeed_smc-test.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/aspeed_smc-test.c
-+++ b/tests/qtest/aspeed_smc-test.c
-@@ -XXX,XX +XXX,XX @@ enum {
-     BULK_ERASE = 0xc7,
-     READ = 0x03,
-     PP = 0x02,
-+    WRSR = 0x1,
-     WREN = 0x6,
-+    SRWD = 0x80,
-     RESET_ENABLE = 0x66,
-     RESET_MEMORY = 0x99,
-     EN_4BYTE_ADDR = 0xB7,
-@@ -XXX,XX +XXX,XX @@ static void test_read_status_reg(void)
-     flash_reset();
- }
-+static void test_status_reg_write_protection(void)
-+{
-+    uint8_t r;
-+
-+    spi_conf(CONF_ENABLE_W0);
-+
-+    /* default case: WP# is high and SRWD is low -> status register writable */
-+    spi_ctrl_start_user();
-+    writeb(ASPEED_FLASH_BASE, WREN);
-+    /* test ability to write SRWD */
-+    writeb(ASPEED_FLASH_BASE, WRSR);
-+    writeb(ASPEED_FLASH_BASE, SRWD);
-+    writeb(ASPEED_FLASH_BASE, RDSR);
-+    r = readb(ASPEED_FLASH_BASE);
-+    spi_ctrl_stop_user();
-+    g_assert_cmphex(r & SRWD, ==, SRWD);
-+
-+    /* WP# high and SRWD high -> status register writable */
-+    spi_ctrl_start_user();
-+    writeb(ASPEED_FLASH_BASE, WREN);
-+    /* test ability to write SRWD */
-+    writeb(ASPEED_FLASH_BASE, WRSR);
-+    writeb(ASPEED_FLASH_BASE, 0);
-+    writeb(ASPEED_FLASH_BASE, RDSR);
-+    r = readb(ASPEED_FLASH_BASE);
-+    spi_ctrl_stop_user();
-+    g_assert_cmphex(r & SRWD, ==, 0);
-+
-+    /* WP# low and SRWD low -> status register writable */
-+    qtest_set_irq_in(global_qtest,
-+                     "/machine/soc/fmc/ssi.0/child[0]", "WP#", 0, 0);
-+    spi_ctrl_start_user();
-+    writeb(ASPEED_FLASH_BASE, WREN);
-+    /* test ability to write SRWD */
-+    writeb(ASPEED_FLASH_BASE, WRSR);
-+    writeb(ASPEED_FLASH_BASE, SRWD);
-+    writeb(ASPEED_FLASH_BASE, RDSR);
-+    r = readb(ASPEED_FLASH_BASE);
-+    spi_ctrl_stop_user();
-+    g_assert_cmphex(r & SRWD, ==, SRWD);
-+
-+    /* WP# low and SRWD high -> status register NOT writable */
-+    spi_ctrl_start_user();
-+    writeb(ASPEED_FLASH_BASE, WREN);
-+    /* test ability to write SRWD */
-+    writeb(ASPEED_FLASH_BASE, WRSR);
-+    writeb(ASPEED_FLASH_BASE, 0);
-+    writeb(ASPEED_FLASH_BASE, RDSR);
-+    r = readb(ASPEED_FLASH_BASE);
-+    spi_ctrl_stop_user();
-+    /* write is not successful */
-+    g_assert_cmphex(r & SRWD, ==, SRWD);
-+
-+    qtest_set_irq_in(global_qtest,
-+                     "/machine/soc/fmc/ssi.0/child[0]", "WP#", 0, 1);
-+    flash_reset();
-+}
-+
- static char tmp_path[] = "/tmp/qtest.m25p80.XXXXXX";
- int main(int argc, char **argv)
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
-     qtest_add_func("/ast2400/smc/read_page_mem", test_read_page_mem);
-     qtest_add_func("/ast2400/smc/write_page_mem", test_write_page_mem);
-     qtest_add_func("/ast2400/smc/read_status_reg", test_read_status_reg);
-+    qtest_add_func("/ast2400/smc/status_reg_write_protection",
-+                   test_status_reg_write_protection);
-     flash_reset();
-     ret = g_test_run();
---
-.35.3

-[PULL 03/27] aspeed: Set the dram container at the SoC level
+Deleted patch
-Currently, the Aspeed machines allocate a ram container region in
-which the machine ram region is mapped. See commit ad1a9782186d
-("aspeed: add a RAM memory region container"). An extra region is
-mapped after ram in the ram container to catch invalid access done by
-FW. That's how FW determines the size of ram. See commit ebe31c0a8ef7
-("aspeed: add a max_ram_size property to the memory controller").
-Let's move all the logic under the SoC where it should be. It will
-also ease the work on multi SoC support.
-Reviewed-by: Peter Delevoryas <pdel@fb.com>
-Message-Id: <20220623202123.3972977-1-clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- include/hw/arm/aspeed_soc.h |  2 ++
- hw/arm/aspeed.c             | 39 ++---------------------------
- hw/arm/aspeed_ast2600.c     |  7 ++++--
- hw/arm/aspeed_soc.c         | 49 +++++++++++++++++++++++++++++++++++--
-files changed, 56 insertions(+), 41 deletions(-)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
-+++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
-     A15MPPrivState     a7mpcore;
-     ARMv7MState        armv7m;
-     MemoryRegion *dram_mr;
-+    MemoryRegion dram_container;
-     MemoryRegion sram;
-     AspeedVICState vic;
-     AspeedRtcState rtc;
-@@ -XXX,XX +XXX,XX @@ enum {
- qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
- void aspeed_soc_uart_init(AspeedSoCState *s);
-+bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
- #endif /* ASPEED_SOC_H */
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ struct AspeedMachineState {
- #define BLETCHLEY_BMC_HW_STRAP1 AST2600_EVB_HW_STRAP1
- #define BLETCHLEY_BMC_HW_STRAP2 AST2600_EVB_HW_STRAP2
--/*
-- * The max ram region is for firmwares that scan the address space
-- * with load/store to guess how much RAM the SoC has.
-- */
--static uint64_t max_ram_read(void *opaque, hwaddr offset, unsigned size)
--{
--    return 0;
--}
--
--static void max_ram_write(void *opaque, hwaddr offset, uint64_t value,
--                           unsigned size)
--{
--    /* Discard writes */
--}
--
--static const MemoryRegionOps max_ram_ops = {
--    .read = max_ram_read,
--    .write = max_ram_write,
--    .endianness = DEVICE_NATIVE_ENDIAN,
--};
--
- #define AST_SMP_MAILBOX_BASE            0x1e6e2180
- #define AST_SMP_MBOX_FIELD_ENTRY        (AST_SMP_MAILBOX_BASE + 0x0)
- #define AST_SMP_MBOX_FIELD_GOSIGN       (AST_SMP_MAILBOX_BASE + 0x4)
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-     AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(machine);
-     AspeedSoCClass *sc;
-     DriveInfo *drive0 = drive_get(IF_MTD, 0, 0);
--    ram_addr_t max_ram_size;
-     int i;
-     NICInfo *nd = &nd_table[0];
--    memory_region_init(&bmc->ram_container, NULL, "aspeed-ram-container",
--                       4 * GiB);
--    memory_region_add_subregion(&bmc->ram_container, 0, machine->ram);
--
-     object_initialize_child(OBJECT(machine), "soc", &bmc->soc, amc->soc_name);
-     sc = ASPEED_SOC_GET_CLASS(&bmc->soc);
-     /*
--     * This will error out if isize is not supported by memory controller.
-+     * This will error out if the RAM size is not supported by the
-+     * memory controller of the SoC.
-      */
-     object_property_set_uint(OBJECT(&bmc->soc), "ram-size", machine->ram_size,
-                              &error_fatal);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-                          amc->uart_default);
-     qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
--    memory_region_add_subregion(get_system_memory(),
--                                sc->memmap[ASPEED_DEV_SDRAM],
--                                &bmc->ram_container);
--
--    max_ram_size = object_property_get_uint(OBJECT(&bmc->soc), "max-ram-size",
--                                            &error_abort);
--    memory_region_init_io(&bmc->max_ram, NULL, &max_ram_ops, NULL,
--                          "max_ram", max_ram_size  - machine->ram_size);
--    memory_region_add_subregion(&bmc->ram_container, machine->ram_size, &bmc->max_ram);
--
-     aspeed_board_init_flashes(&bmc->soc.fmc,
-                               bmc->fmc_model ? bmc->fmc_model : amc->fmc_model,
-                               amc->num_cs, 0);
-diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast2600.c
-+++ b/hw/arm/aspeed_ast2600.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
-     object_initialize_child(obj, "sdmc", &s->sdmc, typename);
-     object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
-                               "ram-size");
--    object_property_add_alias(obj, "max-ram-size", OBJECT(&s->sdmc),
--                              "max-ram-size");
-     for (i = 0; i < sc->wdts_num; i++) {
-         snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-                         sc->memmap[ASPEED_DEV_WDT] + i * awc->offset);
-     }
-+    /* RAM */
-+    if (!aspeed_soc_dram_init(s, errp)) {
-+        return;
-+    }
-+
-     /* Net */
-     for (i = 0; i < sc->macs_num; i++) {
-         object_property_set_bool(OBJECT(&s->ftgmac100[i]), "aspeed", true,
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
-+++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
-+#include "qemu/units.h"
- #include "qapi/error.h"
- #include "hw/misc/unimp.h"
- #include "hw/arm/aspeed_soc.h"
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
-     object_initialize_child(obj, "sdmc", &s->sdmc, typename);
-     object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
-                               "ram-size");
--    object_property_add_alias(obj, "max-ram-size", OBJECT(&s->sdmc),
--                              "max-ram-size");
-     for (i = 0; i < sc->wdts_num; i++) {
-         snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-                         sc->memmap[ASPEED_DEV_WDT] + i * awc->offset);
-     }
-+    /* RAM  */
-+    if (!aspeed_soc_dram_init(s, errp)) {
-+        return;
-+    }
-+
-     /* Net */
-     for (i = 0; i < sc->macs_num; i++) {
-         object_property_set_bool(OBJECT(&s->ftgmac100[i]), "aspeed", true,
-@@ -XXX,XX +XXX,XX @@ void aspeed_soc_uart_init(AspeedSoCState *s)
-                        serial_hd(i), DEVICE_LITTLE_ENDIAN);
-     }
- }
-+
-+/*
-+ * SDMC should be realized first to get correct RAM size and max size
-+ * values
-+ */
-+bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp)
-+{
-+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-+    ram_addr_t ram_size, max_ram_size;
-+
-+    ram_size = object_property_get_uint(OBJECT(&s->sdmc), "ram-size",
-+                                        &error_abort);
-+    max_ram_size = object_property_get_uint(OBJECT(&s->sdmc), "max-ram-size",
-+                                            &error_abort);
-+
-+    memory_region_init(&s->dram_container, OBJECT(s), "ram-container",
-+                       max_ram_size);
-+    memory_region_add_subregion(&s->dram_container, 0, s->dram_mr);
-+
-+    /*
-+     * Add a memory region beyond the RAM region to let firmwares scan
-+     * the address space with load/store and guess how much RAM the
-+     * SoC has.
-+     */
-+    if (ram_size < max_ram_size) {
-+        DeviceState *dev = qdev_new(TYPE_UNIMPLEMENTED_DEVICE);
-+
-+        qdev_prop_set_string(dev, "name", "ram-empty");
-+        qdev_prop_set_uint64(dev, "size", max_ram_size  - ram_size);
-+        if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp)) {
-+            return false;
-+        }
-+
-+        memory_region_add_subregion_overlap(&s->dram_container, ram_size,
-+                      sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0), -1000);
-+    }
-+
-+    memory_region_add_subregion(get_system_memory(),
-+                      sc->memmap[ASPEED_DEV_SDRAM], &s->dram_container);
-+    return true;
-+}
---
-.35.3

-[PULL 04/27] aspeed/scu: Add trace events for read ops
+Deleted patch
-Reviewed-by: Peter Delevoryas <pdel@fb.com>
-Message-Id: <20220628154740.1117349-2-clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/misc/aspeed_scu.c | 2 ++
- hw/misc/trace-events | 1 +
-files changed, 3 insertions(+)
-diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/aspeed_scu.c
-+++ b/hw/misc/aspeed_scu.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_scu_read(void *opaque, hwaddr offset, unsigned size)
-         break;
-     }
-+    trace_aspeed_scu_read(offset, size, s->regs[reg]);
-     return s->regs[reg];
- }
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_ast2600_scu_read(void *opaque, hwaddr offset,
-         break;
-     }
-+    trace_aspeed_scu_read(offset, size, s->regs[reg]);
-     return s->regs[reg];
- }
-diff --git a/hw/misc/trace-events b/hw/misc/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/trace-events
-+++ b/hw/misc/trace-events
-@@ -XXX,XX +XXX,XX @@ slavio_led_mem_readw(uint32_t ret) "Read diagnostic LED 0x%04x"
- # aspeed_scu.c
- aspeed_scu_write(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
-+aspeed_scu_read(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
- # mps2-scc.c
- mps2_scc_read(uint64_t offset, uint64_t data, unsigned size) "MPS2 SCC read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
---
-.35.3

-[PULL 27/27] hw/misc/aspeed: Add PECI controller
+[PULL 1/3] aspeed: Fix maximum number of spi controller
-From: Peter Delevoryas <pdel@fb.com>
+From: Troy Lee <troy_lee@aspeedtech.com>
-This introduces a really basic PECI controller that responses to
+Commit 6de4aa8dc544 ("hw/arm/aspeed_ast27x0: Add SoC Support for AST2700
-commands by always setting the response code to success and then raising
+A1") extends ast2700a1 spis_num to 3, but ASPEED_SPIS_NUM defines the
-an interrupt to indicate the command is done. This helps avoid getting
+maximum number of spi controller to 2, result in ehci[0] is being
-hit with constant errors if the driver continuously attempts to send a
+overwritten in runtime.
 command and keeps timing out.
-The AST2400 and AST2500 only included registers up to 0x5C, not 0xFC.
+Signed-off-by: Troy Lee <troy_lee@aspeedtech.com>
-They supported PECI 1.1, 2.0, and 3.0. The AST2600 and AST1030 support
+Fixes: 6de4aa8dc544 ("hw/arm/aspeed_ast27x0: Add SoC Support for AST2700 A1")
-PECI 4.0, which includes more read/write buffer registers from 0x80 to
+Reviewed-by: Cédric Le Goater <clg@redhat.com>
-xFC to support 64-byte mode.
+Link: https://lore.kernel.org/qemu-devel/20250317065938.1902272-1-troy_lee@aspeedtech.com
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
 This patch doesn't attempt to handle that, or to create a different
 version of the controller for the different generations, since it's only
 implementing functionality that is common to all generations.
 The basic sequence of events is that the firmware will read and write to
 various registers and then trigger a command by setting the FIRE bit in
 the command register (similar to the I2C controller).
 Then the firmware waits for an interrupt from the PECI controller,
 expecting the interrupt status register to be filled in with info on
 what happened. If the command was transmitted and received successfully,
 then response codes from the host CPU will be found in the data buffer
 registers.
 Signed-off-by: Peter Delevoryas <pdel@fb.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-Id: <20220630045133.32251-12-me@pjd.dev>
 [ clg: s/sysbus_mmio_map/aspeed_mmio_map/ ]
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- include/hw/arm/aspeed_soc.h   |   3 +
+ include/hw/arm/aspeed_soc.h | 2 +-
- include/hw/misc/aspeed_peci.h |  29 +++++++
+file changed, 1 insertion(+), 1 deletion(-)
  hw/arm/aspeed_ast10x0.c       |  13 +++
  hw/arm/aspeed_ast2600.c       |  13 +++
  hw/arm/aspeed_soc.c           |  14 ++++
  hw/misc/aspeed_peci.c         | 152 ++++++++++++++++++++++++++++++++++
  hw/misc/meson.build           |   3 +-
  hw/misc/trace-events          |   5 ++
 files changed, 231 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/misc/aspeed_peci.h
  create mode 100644 hw/misc/aspeed_peci.c
 diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/aspeed_soc.h
 +++ b/include/hw/arm/aspeed_soc.h
 @@ -XXX,XX +XXX,XX @@
- #include "qom/object.h"
+ #include "hw/char/serial-mm.h"
- #include "hw/misc/aspeed_lpc.h"
+ #include "hw/intc/arm_gicv3.h"
- #include "hw/misc/unimp.h"
-+#include "hw/misc/aspeed_peci.h"
+-#define ASPEED_SPIS_NUM  2
++#define ASPEED_SPIS_NUM  3
  #define ASPEED_SPIS_NUM  2
  #define ASPEED_EHCIS_NUM 2
-@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
+ #define ASPEED_WDTS_NUM  8
-     AspeedSDHCIState sdhci;
+ #define ASPEED_CPUS_NUM  4
      AspeedSDHCIState emmc;
      AspeedLPCState lpc;
 +    AspeedPECIState peci;
      uint32_t uart_default;
      Clock *sysclk;
      UnimplementedDeviceState iomem;
@@ -XXX,XX +XXX,XX @@ enum {
      ASPEED_DEV_LPC,
      ASPEED_DEV_IBT,
      ASPEED_DEV_I2C,
 +    ASPEED_DEV_PECI,
      ASPEED_DEV_ETH1,
      ASPEED_DEV_ETH2,
      ASPEED_DEV_ETH3,
 diff --git a/include/hw/misc/aspeed_peci.h b/include/hw/misc/aspeed_peci.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/misc/aspeed_peci.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Aspeed PECI Controller
 + *
 + * Copyright (c) Meta Platforms, Inc. and affiliates. (http://www.meta.com)
 + *
 + * This code is licensed under the GPL version 2 or later. See the COPYING
 + * file in the top-level directory.
 + */
 +
 +#ifndef ASPEED_PECI_H
 +#define ASPEED_PECI_H
 +
 +#include "hw/sysbus.h"
 +
 +#define ASPEED_PECI_NR_REGS ((0xFC + 4) >> 2)
 +#define TYPE_ASPEED_PECI "aspeed.peci"
 +OBJECT_DECLARE_SIMPLE_TYPE(AspeedPECIState, ASPEED_PECI);
 +
 +struct AspeedPECIState {
 +    /* <private> */
 +    SysBusDevice parent;
 +
 +    MemoryRegion mmio;
 +    qemu_irq irq;
 +
 +    uint32_t regs[ASPEED_PECI_NR_REGS];
 +};
 +
 +#endif
 diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_ast10x0.c
 +++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast1030_memmap[] = {
      [ASPEED_DEV_UART13]    = 0x7E790700,
      [ASPEED_DEV_WDT]       = 0x7E785000,
      [ASPEED_DEV_LPC]       = 0x7E789000,
 +    [ASPEED_DEV_PECI]      = 0x7E78B000,
      [ASPEED_DEV_I2C]       = 0x7E7B0000,
  };
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast1030_irqmap[] = {
      [ASPEED_DEV_TIMER8]    = 23,
      [ASPEED_DEV_WDT]       = 24,
      [ASPEED_DEV_LPC]       = 35,
 +    [ASPEED_DEV_PECI]      = 38,
      [ASPEED_DEV_FMC]       = 39,
      [ASPEED_DEV_PWM]       = 44,
      [ASPEED_DEV_ADC]       = 46,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_init(Object *obj)
      object_initialize_child(obj, "lpc", &s->lpc, TYPE_ASPEED_LPC);
 +    object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
 +
      object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_SBC);
      for (i = 0; i < sc->wdts_num; i++) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c.busses[i]), 0, irq);
      }
 +    /* PECI */
 +    if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
 +        return;
 +    }
 +    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->peci), 0,
 +                    sc->memmap[ASPEED_DEV_PECI]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
 +                       aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
 +
      /* LPC */
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
          return;
 diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_ast2600.c
 +++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
      [ASPEED_DEV_LPC]       = 0x1E789000,
      [ASPEED_DEV_IBT]       = 0x1E789140,
      [ASPEED_DEV_I2C]       = 0x1E78A000,
 +    [ASPEED_DEV_PECI]      = 0x1E78B000,
      [ASPEED_DEV_UART1]     = 0x1E783000,
      [ASPEED_DEV_UART2]     = 0x1E78D000,
      [ASPEED_DEV_UART3]     = 0x1E78E000,
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2600_irqmap[] = {
      [ASPEED_DEV_LPC]       = 35,
      [ASPEED_DEV_IBT]       = 143,
      [ASPEED_DEV_I2C]       = 110,   /* 110 -> 125 */
 +    [ASPEED_DEV_PECI]      = 38,
      [ASPEED_DEV_ETH1]      = 2,
      [ASPEED_DEV_ETH2]      = 3,
      [ASPEED_DEV_HACE]      = 4,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
      snprintf(typename, sizeof(typename), "aspeed.i2c-%s", socname);
      object_initialize_child(obj, "i2c", &s->i2c, typename);
 +    object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
 +
      snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
      object_initialize_child(obj, "fmc", &s->fmc, typename);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c.busses[i]), 0, irq);
      }
 +    /* PECI */
 +    if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
 +        return;
 +    }
 +    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->peci), 0,
 +                    sc->memmap[ASPEED_DEV_PECI]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
 +                       aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
 +
      /* FMC, The number of CS is set at the board level */
      object_property_set_link(OBJECT(&s->fmc), "dram", OBJECT(s->dram_mr),
                               &error_abort);
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2400_memmap[] = {
      [ASPEED_DEV_LPC]    = 0x1E789000,
      [ASPEED_DEV_IBT]    = 0x1E789140,
      [ASPEED_DEV_I2C]    = 0x1E78A000,
 +    [ASPEED_DEV_PECI]   = 0x1E78B000,
      [ASPEED_DEV_ETH1]   = 0x1E660000,
      [ASPEED_DEV_ETH2]   = 0x1E680000,
      [ASPEED_DEV_UART1]  = 0x1E783000,
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2500_memmap[] = {
      [ASPEED_DEV_LPC]    = 0x1E789000,
      [ASPEED_DEV_IBT]    = 0x1E789140,
      [ASPEED_DEV_I2C]    = 0x1E78A000,
 +    [ASPEED_DEV_PECI]   = 0x1E78B000,
      [ASPEED_DEV_ETH1]   = 0x1E660000,
      [ASPEED_DEV_ETH2]   = 0x1E680000,
      [ASPEED_DEV_UART1]  = 0x1E783000,
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2400_irqmap[] = {
      [ASPEED_DEV_PWM]    = 28,
      [ASPEED_DEV_LPC]    = 8,
      [ASPEED_DEV_I2C]    = 12,
 +    [ASPEED_DEV_PECI]   = 15,
      [ASPEED_DEV_ETH1]   = 2,
      [ASPEED_DEV_ETH2]   = 3,
      [ASPEED_DEV_XDMA]   = 6,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      snprintf(typename, sizeof(typename), "aspeed.i2c-%s", socname);
      object_initialize_child(obj, "i2c", &s->i2c, typename);
 +    object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
 +
      snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
      object_initialize_child(obj, "fmc", &s->fmc, typename);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c), 0,
                         aspeed_soc_get_irq(s, ASPEED_DEV_I2C));
 +    /* PECI */
 +    if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
 +        return;
 +    }
 +    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->peci), 0,
 +                    sc->memmap[ASPEED_DEV_PECI]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
 +                       aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
 +
      /* FMC, The number of CS is set at the board level */
      object_property_set_link(OBJECT(&s->fmc), "dram", OBJECT(s->dram_mr),
                               &error_abort);
 diff --git a/hw/misc/aspeed_peci.c b/hw/misc/aspeed_peci.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/aspeed_peci.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Aspeed PECI Controller
 + *
 + * Copyright (c) Meta Platforms, Inc. and affiliates. (http://www.meta.com)
 + *
 + * This code is licensed under the GPL version 2 or later. See the COPYING
 + * file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "hw/irq.h"
 +#include "hw/misc/aspeed_peci.h"
 +#include "hw/registerfields.h"
 +#include "trace.h"
 +
 +#define ASPEED_PECI_CC_RSP_SUCCESS (0x40U)
 +
 +/* Command Register */
 +REG32(PECI_CMD, 0x08)
 +    FIELD(PECI_CMD, FIRE, 0, 1)
 +
 +/* Interrupt Control Register */
 +REG32(PECI_INT_CTRL, 0x18)
 +
 +/* Interrupt Status Register */
 +REG32(PECI_INT_STS, 0x1C)
 +    FIELD(PECI_INT_STS, CMD_DONE, 0, 1)
 +
 +/* Rx/Tx Data Buffer Registers */
 +REG32(PECI_WR_DATA0, 0x20)
 +REG32(PECI_RD_DATA0, 0x30)
 +
 +static void aspeed_peci_raise_interrupt(AspeedPECIState *s, uint32_t status)
 +{
 +    trace_aspeed_peci_raise_interrupt(s->regs[R_PECI_INT_CTRL], status);
 +
 +    s->regs[R_PECI_INT_STS] = s->regs[R_PECI_INT_CTRL] & status;
 +    if (!s->regs[R_PECI_INT_STS]) {
 +        return;
 +    }
 +    qemu_irq_raise(s->irq);
 +}
 +
 +static uint64_t aspeed_peci_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    AspeedPECIState *s = ASPEED_PECI(opaque);
 +    uint64_t data;
 +
 +    if (offset >= ASPEED_PECI_NR_REGS << 2) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +        return 0;
 +    }
 +    data = s->regs[offset >> 2];
 +
 +    trace_aspeed_peci_read(offset, data);
 +    return data;
 +}
 +
 +static void aspeed_peci_write(void *opaque, hwaddr offset, uint64_t data,
 +                              unsigned size)
 +{
 +    AspeedPECIState *s = ASPEED_PECI(opaque);
 +
 +    trace_aspeed_peci_write(offset, data);
 +
 +    if (offset >= ASPEED_PECI_NR_REGS << 2) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +        return;
 +    }
 +
 +    switch (offset) {
 +    case A_PECI_INT_STS:
 +        s->regs[R_PECI_INT_STS] &= ~data;
 +        if (!s->regs[R_PECI_INT_STS]) {
 +            qemu_irq_lower(s->irq);
 +        }
 +        break;
 +    case A_PECI_CMD:
 +        /*
 +         * Only the FIRE bit is writable. Once the command is complete, it
 +         * should be cleared. Since we complete the command immediately, the
 +         * value is not stored in the register array.
 +         */
 +        if (!FIELD_EX32(data, PECI_CMD, FIRE)) {
 +            break;
 +        }
 +        if (s->regs[R_PECI_INT_STS]) {
 +            qemu_log_mask(LOG_GUEST_ERROR, "%s: Interrupt status must be "
 +                          "cleared before firing another command: 0x%08x\n",
 +                          __func__, s->regs[R_PECI_INT_STS]);
 +            break;
 +        }
 +        s->regs[R_PECI_RD_DATA0] = ASPEED_PECI_CC_RSP_SUCCESS;
 +        s->regs[R_PECI_WR_DATA0] = ASPEED_PECI_CC_RSP_SUCCESS;
 +        aspeed_peci_raise_interrupt(s,
 +                                    FIELD_DP32(0, PECI_INT_STS, CMD_DONE, 1));
 +        break;
 +    default:
 +        s->regs[offset / sizeof(s->regs[0])] = data;
 +        break;
 +    }
 +}
 +
 +static const MemoryRegionOps aspeed_peci_ops = {
 +    .read = aspeed_peci_read,
 +    .write = aspeed_peci_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +};
 +
 +static void aspeed_peci_realize(DeviceState *dev, Error **errp)
 +{
 +    AspeedPECIState *s = ASPEED_PECI(dev);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 +
 +    memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_peci_ops, s,
 +                          TYPE_ASPEED_PECI, 0x1000);
 +    sysbus_init_mmio(sbd, &s->mmio);
 +    sysbus_init_irq(sbd, &s->irq);
 +}
 +
 +static void aspeed_peci_reset(DeviceState *dev)
 +{
 +    AspeedPECIState *s = ASPEED_PECI(dev);
 +
 +    memset(s->regs, 0, sizeof(s->regs));
 +}
 +
 +static void aspeed_peci_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = aspeed_peci_realize;
 +    dc->reset = aspeed_peci_reset;
 +    dc->desc = "Aspeed PECI Controller";
 +}
 +
 +static const TypeInfo aspeed_peci_types[] = {
 +    {
 +        .name = TYPE_ASPEED_PECI,
 +        .parent = TYPE_SYS_BUS_DEVICE,
 +        .instance_size = sizeof(AspeedPECIState),
 +        .class_init = aspeed_peci_class_init,
 +        .abstract = false,
 +    },
 +};
 +
 +DEFINE_TYPES(aspeed_peci_types);
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/meson.build
 +++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
    'aspeed_scu.c',
    'aspeed_sbc.c',
    'aspeed_sdmc.c',
 -  'aspeed_xdma.c'))
 +  'aspeed_xdma.c',
 +  'aspeed_peci.c'))
  softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
  softmmu_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_rng.c'))
 diff --git a/hw/misc/trace-events b/hw/misc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ aspeed_i3c_device_write(uint32_t deviceid, uint64_t offset, uint64_t data) "I3C
  aspeed_sdmc_write(uint64_t reg, uint64_t data) "reg @0x%" PRIx64 " data: 0x%" PRIx64
  aspeed_sdmc_read(uint64_t reg, uint64_t data) "reg @0x%" PRIx64 " data: 0x%" PRIx64
 +# aspeed_peci.c
 +aspeed_peci_read(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64
 +aspeed_peci_write(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64
 +aspeed_peci_raise_interrupt(uint32_t ctrl, uint32_t status) "ctrl 0x%" PRIx32 " status 0x%" PRIx32
 +
  # bcm2835_property.c
  bcm2835_mbox_property(uint32_t tag, uint32_t bufsize, size_t resplen) "mbox property tag:0x%08x in_sz:%u out_sz:%zu"
 --
-.35.3
+.49.0

-[PULL 05/27] aspeed/i2c: Change trace event for NORMAL_STOP states
+[PULL 2/3] hw/intc/aspeed: Fix IRQ handler mask check
-Using a 'stop' string seems more appropriate than 'normal'.
+From: Steven Lee <steven_lee@aspeedtech.com>
-Reviewed-by: Peter Delevoryas <pdel@fb.com>
+Updated the IRQ handler mask check to AND with select variable.
-Message-Id: <20220628154740.1117349-3-clg@kaod.org>
+This ensures that the interrupt service routine is correctly triggered
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+for the interrupts within the same irq group.
 For example, both `eth0` and the debug UART are handled in `GICINT132`.
 Without this fix, the debug console may hang if the `eth0` ISR is not
 handled.
 Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
 Change-Id: Ic3609eb72218dfd68be6057d78b8953b18828709
 Reviewed-by: Cédric Le Goater <clg@redhat.com>
 Fixes: d831c5fd8682 ("aspeed/intc: Add AST2700 support")
 Link: https://lore.kernel.org/qemu-devel/20250320092543.4040672-2-steven_lee@aspeedtech.com
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- hw/i2c/aspeed_i2c.c | 2 +-
+ hw/intc/aspeed_intc.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
+diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
+--- a/hw/intc/aspeed_intc.c
-+++ b/hw/i2c/aspeed_i2c.c
++++ b/hw/intc/aspeed_intc.c
-@@ -XXX,XX +XXX,XX @@ static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
+@@ -XXX,XX +XXX,XX @@ static void aspeed_intc_set_irq_handler(AspeedINTCState *s,
-                ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH) ?
+     outpin_idx = intc_irq->outpin_idx;
-                                                "slave-match|" : "",
+     inpin_idx = intc_irq->inpin_idx;
-                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, NORMAL_STOP) ?
--                                               "normal|" : "",
+-    if (s->mask[inpin_idx] || s->regs[status_reg]) {
-+                                               "stop|" : "",
++    if ((s->mask[inpin_idx] & select) || (s->regs[status_reg] & select)) {
-                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, ABNORMAL) ?
+         /*
-                                                "abnormal"  : "");
+          * a. mask is not 0 means in ISR mode
+          * sources interrupt routine are executing.
 --
-.35.3
+.49.0

-[PULL 06/27] aspeed/hace: Accumulative mode supported
+[PULL 3/3] hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
-From: Joel Stanley <joel@jms.id.au>
+From: Jamin Lin <jamin_lin@aspeedtech.com>
-While the HMAC mode is not modelled, the accumulative mode is.
+The maximum padding size is either 64 or 128 bytes and should always be smaller
 than "req_len". If "padding_size" exceeds "req_len", then
 "req_len - padding_size" underflows due to "uint32_t" data type, leading to a
 large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory
 access, potentially leading to a buffer overflow.
-Accumulative mode is enabled by setting one of the bits in the HMAC
+Added a check to ensure "padding_size" does not exceed "req_len" before
-engine command mode part of the register, so fix the unimplemented check
+computing "pad_offset". This prevents "req_len - padding_size" from underflowing
-to only look at the upper of the two bits.
+and avoids accessing invalid memory.
-Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE")
+Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
-Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600 HACE ")
-Message-Id: <20220627100816.125956-1-joel@jms.id.au>
+Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- hw/misc/aspeed_hace.c | 6 +++---
+ hw/misc/aspeed_hace.c | 5 +++++
-file changed, 3 insertions(+), 3 deletions(-)
+file changed, 5 insertions(+)
 diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/aspeed_hace.c
 +++ b/hw/misc/aspeed_hace.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
+@@ -XXX,XX +XXX,XX @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
-         int algo;
+     if (*total_msg_len <= s->total_req_len) {
-         data &= ahc->hash_mask;
+         uint32_t padding_size = s->total_req_len - *total_msg_len;
+         uint8_t *padding = iov->iov_base;
--        if ((data & HASH_HMAC_MASK)) {
++
-+        if ((data & HASH_DIGEST_HMAC)) {
++        if (padding_size > req_len) {
-             qemu_log_mask(LOG_UNIMP,
++            return false;
--                          "%s: HMAC engine command mode %"PRIx64" not implemented\n",
++        }
--                          __func__, (data & HASH_HMAC_MASK) >> 8);
++
-+                          "%s: HMAC mode not implemented\n",
+         *pad_offset = req_len - padding_size;
-+                          __func__);
+         if (padding[*pad_offset] == 0x80) {
-         }
+             return true;
          if (data & BIT(1)) {
              qemu_log_mask(LOG_UNIMP,
 --
-.35.3
+.49.0

-[PULL 07/27] aspeed/smc: Fix potential overflow
+Deleted patch
-Coverity warns that "ssi_transfer(s->spi, 0U) << 8 * i" might overflow
-because the expression is evaluated using 32-bit arithmetic and then
-used in a context expecting a uint64_t.
-Fixes: Coverity CID 1487244
-Message-Id: <20220628165512.1133590-1-clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/ssi/aspeed_smc.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/aspeed_smc.c
-+++ b/hw/ssi/aspeed_smc.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
-     switch (aspeed_smc_flash_mode(fl)) {
-     case CTRL_USERMODE:
-         for (i = 0; i < size; i++) {
--            ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
-+            ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
-         }
-         break;
-     case CTRL_READMODE:
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
-         aspeed_smc_flash_setup(fl, addr);
-         for (i = 0; i < size; i++) {
--            ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
-+            ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
-         }
-         aspeed_smc_flash_unselect(fl);
---
-.35.3

-[PULL 08/27] aspeed: Set CPU memory property explicitly
+Deleted patch
-From: Peter Delevoryas <pdel@fb.com>
-Signed-off-by: Peter Delevoryas <pdel@fb.com>
-Message-Id: <20220624003701.1363500-2-pdel@fb.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/arm/aspeed_ast2600.c | 2 ++
- hw/arm/aspeed_soc.c     | 2 ++
-files changed, 4 insertions(+)
-diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast2600.c
-+++ b/hw/arm/aspeed_ast2600.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-         object_property_set_int(OBJECT(&s->cpu[i]), "cntfrq", 1125000000,
-                                 &error_abort);
-+        object_property_set_link(OBJECT(&s->cpu[i]), "memory",
-+                                 OBJECT(get_system_memory()), &error_abort);
-         if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
-             return;
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
-+++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     /* CPU */
-     for (i = 0; i < sc->num_cpus; i++) {
-+        object_property_set_link(OBJECT(&s->cpu[i]), "memory",
-+                                 OBJECT(get_system_memory()), &error_abort);
-         if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
-             return;
-         }
---
-.35.3

-[PULL 09/27] aspeed: Add memory property to Aspeed SoC
+Deleted patch
-From: Peter Delevoryas <pdel@fb.com>
-Multi-SoC machines can use this property to specify a memory container
-for each SoC. Single SoC machines will just specify get_system_memory().
-Signed-off-by: Peter Delevoryas <pdel@fb.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220624003701.1363500-3-pdel@fb.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- include/hw/arm/aspeed_soc.h |  1 +
- hw/arm/aspeed.c             |  4 ++++
- hw/arm/aspeed_ast10x0.c     |  5 ++---
- hw/arm/aspeed_ast2600.c     |  4 ++--
- hw/arm/aspeed_soc.c         | 12 +++++++-----
-files changed, 16 insertions(+), 10 deletions(-)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
-+++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
-     ARMCPU cpu[ASPEED_CPUS_NUM];
-     A15MPPrivState     a7mpcore;
-     ARMv7MState        armv7m;
-+    MemoryRegion *memory;
-     MemoryRegion *dram_mr;
-     MemoryRegion dram_container;
-     MemoryRegion sram;
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-                             &error_abort);
-     object_property_set_int(OBJECT(&bmc->soc), "hw-strap2", amc->hw_strap2,
-                             &error_abort);
-+    object_property_set_link(OBJECT(&bmc->soc), "memory",
-+                             OBJECT(get_system_memory()), &error_abort);
-     object_property_set_link(OBJECT(&bmc->soc), "dram",
-                              OBJECT(machine->ram), &error_abort);
-     if (machine->kernel_filename) {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_minibmc_machine_init(MachineState *machine)
-     object_initialize_child(OBJECT(machine), "soc", &bmc->soc, amc->soc_name);
-     qdev_connect_clock_in(DEVICE(&bmc->soc), "sysclk", sysclk);
-+    object_property_set_link(OBJECT(&bmc->soc), "memory",
-+                             OBJECT(get_system_memory()), &error_abort);
-     qdev_prop_set_uint32(DEVICE(&bmc->soc), "uart-default",
-                          amc->uart_default);
-     qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
-diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast10x0.c
-+++ b/hw/arm/aspeed_ast10x0.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
- {
-     AspeedSoCState *s = ASPEED_SOC(dev_soc);
-     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
--    MemoryRegion *system_memory = get_system_memory();
-     DeviceState *armv7m;
-     Error *err = NULL;
-     int i;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-     qdev_prop_set_string(armv7m, "cpu-type", sc->cpu_type);
-     qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
-     object_property_set_link(OBJECT(&s->armv7m), "memory",
--                             OBJECT(system_memory), &error_abort);
-+                             OBJECT(s->memory), &error_abort);
-     sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), &error_abort);
-     /* Internal SRAM */
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-         error_propagate(errp, err);
-         return;
-     }
--    memory_region_add_subregion(system_memory,
-+    memory_region_add_subregion(s->memory,
-                                 sc->memmap[ASPEED_DEV_SRAM],
-                                 &s->sram);
-diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast2600.c
-+++ b/hw/arm/aspeed_ast2600.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-         object_property_set_int(OBJECT(&s->cpu[i]), "cntfrq", 1125000000,
-                                 &error_abort);
-         object_property_set_link(OBJECT(&s->cpu[i]), "memory",
--                                 OBJECT(get_system_memory()), &error_abort);
-+                                 OBJECT(s->memory), &error_abort);
-         if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
-             return;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-         error_propagate(errp, err);
-         return;
-     }
--    memory_region_add_subregion(get_system_memory(),
-+    memory_region_add_subregion(s->memory,
-                                 sc->memmap[ASPEED_DEV_SRAM], &s->sram);
-     /* DPMCU */
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
-+++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     /* CPU */
-     for (i = 0; i < sc->num_cpus; i++) {
-         object_property_set_link(OBJECT(&s->cpu[i]), "memory",
--                                 OBJECT(get_system_memory()), &error_abort);
-+                                 OBJECT(s->memory), &error_abort);
-         if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
-             return;
-         }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-         error_propagate(errp, err);
-         return;
-     }
--    memory_region_add_subregion(get_system_memory(),
-+    memory_region_add_subregion(s->memory,
-                                 sc->memmap[ASPEED_DEV_SRAM], &s->sram);
-     /* SCU */
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
- }
- static Property aspeed_soc_properties[] = {
-+    DEFINE_PROP_LINK("memory", AspeedSoCState, memory, TYPE_MEMORY_REGION,
-+                     MemoryRegion *),
-     DEFINE_PROP_LINK("dram", AspeedSoCState, dram_mr, TYPE_MEMORY_REGION,
-                      MemoryRegion *),
-     DEFINE_PROP_UINT32("uart-default", AspeedSoCState, uart_default,
-@@ -XXX,XX +XXX,XX @@ void aspeed_soc_uart_init(AspeedSoCState *s)
-     int i, uart;
-     /* Attach an 8250 to the IO space as our UART */
--    serial_mm_init(get_system_memory(), sc->memmap[s->uart_default], 2,
-+    serial_mm_init(s->memory, sc->memmap[s->uart_default], 2,
-                    aspeed_soc_get_irq(s, s->uart_default), 38400,
-                    serial_hd(0), DEVICE_LITTLE_ENDIAN);
-     for (i = 1, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
-         if (uart == s->uart_default) {
-             uart++;
-         }
--        serial_mm_init(get_system_memory(), sc->memmap[uart], 2,
-+        serial_mm_init(s->memory, sc->memmap[uart], 2,
-                        aspeed_soc_get_irq(s, uart), 38400,
-                        serial_hd(i), DEVICE_LITTLE_ENDIAN);
-     }
-@@ -XXX,XX +XXX,XX @@ bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp)
-                       sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0), -1000);
-     }
--    memory_region_add_subregion(get_system_memory(),
-+    memory_region_add_subregion(s->memory,
-                       sc->memmap[ASPEED_DEV_SDRAM], &s->dram_container);
-     return true;
- }
---
-.35.3

-[PULL 10/27] aspeed: Remove usage of sysbus_mmio_map
+Deleted patch
-From: Peter Delevoryas <pdel@fb.com>
-sysbus_mmio_map maps devices into "get_system_memory()".
-With the new SoC memory attribute, we want to make sure that each device is
-mapped into the SoC memory.
-In single SoC machines, the SoC memory is the same as "get_system_memory()",
-but in multi SoC machines it will be different.
-Signed-off-by: Peter Delevoryas <pdel@fb.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220624003701.1363500-4-pdel@fb.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- include/hw/arm/aspeed_soc.h |  1 +
- hw/arm/aspeed_ast10x0.c     | 25 +++++++++---------
- hw/arm/aspeed_ast2600.c     | 51 ++++++++++++++++++++-----------------
- hw/arm/aspeed_soc.c         | 47 ++++++++++++++++++++--------------
-files changed, 69 insertions(+), 55 deletions(-)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
-+++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@ enum {
- qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
- void aspeed_soc_uart_init(AspeedSoCState *s);
- bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
-+void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr);
- #endif /* ASPEED_SOC_H */
-diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast10x0.c
-+++ b/hw/arm/aspeed_ast10x0.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
-     /* I2C */
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i2c), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
-     for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
-         qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->armv7m),
-                                         sc->irqmap[ASPEED_DEV_I2C] + i);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
-     /* Connect the LPC IRQ to the GIC. It is otherwise unused. */
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->timerctrl), 0,
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->timerctrl), 0,
-                     sc->memmap[ASPEED_DEV_TIMER1]);
-     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
-         qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->adc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 1,
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 1,
-                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
-             return;
-         }
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 0,
-                         sc->memmap[ASPEED_DEV_SPI1 + i]);
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 1,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 1,
-                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
-     }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sbc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sbc), 0, sc->memmap[ASPEED_DEV_SBC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sbc), 0, sc->memmap[ASPEED_DEV_SBC]);
-     /* Watch dog */
-     for (i = 0; i < sc->wdts_num; i++) {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-         if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
-             return;
-         }
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->wdt[i]), 0,
-                         sc->memmap[ASPEED_DEV_WDT] + i * awc->offset);
-     }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_DEV_GPIO]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio), 0,
-+                    sc->memmap[ASPEED_DEV_GPIO]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
- }
-diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast2600.c
-+++ b/hw/arm/aspeed_ast2600.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-                             &error_abort);
-     sysbus_realize(SYS_BUS_DEVICE(&s->a7mpcore), &error_abort);
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->a7mpcore), 0, ASPEED_A7MPCORE_ADDR);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->a7mpcore), 0, ASPEED_A7MPCORE_ADDR);
-     for (i = 0; i < sc->num_cpus; i++) {
-         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->a7mpcore);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
-     /* RTC */
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->rtc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_DEV_RTC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_DEV_RTC]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_RTC));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->timerctrl), 0,
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->timerctrl), 0,
-                     sc->memmap[ASPEED_DEV_TIMER1]);
-     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
-         qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->adc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i2c), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
-     for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
-         qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                         sc->irqmap[ASPEED_DEV_I2C] + i);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 1,
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 1,
-                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
-             return;
-         }
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 0,
-                         sc->memmap[ASPEED_DEV_SPI1 + i]);
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 1,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 1,
-                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
-     }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
-             return;
-         }
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->ehci[i]), 0,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ehci[i]), 0,
-                         sc->memmap[ASPEED_DEV_EHCI1 + i]);
-         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
-                            aspeed_soc_get_irq(s, ASPEED_DEV_EHCI1 + i));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, sc->memmap[ASPEED_DEV_SDMC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdmc), 0,
-+                    sc->memmap[ASPEED_DEV_SDMC]);
-     /* Watch dog */
-     for (i = 0; i < sc->wdts_num; i++) {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-         if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
-             return;
-         }
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->wdt[i]), 0,
-                         sc->memmap[ASPEED_DEV_WDT] + i * awc->offset);
-     }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ftgmac100[i]), errp)) {
-             return;
-         }
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
-                         sc->memmap[ASPEED_DEV_ETH1 + i]);
-         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
-                            aspeed_soc_get_irq(s, ASPEED_DEV_ETH1 + i));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-             return;
-         }
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->mii[i]), 0,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->mii[i]), 0,
-                         sc->memmap[ASPEED_DEV_MII1 + i]);
-     }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->xdma), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->xdma), 0,
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->xdma), 0,
-                     sc->memmap[ASPEED_DEV_XDMA]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_XDMA));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_DEV_GPIO]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_DEV_GPIO]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio_1_8v), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
-                     sc->memmap[ASPEED_DEV_GPIO_1_8V]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO_1_8V));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdhci), 0,
-                     sc->memmap[ASPEED_DEV_SDHCI]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_SDHCI));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->emmc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->emmc), 0, sc->memmap[ASPEED_DEV_EMMC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->emmc), 0,
-+                    sc->memmap[ASPEED_DEV_EMMC]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->emmc), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_EMMC));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
-     /* Connect the LPC IRQ to the GIC. It is otherwise unused. */
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->hace), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->hace), 0, sc->memmap[ASPEED_DEV_HACE]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->hace), 0,
-+                    sc->memmap[ASPEED_DEV_HACE]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i3c), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i3c), 0, sc->memmap[ASPEED_DEV_I3C]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i3c), 0, sc->memmap[ASPEED_DEV_I3C]);
-     for (i = 0; i < ASPEED_I3C_NR_DEVICES; i++) {
-         qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore),
-                                         sc->irqmap[ASPEED_DEV_I3C] + i);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sbc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sbc), 0, sc->memmap[ASPEED_DEV_SBC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sbc), 0, sc->memmap[ASPEED_DEV_SBC]);
- }
- static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
-+++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
-     /* VIC */
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->vic), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->vic), 0, sc->memmap[ASPEED_DEV_VIC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->vic), 0, sc->memmap[ASPEED_DEV_VIC]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->vic), 0,
-                        qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ));
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->vic), 1,
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->rtc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_DEV_RTC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_DEV_RTC]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_RTC));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->timerctrl), 0,
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->timerctrl), 0,
-                     sc->memmap[ASPEED_DEV_TIMER1]);
-     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
-         qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->adc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i2c), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_I2C));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 1,
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 1,
-                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
-             return;
-         }
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 0,
-                         sc->memmap[ASPEED_DEV_SPI1 + i]);
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 1,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 1,
-                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
-     }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
-             return;
-         }
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->ehci[i]), 0,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ehci[i]), 0,
-                         sc->memmap[ASPEED_DEV_EHCI1 + i]);
-         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
-                            aspeed_soc_get_irq(s, ASPEED_DEV_EHCI1 + i));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, sc->memmap[ASPEED_DEV_SDMC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdmc), 0,
-+                    sc->memmap[ASPEED_DEV_SDMC]);
-     /* Watch dog */
-     for (i = 0; i < sc->wdts_num; i++) {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-         if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
-             return;
-         }
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->wdt[i]), 0,
-                         sc->memmap[ASPEED_DEV_WDT] + i * awc->offset);
-     }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ftgmac100[i]), errp)) {
-             return;
-         }
--        sysbus_mmio_map(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
-+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
-                         sc->memmap[ASPEED_DEV_ETH1 + i]);
-         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
-                            aspeed_soc_get_irq(s, ASPEED_DEV_ETH1 + i));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->xdma), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->xdma), 0,
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->xdma), 0,
-                     sc->memmap[ASPEED_DEV_XDMA]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_XDMA));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_DEV_GPIO]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio), 0,
-+                    sc->memmap[ASPEED_DEV_GPIO]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdhci), 0,
-                     sc->memmap[ASPEED_DEV_SDHCI]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_SDHCI));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
-     /* Connect the LPC IRQ to the VIC */
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->hace), errp)) {
-         return;
-     }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->hace), 0, sc->memmap[ASPEED_DEV_HACE]);
-+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->hace), 0,
-+                    sc->memmap[ASPEED_DEV_HACE]);
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
-                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
- }
-@@ -XXX,XX +XXX,XX @@ bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp)
-                       sc->memmap[ASPEED_DEV_SDRAM], &s->dram_container);
-     return true;
- }
-+
-+void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr)
-+{
-+    memory_region_add_subregion(s->memory, addr,
-+                                sysbus_mmio_get_region(dev, n));
-+}
---
-.35.3

-[PULL 11/27] aspeed: Map unimplemented devices in SoC memory
+Deleted patch
-From: Peter Delevoryas <pdel@fb.com>
-Signed-off-by: Peter Delevoryas <pdel@fb.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220624003701.1363500-5-pdel@fb.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- include/hw/arm/aspeed_soc.h |  9 +++++++++
- hw/arm/aspeed_ast10x0.c     | 16 ++++++++++------
- hw/arm/aspeed_ast2600.c     | 27 ++++++++++++++++++---------
- hw/arm/aspeed_soc.c         | 23 +++++++++++++++++++----
-files changed, 56 insertions(+), 19 deletions(-)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
-+++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/usb/hcd-ehci.h"
- #include "qom/object.h"
- #include "hw/misc/aspeed_lpc.h"
-+#include "hw/misc/unimp.h"
- #define ASPEED_SPIS_NUM  2
- #define ASPEED_EHCIS_NUM 2
-@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
-     AspeedSMCState spi[ASPEED_SPIS_NUM];
-     EHCISysBusState ehci[ASPEED_EHCIS_NUM];
-     AspeedSBCState sbc;
-+    UnimplementedDeviceState sbc_unimplemented;
-     AspeedSDMCState sdmc;
-     AspeedWDTState wdt[ASPEED_WDTS_NUM];
-     FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
-@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
-     AspeedLPCState lpc;
-     uint32_t uart_default;
-     Clock *sysclk;
-+    UnimplementedDeviceState iomem;
-+    UnimplementedDeviceState video;
-+    UnimplementedDeviceState emmc_boot_controller;
-+    UnimplementedDeviceState dpmcu;
- };
- #define TYPE_ASPEED_SOC "aspeed-soc"
-@@ -XXX,XX +XXX,XX @@ qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
- void aspeed_soc_uart_init(AspeedSoCState *s);
- bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
- void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr);
-+void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
-+                                   const char *name, hwaddr addr,
-+                                   uint64_t size);
- #endif /* ASPEED_SOC_H */
-diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast10x0.c
-+++ b/hw/arm/aspeed_ast10x0.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_init(Object *obj)
-     snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
-     object_initialize_child(obj, "gpio", &s->gpio, typename);
-+
-+    object_initialize_child(obj, "iomem", &s->iomem, TYPE_UNIMPLEMENTED_DEVICE);
-+    object_initialize_child(obj, "sbc-unimplemented", &s->sbc_unimplemented,
-+                            TYPE_UNIMPLEMENTED_DEVICE);
- }
- static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
-     }
-     /* General I/O memory space to catch all unimplemented device */
--    create_unimplemented_device("aspeed.sbc",
--                                sc->memmap[ASPEED_DEV_SBC],
--                                0x40000);
--    create_unimplemented_device("aspeed.io",
--                                sc->memmap[ASPEED_DEV_IOMEM],
--                                ASPEED_SOC_IOMEM_SIZE);
-+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
-+                                  sc->memmap[ASPEED_DEV_IOMEM],
-+                                  ASPEED_SOC_IOMEM_SIZE);
-+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->sbc_unimplemented),
-+                                  "aspeed.sbc", sc->memmap[ASPEED_DEV_SBC],
-+                                  0x40000);
-     /* AST1030 CPU Core */
-     armv7m = DEVICE(&s->armv7m);
-diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast2600.c
-+++ b/hw/arm/aspeed_ast2600.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
-     object_initialize_child(obj, "i3c", &s->i3c, TYPE_ASPEED_I3C);
-     object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_SBC);
-+
-+    object_initialize_child(obj, "iomem", &s->iomem, TYPE_UNIMPLEMENTED_DEVICE);
-+    object_initialize_child(obj, "video", &s->video, TYPE_UNIMPLEMENTED_DEVICE);
-+    object_initialize_child(obj, "dpmcu", &s->dpmcu, TYPE_UNIMPLEMENTED_DEVICE);
-+    object_initialize_child(obj, "emmc-boot-controller",
-+                            &s->emmc_boot_controller,
-+                            TYPE_UNIMPLEMENTED_DEVICE);
- }
- /*
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     qemu_irq irq;
-     /* IO space */
--    create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_DEV_IOMEM],
--                                ASPEED_SOC_IOMEM_SIZE);
-+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
-+                                  sc->memmap[ASPEED_DEV_IOMEM],
-+                                  ASPEED_SOC_IOMEM_SIZE);
-     /* Video engine stub */
--    create_unimplemented_device("aspeed.video", sc->memmap[ASPEED_DEV_VIDEO],
--                                0x1000);
-+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->video), "aspeed.video",
-+                                  sc->memmap[ASPEED_DEV_VIDEO], 0x1000);
-     /* eMMC Boot Controller stub */
--    create_unimplemented_device("aspeed.emmc-boot-controller",
--                                sc->memmap[ASPEED_DEV_EMMC_BC],
--                                0x1000);
-+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->emmc_boot_controller),
-+                                  "aspeed.emmc-boot-controller",
-+                                  sc->memmap[ASPEED_DEV_EMMC_BC], 0x1000);
-     /* CPU */
-     for (i = 0; i < sc->num_cpus; i++) {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-                                 sc->memmap[ASPEED_DEV_SRAM], &s->sram);
-     /* DPMCU */
--    create_unimplemented_device("aspeed.dpmcu", sc->memmap[ASPEED_DEV_DPMCU],
--                                ASPEED_SOC_DPMCU_SIZE);
-+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->dpmcu), "aspeed.dpmcu",
-+                                  sc->memmap[ASPEED_DEV_DPMCU],
-+                                  ASPEED_SOC_DPMCU_SIZE);
-     /* SCU */
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
-+++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
-     snprintf(typename, sizeof(typename), "aspeed.hace-%s", socname);
-     object_initialize_child(obj, "hace", &s->hace, typename);
-+
-+    object_initialize_child(obj, "iomem", &s->iomem, TYPE_UNIMPLEMENTED_DEVICE);
-+    object_initialize_child(obj, "video", &s->video, TYPE_UNIMPLEMENTED_DEVICE);
- }
- static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
-     Error *err = NULL;
-     /* IO space */
--    create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_DEV_IOMEM],
--                                ASPEED_SOC_IOMEM_SIZE);
-+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
-+                                  sc->memmap[ASPEED_DEV_IOMEM],
-+                                  ASPEED_SOC_IOMEM_SIZE);
-     /* Video engine stub */
--    create_unimplemented_device("aspeed.video", sc->memmap[ASPEED_DEV_VIDEO],
--                                0x1000);
-+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->video), "aspeed.video",
-+                                  sc->memmap[ASPEED_DEV_VIDEO], 0x1000);
-     /* CPU */
-     for (i = 0; i < sc->num_cpus; i++) {
-@@ -XXX,XX +XXX,XX @@ void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr)
-     memory_region_add_subregion(s->memory, addr,
-                                 sysbus_mmio_get_region(dev, n));
- }
-+
-+void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
-+                                   const char *name, hwaddr addr, uint64_t size)
-+{
-+    qdev_prop_set_string(DEVICE(dev), "name", name);
-+    qdev_prop_set_uint64(DEVICE(dev), "size", size);
-+    sysbus_realize(dev, &error_abort);
-+
-+    memory_region_add_subregion_overlap(s->memory, addr,
-+                                        sysbus_mmio_get_region(dev, 0), -1000);
-+}
---
-.35.3

-[PULL 12/27] aspeed: Remove use of qemu_get_cpu
+Deleted patch
-From: Peter Delevoryas <pdel@fb.com>
-Signed-off-by: Peter Delevoryas <pdel@fb.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220624003701.1363500-6-pdel@fb.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/arm/aspeed_ast2600.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast2600.c
-+++ b/hw/arm/aspeed_ast2600.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     for (i = 0; i < sc->num_cpus; i++) {
-         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->a7mpcore);
--        DeviceState  *d   = DEVICE(qemu_get_cpu(i));
-+        DeviceState  *d   = DEVICE(&s->cpu[i]);
-         irq = qdev_get_gpio_in(d, ARM_CPU_IRQ);
-         sysbus_connect_irq(sbd, i, irq);
---
-.35.3

-[PULL 13/27] hw/arm/aspeed: add support for the Qualcomm DC-SCM v1 board
+Deleted patch
-From: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
-Add qcom-dc-scm-v1 board support.
-Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220627154703.148943-2-quic_jaehyoo@quicinc.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/arm/aspeed.c | 35 +++++++++++++++++++++++++++++++++++
-file changed, 35 insertions(+)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ struct AspeedMachineState {
- #define BLETCHLEY_BMC_HW_STRAP1 AST2600_EVB_HW_STRAP1
- #define BLETCHLEY_BMC_HW_STRAP2 AST2600_EVB_HW_STRAP2
-+/* Qualcomm DC-SCM hardware value */
-+#define QCOM_DC_SCM_V1_BMC_HW_STRAP1  0x00000000
-+#define QCOM_DC_SCM_V1_BMC_HW_STRAP2  0x00000041
-+
- #define AST_SMP_MAILBOX_BASE            0x1e6e2180
- #define AST_SMP_MBOX_FIELD_ENTRY        (AST_SMP_MAILBOX_BASE + 0x0)
- #define AST_SMP_MBOX_FIELD_GOSIGN       (AST_SMP_MAILBOX_BASE + 0x4)
-@@ -XXX,XX +XXX,XX @@ static void fby35_i2c_init(AspeedMachineState *bmc)
-      */
- }
-+static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
-+{
-+    AspeedSoCState *soc = &bmc->soc;
-+
-+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
-+}
-+
- static bool aspeed_get_mmio_exec(Object *obj, Error **errp)
- {
-     return ASPEED_MACHINE(obj)->mmio_exec;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_minibmc_machine_ast1030_evb_class_init(ObjectClass *oc,
-     amc->macs_mask = 0;
- }
-+static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
-+                                                     void *data)
-+{
-+    MachineClass *mc = MACHINE_CLASS(oc);
-+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-+
-+    mc->desc       = "Qualcomm DC-SCM V1 BMC (Cortex A7)";
-+    amc->soc_name  = "ast2600-a3";
-+    amc->hw_strap1 = QCOM_DC_SCM_V1_BMC_HW_STRAP1;
-+    amc->hw_strap2 = QCOM_DC_SCM_V1_BMC_HW_STRAP2;
-+    amc->fmc_model = "n25q512a";
-+    amc->spi_model = "n25q512a";
-+    amc->num_cs    = 2;
-+    amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
-+    amc->i2c_init  = qcom_dc_scm_bmc_i2c_init;
-+    mc->default_ram_size = 1 * GiB;
-+    mc->default_cpus = mc->min_cpus = mc->max_cpus =
-+        aspeed_soc_num_cpus(amc->soc_name);
-+};
-+
- static const TypeInfo aspeed_machine_types[] = {
-     {
-         .name          = MACHINE_TYPE_NAME("palmetto-bmc"),
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
-         .name          = MACHINE_TYPE_NAME("g220a-bmc"),
-         .parent        = TYPE_ASPEED_MACHINE,
-         .class_init    = aspeed_machine_g220a_class_init,
-+    }, {
-+        .name          = MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"),
-+        .parent        = TYPE_ASPEED_MACHINE,
-+        .class_init    = aspeed_machine_qcom_dc_scm_v1_class_init,
-     }, {
-         .name          = MACHINE_TYPE_NAME("fp5280g2-bmc"),
-         .parent        = TYPE_ASPEED_MACHINE,
---
-.35.3

-[PULL 14/27] hw/arm/aspeed: add Qualcomm Firework BMC machine
+Deleted patch
-From: Graeme Gregory <quic_ggregory@quicinc.com>
-Add base for Qualcomm Firework BMC machine.
-Signed-off-by: Graeme Gregory <quic_ggregory@quicinc.com>
-Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220627154703.148943-3-quic_jaehyoo@quicinc.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/arm/aspeed.c | 34 ++++++++++++++++++++++++++++++++++
-file changed, 34 insertions(+)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
-     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
- }
-+static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
-+{
-+    AspeedSoCState *soc = &bmc->soc;
-+
-+    /* Create the generic DC-SCM hardware */
-+    qcom_dc_scm_bmc_i2c_init(bmc);
-+
-+    /* Now create the Firework specific hardware */
-+}
-+
- static bool aspeed_get_mmio_exec(Object *obj, Error **errp)
- {
-     return ASPEED_MACHINE(obj)->mmio_exec;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
-         aspeed_soc_num_cpus(amc->soc_name);
- };
-+static void aspeed_machine_qcom_firework_class_init(ObjectClass *oc,
-+                                                    void *data)
-+{
-+    MachineClass *mc = MACHINE_CLASS(oc);
-+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-+
-+    mc->desc       = "Qualcomm DC-SCM V1/Firework BMC (Cortex A7)";
-+    amc->soc_name  = "ast2600-a3";
-+    amc->hw_strap1 = QCOM_DC_SCM_V1_BMC_HW_STRAP1;
-+    amc->hw_strap2 = QCOM_DC_SCM_V1_BMC_HW_STRAP2;
-+    amc->fmc_model = "n25q512a";
-+    amc->spi_model = "n25q512a";
-+    amc->num_cs    = 2;
-+    amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
-+    amc->i2c_init  = qcom_dc_scm_firework_i2c_init;
-+    mc->default_ram_size = 1 * GiB;
-+    mc->default_cpus = mc->min_cpus = mc->max_cpus =
-+        aspeed_soc_num_cpus(amc->soc_name);
-+};
-+
- static const TypeInfo aspeed_machine_types[] = {
-     {
-         .name          = MACHINE_TYPE_NAME("palmetto-bmc"),
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
-         .name          = MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"),
-         .parent        = TYPE_ASPEED_MACHINE,
-         .class_init    = aspeed_machine_qcom_dc_scm_v1_class_init,
-+    }, {
-+        .name          = MACHINE_TYPE_NAME("qcom-firework-bmc"),
-+        .parent        = TYPE_ASPEED_MACHINE,
-+        .class_init    = aspeed_machine_qcom_firework_class_init,
-     }, {
-         .name          = MACHINE_TYPE_NAME("fp5280g2-bmc"),
-         .parent        = TYPE_ASPEED_MACHINE,
---
-.35.3

-[PULL 15/27] hw/i2c: pmbus: Page #255 is valid page for read requests.
+Deleted patch
-From: Maheswara Kurapati <quic_mkurapat@quicinc.com>
-Current implementation of the pmbus core driver treats the read request
-for page 255 as invalid request and sets the invalid command bit (bit 7)
-in the STATUS_CML register. As per the PMBus specification it is a valid
-request.
-Refer to the PMBus specification, revision 1.3.1, section 11.10 PAGE,
-on the page 58:
-  "Setting the PAGE to FFh means that all subsequent comands are to be
-   applied to all outputs.
-   Some commands, such as READ_TEMPERATURE, may use a common sensor but
-   be available on all pages of a device. Such implementations are the
-   decision of each device manufacturer or are specified in a PMBus
-   Application Profile. Consult the manufacturer's documents or the
-   Application Profile Specification as needed."
-For e.g.,
-The VOUT_MODE is a valid command for page 255 for maxim 31785 device.
-refer to Table 1. PMBus Command Codes on page 14 in the datasheet.
-https://datasheets.maximintegrated.com/en/ds/MAX31785.pdf
-Fixes: 38870253f1d1 ("hw/i2c: pmbus: fix error returns and guard against out of range accesses")
-Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com>
-Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
-Reviewed-by: Titus Rwantare <titusr@google.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220627154703.148943-4-quic_jaehyoo@quicinc.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/i2c/pmbus_device.c | 6 +-----
-file changed, 1 insertion(+), 5 deletions(-)
-diff --git a/hw/i2c/pmbus_device.c b/hw/i2c/pmbus_device.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/pmbus_device.c
-+++ b/hw/i2c/pmbus_device.c
-@@ -XXX,XX +XXX,XX @@ static uint8_t pmbus_receive_byte(SMBusDevice *smd)
-     /*
-      * Reading from all pages will return the value from page 0,
--     * this is unspecified behaviour in general.
-+     * means that all subsequent commands are to be applied to all output.
-      */
-     if (pmdev->page == PB_ALL_PAGES) {
-         index = 0;
--        qemu_log_mask(LOG_GUEST_ERROR,
--                      "%s: tried to read from all pages\n",
--                      __func__);
--        pmbus_cml_error(pmdev);
-     } else if (pmdev->page > pmdev->num_pages - 1) {
-         qemu_log_mask(LOG_GUEST_ERROR,
-                       "%s: page %d is out of range\n",
---
-.35.3

-[PULL 16/27] hw/sensor: add Maxim MAX31785 device
+Deleted patch
-From: Maheswara Kurapati <quic_mkurapat@quicinc.com>
-MAX31785 is a PMBus compliant 6-Channel fan controller. It supports 6 fan
-channels, 11 temperature sensors, and 6-Channel ADC to measure the remote
-voltages. Datasheet can be found here:
-https://datasheets.maximintegrated.com/en/ds/MAX31785.pdf
-This initial version of the driver has skeleton and support for the
-fan channels. Requests for temperature sensors, and ADC Channels the
-are serviced with the default values as per the datasheet.  No additional
-instrumentation is done. NV Log feature is not supported.
-Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com>
-Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
-Reviewed-by: Joel Stanley <joel@jms.id.au>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220627154703.148943-5-quic_jaehyoo@quicinc.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/sensor/max31785.c  | 573 ++++++++++++++++++++++++++++++++++++++++++
- hw/sensor/Kconfig     |   4 +
- hw/sensor/meson.build |   1 +
-files changed, 578 insertions(+)
- create mode 100644 hw/sensor/max31785.c
-diff --git a/hw/sensor/max31785.c b/hw/sensor/max31785.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/sensor/max31785.c
-@@ -XXX,XX +XXX,XX @@
-+// SPDX-License-Identifier: GPL-2.0-or-later
-+/*
-+ * Maxim MAX31785 PMBus 6-Channel Fan Controller
-+ *
-+ * Datasheet:
-+ * https://datasheets.maximintegrated.com/en/ds/MAX31785.pdf
-+ *
-+ * Copyright(c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "hw/i2c/pmbus_device.h"
-+#include "hw/irq.h"
-+#include "migration/vmstate.h"
-+#include "qapi/error.h"
-+#include "qapi/visitor.h"
-+#include "qemu/log.h"
-+#include "qemu/module.h"
-+
-+#define TYPE_MAX31785 "max31785"
-+#define MAX31785(obj) OBJECT_CHECK(MAX31785State, (obj), TYPE_MAX31785)
-+
-+/* MAX31785 mfr specific PMBus commands */
-+#define MAX31785_MFR_MODE               0xD1
-+#define MAX31785_MFR_PSEN_CONFIG        0xD2
-+#define MAX31785_MFR_VOUT_PEAK          0xD4
-+#define MAX31785_MFR_TEMPERATURE_PEAK   0xD6
-+#define MAX31785_MFR_VOUT_MIN           0xD7
-+#define MAX31785_MFR_FAULT_RESPONSE     0xD9
-+#define MAX31785_MFR_NV_FAULT_LOG       0xDC
-+#define MAX31785_MFR_TIME_COUNT         0xDD
-+#define MAX31785_MFR_TEMP_SENSOR_CONFIG 0xF0
-+#define MAX31785_MFR_FAN_CONFIG         0xF1
-+#define MAX31785_MFR_FAN_LUT            0xF2
-+#define MAX31785_MFR_READ_FAN_PWM       0xF3
-+#define MAX31785_MFR_FAN_FAULT_LIMIT    0xF5
-+#define MAX31785_MFR_FAN_WARN_LIMIT     0xF6
-+#define MAX31785_MFR_FAN_RUN_TIME       0xF7
-+#define MAX31785_MFR_FAN_PWM_AVG        0xF8
-+#define MAX31785_MFR_FAN_PWM2RPM        0xF9
-+
-+/* defaults as per the data sheet */
-+#define MAX31785_DEFAULT_CAPABILITY            0x10
-+#define MAX31785_DEFAULT_VOUT_MODE             0x40
-+#define MAX31785_DEFAULT_VOUT_SCALE_MONITOR    0x7FFF
-+#define MAX31785_DEFAULT_FAN_COMMAND_1         0x7FFF
-+#define MAX31785_DEFAULT_OV_FAULT_LIMIT        0x7FFF
-+#define MAX31785_DEFAULT_OV_WARN_LIMIT         0x7FFF
-+#define MAX31785_DEFAULT_OT_FAULT_LIMIT        0x7FFF
-+#define MAX31785_DEFAULT_OT_WARN_LIMIT         0x7FFF
-+#define MAX31785_DEFAULT_PMBUS_REVISION        0x11
-+#define MAX31785_DEFAULT_MFR_ID                0x4D
-+#define MAX31785_DEFAULT_MFR_MODEL             0x53
-+#define MAX31785_DEFAULT_MFR_REVISION          0x3030
-+#define MAX31785A_DEFAULT_MFR_REVISION         0x3040
-+#define MAX31785B_DEFAULT_MFR_REVISION         0x3061
-+#define MAX31785B_DEFAULT_MFR_TEMPERATURE_PEAK 0x8000
-+#define MAX31785B_DEFAULT_MFR_VOUT_MIN         0x7FFF
-+#define MAX31785_DEFAULT_TEXT                  0x3130313031303130
-+
-+/* MAX31785 pages */
-+#define MAX31785_TOTAL_NUM_PAGES      23
-+#define MAX31785_FAN_PAGES            6
-+#define MAX31785_MIN_FAN_PAGE         0
-+#define MAX31785_MAX_FAN_PAGE         5
-+#define MAX31785_MIN_TEMP_PAGE        6
-+#define MAX31785_MAX_TEMP_PAGE        16
-+#define MAX31785_MIN_ADC_VOLTAGE_PAGE 17
-+#define MAX31785_MAX_ADC_VOLTAGE_PAGE 22
-+
-+/* FAN_CONFIG_1_2 */
-+#define MAX31785_MFR_FAN_CONFIG                0xF1
-+#define MAX31785_FAN_CONFIG_ENABLE             BIT(7)
-+#define MAX31785_FAN_CONFIG_RPM_PWM            BIT(6)
-+#define MAX31785_FAN_CONFIG_PULSE(pulse)       (pulse << 4)
-+#define MAX31785_DEFAULT_FAN_CONFIG_1_2(pulse)                                 \
-+    (MAX31785_FAN_CONFIG_ENABLE | MAX31785_FAN_CONFIG_PULSE(pulse))
-+#define MAX31785_DEFAULT_MFR_FAN_CONFIG        0x0000
-+
-+/* fan speed in RPM */
-+#define MAX31785_DEFAULT_FAN_SPEED   0x7fff
-+#define MAX31785_DEFAULT_FAN_STATUS  0x00
-+
-+#define MAX31785_DEFAULT_FAN_MAX_PWM 0x2710
-+
-+/*
-+ * MAX31785State:
-+ * @code: The command code received
-+ * @page: Each page corresponds to a device monitored by the Max 31785
-+ * The page register determines the available commands depending on device
-+ * _____________________________________________________________________________
-+ * |   0   |  Fan Connected to PWM0                                            |
-+ * |_______|___________________________________________________________________|
-+ * |   1   |  Fan Connected to PWM1                                            |
-+ * |_______|___________________________________________________________________|
-+ * |   2   |  Fan Connected to PWM2                                            |
-+ * |_______|___________________________________________________________________|
-+ * |   3   |  Fan Connected to PWM3                                            |
-+ * |_______|___________________________________________________________________|
-+ * |   4   |  Fan Connected to PWM4                                            |
-+ * |_______|___________________________________________________________________|
-+ * |   5   |  Fan Connected to PWM5                                            |
-+ * |_______|___________________________________________________________________|
-+ * |   6   |  Remote Thermal Diode Connected to ADC 0                          |
-+ * |_______|___________________________________________________________________|
-+ * |   7   |  Remote Thermal Diode Connected to ADC 1                          |
-+ * |_______|___________________________________________________________________|
-+ * |   8   |  Remote Thermal Diode Connected to ADC 2                          |
-+ * |_______|___________________________________________________________________|
-+ * |   9   |  Remote Thermal Diode Connected to ADC 3                          |
-+ * |_______|___________________________________________________________________|
-+ * |  10   |  Remote Thermal Diode Connected to ADC 4                          |
-+ * |_______|___________________________________________________________________|
-+ * |  11   |  Remote Thermal Diode Connected to ADC 5                          |
-+ * |_______|___________________________________________________________________|
-+ * |  12   |  Internal Temperature Sensor                                      |
-+ * |_______|___________________________________________________________________|
-+ * |  13   |  Remote I2C Temperature Sensor with Address 0                     |
-+ * |_______|___________________________________________________________________|
-+ * |  14   |  Remote I2C Temperature Sensor with Address 1                     |
-+ * |_______|___________________________________________________________________|
-+ * |  15   |  Remote I2C Temperature Sensor with Address 2                     |
-+ * |_______|___________________________________________________________________|
-+ * |  16   |  Remote I2C Temperature Sensor with Address 3                     |
-+ * |_______|___________________________________________________________________|
-+ * |  17   |  Remote I2C Temperature Sensor with Address 4                     |
-+ * |_______|___________________________________________________________________|
-+ * |  17   |  Remote Voltage Connected to ADC0                                 |
-+ * |_______|___________________________________________________________________|
-+ * |  18   |  Remote Voltage Connected to ADC1                                 |
-+ * |_______|___________________________________________________________________|
-+ * |  19   |  Remote Voltage Connected to ADC2                                 |
-+ * |_______|___________________________________________________________________|
-+ * |  20   |  Remote Voltage Connected to ADC3                                 |
-+ * |_______|___________________________________________________________________|
-+ * |  21   |  Remote Voltage Connected to ADC4                                 |
-+ * |_______|___________________________________________________________________|
-+ * |  22   |  Remote Voltage Connected to ADC5                                 |
-+ * |_______|___________________________________________________________________|
-+ * |23-254 |  Reserved                                                         |
-+ * |_______|___________________________________________________________________|
-+ * |  255  |  Applies to all pages                                             |
-+ * |_______|___________________________________________________________________|
-+ */
-+
-+/* Place holder to save the max31785 mfr specific registers */
-+typedef struct MAX31785State {
-+    PMBusDevice parent;
-+    uint16_t mfr_mode[MAX31785_TOTAL_NUM_PAGES];
-+    uint16_t vout_peak[MAX31785_TOTAL_NUM_PAGES];
-+    uint16_t temperature_peak[MAX31785_TOTAL_NUM_PAGES];
-+    uint16_t vout_min[MAX31785_TOTAL_NUM_PAGES];
-+    uint8_t  fault_response[MAX31785_TOTAL_NUM_PAGES];
-+    uint32_t time_count[MAX31785_TOTAL_NUM_PAGES];
-+    uint16_t temp_sensor_config[MAX31785_TOTAL_NUM_PAGES];
-+    uint16_t fan_config[MAX31785_TOTAL_NUM_PAGES];
-+    uint16_t read_fan_pwm[MAX31785_TOTAL_NUM_PAGES];
-+    uint16_t fan_fault_limit[MAX31785_TOTAL_NUM_PAGES];
-+    uint16_t fan_warn_limit[MAX31785_TOTAL_NUM_PAGES];
-+    uint16_t fan_run_time[MAX31785_TOTAL_NUM_PAGES];
-+    uint16_t fan_pwm_avg[MAX31785_TOTAL_NUM_PAGES];
-+    uint64_t fan_pwm2rpm[MAX31785_TOTAL_NUM_PAGES];
-+    uint64_t mfr_location;
-+    uint64_t mfr_date;
-+    uint64_t mfr_serial;
-+    uint16_t mfr_revision;
-+} MAX31785State;
-+
-+static uint8_t max31785_read_byte(PMBusDevice *pmdev)
-+{
-+    MAX31785State *s = MAX31785(pmdev);
-+    switch (pmdev->code) {
-+
-+    case PMBUS_FAN_CONFIG_1_2:
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmbus_send8(pmdev, pmdev->pages[pmdev->page].fan_config_1_2);
-+        }
-+        break;
-+
-+    case PMBUS_FAN_COMMAND_1:
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmbus_send16(pmdev, pmdev->pages[pmdev->page].fan_command_1);
-+        }
-+        break;
-+
-+    case PMBUS_READ_FAN_SPEED_1:
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmbus_send16(pmdev, pmdev->pages[pmdev->page].read_fan_speed_1);
-+        }
-+        break;
-+
-+    case PMBUS_STATUS_FANS_1_2:
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmbus_send16(pmdev, pmdev->pages[pmdev->page].status_fans_1_2);
-+        }
-+        break;
-+
-+    case PMBUS_MFR_REVISION:
-+        pmbus_send16(pmdev, MAX31785_DEFAULT_MFR_REVISION);
-+        break;
-+
-+    case PMBUS_MFR_ID:
-+        pmbus_send8(pmdev, 0x4d); /* Maxim */
-+        break;
-+
-+    case PMBUS_MFR_MODEL:
-+        pmbus_send8(pmdev, 0x53);
-+        break;
-+
-+    case PMBUS_MFR_LOCATION:
-+        pmbus_send64(pmdev, s->mfr_location);
-+        break;
-+
-+    case PMBUS_MFR_DATE:
-+        pmbus_send64(pmdev, s->mfr_date);
-+        break;
-+
-+    case PMBUS_MFR_SERIAL:
-+        pmbus_send64(pmdev, s->mfr_serial);
-+        break;
-+
-+    case MAX31785_MFR_MODE:
-+        pmbus_send16(pmdev, s->mfr_mode[pmdev->page]);
-+        break;
-+
-+    case MAX31785_MFR_VOUT_PEAK:
-+        if ((pmdev->page >= MAX31785_MIN_ADC_VOLTAGE_PAGE) &&
-+            (pmdev->page <= MAX31785_MAX_ADC_VOLTAGE_PAGE)) {
-+            pmbus_send16(pmdev, s->vout_peak[pmdev->page]);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_TEMPERATURE_PEAK:
-+        if ((pmdev->page >= MAX31785_MIN_TEMP_PAGE) &&
-+            (pmdev->page <= MAX31785_MAX_TEMP_PAGE)) {
-+            pmbus_send16(pmdev, s->temperature_peak[pmdev->page]);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_VOUT_MIN:
-+        if ((pmdev->page >= MAX31785_MIN_ADC_VOLTAGE_PAGE) &&
-+            (pmdev->page <= MAX31785_MAX_ADC_VOLTAGE_PAGE)) {
-+            pmbus_send16(pmdev, s->vout_min[pmdev->page]);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAULT_RESPONSE:
-+        pmbus_send8(pmdev, s->fault_response[pmdev->page]);
-+        break;
-+
-+    case MAX31785_MFR_TIME_COUNT: /* R/W 32 */
-+        pmbus_send32(pmdev, s->time_count[pmdev->page]);
-+        break;
-+
-+    case MAX31785_MFR_TEMP_SENSOR_CONFIG: /* R/W 16 */
-+        if ((pmdev->page >= MAX31785_MIN_TEMP_PAGE) &&
-+            (pmdev->page <= MAX31785_MAX_TEMP_PAGE)) {
-+            pmbus_send16(pmdev, s->temp_sensor_config[pmdev->page]);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_CONFIG: /* R/W 16 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmbus_send16(pmdev, s->fan_config[pmdev->page]);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_READ_FAN_PWM: /* R/W 16 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmbus_send16(pmdev, s->read_fan_pwm[pmdev->page]);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_FAULT_LIMIT: /* R/W 16 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmbus_send16(pmdev, s->fan_fault_limit[pmdev->page]);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_WARN_LIMIT: /* R/W 16 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmbus_send16(pmdev, s->fan_warn_limit[pmdev->page]);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_RUN_TIME: /* R/W 16 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmbus_send16(pmdev, s->fan_run_time[pmdev->page]);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_PWM_AVG: /* R/W 16 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmbus_send16(pmdev, s->fan_pwm_avg[pmdev->page]);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_PWM2RPM: /* R/W 64 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmbus_send64(pmdev, s->fan_pwm2rpm[pmdev->page]);
-+        }
-+        break;
-+
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+        "%s: reading from unsupported register: 0x%02x\n",
-+        __func__, pmdev->code);
-+        break;
-+    }
-+
-+    return 0xFF;
-+}
-+
-+static int max31785_write_data(PMBusDevice *pmdev, const uint8_t *buf,
-+                               uint8_t len)
-+{
-+    MAX31785State *s = MAX31785(pmdev);
-+    if (len == 0) {
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: writing empty data\n", __func__);
-+        return -1;
-+    }
-+
-+    pmdev->code = buf[0]; /* PMBus command code */
-+
-+    if (len == 1) {
-+        return 0;
-+    }
-+
-+    /* Exclude command code from buffer */
-+    buf++;
-+    len--;
-+
-+    switch (pmdev->code) {
-+
-+    case PMBUS_FAN_CONFIG_1_2:
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmdev->pages[pmdev->page].fan_config_1_2 = pmbus_receive8(pmdev);
-+        }
-+        break;
-+
-+    case PMBUS_FAN_COMMAND_1:
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            pmdev->pages[pmdev->page].fan_command_1 = pmbus_receive16(pmdev);
-+            pmdev->pages[pmdev->page].read_fan_speed_1 =
-+                ((MAX31785_DEFAULT_FAN_SPEED / MAX31785_DEFAULT_FAN_MAX_PWM) *
-+                pmdev->pages[pmdev->page].fan_command_1);
-+        }
-+        break;
-+
-+    case PMBUS_MFR_LOCATION: /* R/W 64 */
-+        s->mfr_location = pmbus_receive64(pmdev);
-+        break;
-+
-+    case PMBUS_MFR_DATE: /* R/W 64 */
-+        s->mfr_date = pmbus_receive64(pmdev);
-+        break;
-+
-+    case PMBUS_MFR_SERIAL: /* R/W 64 */
-+        s->mfr_serial = pmbus_receive64(pmdev);
-+        break;
-+
-+    case MAX31785_MFR_MODE: /* R/W word */
-+        s->mfr_mode[pmdev->page] = pmbus_receive16(pmdev);
-+        break;
-+
-+    case MAX31785_MFR_VOUT_PEAK: /* R/W word */
-+        if ((pmdev->page >= MAX31785_MIN_ADC_VOLTAGE_PAGE) &&
-+            (pmdev->page <= MAX31785_MAX_ADC_VOLTAGE_PAGE)) {
-+            s->vout_peak[pmdev->page] = pmbus_receive16(pmdev);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_TEMPERATURE_PEAK: /* R/W word */
-+        if ((pmdev->page >= 6) && (pmdev->page <= 16)) {
-+            s->temperature_peak[pmdev->page] = pmbus_receive16(pmdev);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_VOUT_MIN: /* R/W word */
-+        if ((pmdev->page >= MAX31785_MIN_ADC_VOLTAGE_PAGE) &&
-+            (pmdev->page <= MAX31785_MAX_ADC_VOLTAGE_PAGE)) {
-+            s->vout_min[pmdev->page] = pmbus_receive16(pmdev);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAULT_RESPONSE: /* R/W 8 */
-+        s->fault_response[pmdev->page] = pmbus_receive8(pmdev);
-+        break;
-+
-+    case MAX31785_MFR_TIME_COUNT: /* R/W 32 */
-+        s->time_count[pmdev->page] = pmbus_receive32(pmdev);
-+        break;
-+
-+    case MAX31785_MFR_TEMP_SENSOR_CONFIG: /* R/W 16 */
-+        if ((pmdev->page >= MAX31785_MIN_TEMP_PAGE) &&
-+            (pmdev->page <= MAX31785_MAX_TEMP_PAGE)) {
-+            s->temp_sensor_config[pmdev->page] = pmbus_receive16(pmdev);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_CONFIG: /* R/W 16 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            s->fan_config[pmdev->page] = pmbus_receive16(pmdev);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_FAULT_LIMIT: /* R/W 16 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            s->fan_fault_limit[pmdev->page] = pmbus_receive16(pmdev);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_WARN_LIMIT: /* R/W 16 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            s->fan_warn_limit[pmdev->page] = pmbus_receive16(pmdev);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_RUN_TIME: /* R/W 16 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            s->fan_run_time[pmdev->page] = pmbus_receive16(pmdev);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_PWM_AVG: /* R/W 16 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            s->fan_pwm_avg[pmdev->page] = pmbus_receive16(pmdev);
-+        }
-+        break;
-+
-+    case MAX31785_MFR_FAN_PWM2RPM: /* R/W 64 */
-+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
-+            s->fan_pwm2rpm[pmdev->page] = pmbus_receive64(pmdev);
-+        }
-+        break;
-+
-+    default:
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "%s: writing to unsupported register: 0x%02x\n",
-+                      __func__, pmdev->code);
-+        break;
-+    }
-+
-+    return 0;
-+}
-+
-+static void max31785_exit_reset(Object *obj)
-+{
-+    PMBusDevice *pmdev = PMBUS_DEVICE(obj);
-+    MAX31785State *s = MAX31785(obj);
-+
-+    pmdev->capability = MAX31785_DEFAULT_CAPABILITY;
-+
-+    for (int i = MAX31785_MIN_FAN_PAGE; i <= MAX31785_MAX_FAN_PAGE; i++) {
-+        pmdev->pages[i].vout_mode = MAX31785_DEFAULT_VOUT_MODE;
-+        pmdev->pages[i].fan_command_1 = MAX31785_DEFAULT_FAN_COMMAND_1;
-+        pmdev->pages[i].revision = MAX31785_DEFAULT_PMBUS_REVISION;
-+        pmdev->pages[i].fan_config_1_2 = MAX31785_DEFAULT_FAN_CONFIG_1_2(0);
-+        pmdev->pages[i].read_fan_speed_1 = MAX31785_DEFAULT_FAN_SPEED;
-+        pmdev->pages[i].status_fans_1_2 = MAX31785_DEFAULT_FAN_STATUS;
-+    }
-+
-+    for (int i = MAX31785_MIN_TEMP_PAGE; i <= MAX31785_MAX_TEMP_PAGE; i++) {
-+        pmdev->pages[i].vout_mode = MAX31785_DEFAULT_VOUT_MODE;
-+        pmdev->pages[i].revision = MAX31785_DEFAULT_PMBUS_REVISION;
-+        pmdev->pages[i].ot_fault_limit = MAX31785_DEFAULT_OT_FAULT_LIMIT;
-+        pmdev->pages[i].ot_warn_limit = MAX31785_DEFAULT_OT_WARN_LIMIT;
-+    }
-+
-+    for (int i = MAX31785_MIN_ADC_VOLTAGE_PAGE;
-+         i <= MAX31785_MAX_ADC_VOLTAGE_PAGE;
-+         i++) {
-+        pmdev->pages[i].vout_mode = MAX31785_DEFAULT_VOUT_MODE;
-+        pmdev->pages[i].revision = MAX31785_DEFAULT_PMBUS_REVISION;
-+        pmdev->pages[i].vout_scale_monitor =
-+            MAX31785_DEFAULT_VOUT_SCALE_MONITOR;
-+        pmdev->pages[i].vout_ov_fault_limit = MAX31785_DEFAULT_OV_FAULT_LIMIT;
-+        pmdev->pages[i].vout_ov_warn_limit = MAX31785_DEFAULT_OV_WARN_LIMIT;
-+    }
-+
-+    s->mfr_location = MAX31785_DEFAULT_TEXT;
-+    s->mfr_date = MAX31785_DEFAULT_TEXT;
-+    s->mfr_serial = MAX31785_DEFAULT_TEXT;
-+}
-+
-+static const VMStateDescription vmstate_max31785 = {
-+    .name = TYPE_MAX31785,
-+    .version_id = 0,
-+    .minimum_version_id = 0,
-+    .fields = (VMStateField[]){
-+        VMSTATE_PMBUS_DEVICE(parent, MAX31785State),
-+        VMSTATE_UINT16_ARRAY(mfr_mode, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT16_ARRAY(vout_peak, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT16_ARRAY(temperature_peak, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT16_ARRAY(vout_min, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT8_ARRAY(fault_response, MAX31785State,
-+                            MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT32_ARRAY(time_count, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT16_ARRAY(temp_sensor_config, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT16_ARRAY(fan_config, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT16_ARRAY(read_fan_pwm, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT16_ARRAY(fan_fault_limit, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT16_ARRAY(fan_warn_limit, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT16_ARRAY(fan_run_time, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT16_ARRAY(fan_pwm_avg, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT64_ARRAY(fan_pwm2rpm, MAX31785State,
-+                             MAX31785_TOTAL_NUM_PAGES),
-+        VMSTATE_UINT64(mfr_location, MAX31785State),
-+        VMSTATE_UINT64(mfr_date, MAX31785State),
-+        VMSTATE_UINT64(mfr_serial, MAX31785State),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+static void max31785_init(Object *obj)
-+{
-+    PMBusDevice *pmdev = PMBUS_DEVICE(obj);
-+
-+    for (int i = MAX31785_MIN_FAN_PAGE; i <= MAX31785_MAX_FAN_PAGE; i++) {
-+        pmbus_page_config(pmdev, i, PB_HAS_VOUT_MODE);
-+    }
-+
-+    for (int i = MAX31785_MIN_TEMP_PAGE; i <= MAX31785_MAX_TEMP_PAGE; i++) {
-+        pmbus_page_config(pmdev, i, PB_HAS_VOUT_MODE | PB_HAS_TEMPERATURE);
-+    }
-+
-+    for (int i = MAX31785_MIN_ADC_VOLTAGE_PAGE;
-+        i <= MAX31785_MAX_ADC_VOLTAGE_PAGE;
-+        i++) {
-+        pmbus_page_config(pmdev, i, PB_HAS_VOUT_MODE | PB_HAS_VOUT |
-+                                    PB_HAS_VOUT_RATING);
-+    }
-+}
-+
-+static void max31785_class_init(ObjectClass *klass, void *data)
-+{
-+    ResettableClass *rc = RESETTABLE_CLASS(klass);
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+    PMBusDeviceClass *k = PMBUS_DEVICE_CLASS(klass);
-+    dc->desc = "Maxim MAX31785 6-Channel Fan Controller";
-+    dc->vmsd = &vmstate_max31785;
-+    k->write_data = max31785_write_data;
-+    k->receive_byte = max31785_read_byte;
-+    k->device_num_pages = MAX31785_TOTAL_NUM_PAGES;
-+    rc->phases.exit = max31785_exit_reset;
-+}
-+
-+static const TypeInfo max31785_info = {
-+    .name = TYPE_MAX31785,
-+    .parent = TYPE_PMBUS_DEVICE,
-+    .instance_size = sizeof(MAX31785State),
-+    .instance_init = max31785_init,
-+    .class_init = max31785_class_init,
-+};
-+
-+static void max31785_register_types(void)
-+{
-+    type_register_static(&max31785_info);
-+}
-+
-+type_init(max31785_register_types)
-diff --git a/hw/sensor/Kconfig b/hw/sensor/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sensor/Kconfig
-+++ b/hw/sensor/Kconfig
-@@ -XXX,XX +XXX,XX @@ config LSM303DLHC_MAG
- config ISL_PMBUS_VR
-     bool
-     depends on PMBUS
-+
-+config MAX31785
-+    bool
-+    depends on PMBUS
-diff --git a/hw/sensor/meson.build b/hw/sensor/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sensor/meson.build
-+++ b/hw/sensor/meson.build
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ADM1272', if_true: files('adm1272.c'))
- softmmu_ss.add(when: 'CONFIG_MAX34451', if_true: files('max34451.c'))
- softmmu_ss.add(when: 'CONFIG_LSM303DLHC_MAG', if_true: files('lsm303dlhc_mag.c'))
- softmmu_ss.add(when: 'CONFIG_ISL_PMBUS_VR', if_true: files('isl_pmbus_vr.c'))
-+softmmu_ss.add(when: 'CONFIG_MAX31785', if_true: files('max31785.c'))
---
-.35.3

-[PULL 17/27] hw/arm/aspeed: Add MAX31785 Fan controllers
+Deleted patch
-From: Maheswara Kurapati <quic_mkurapat@quicinc.com>
-Add MAX31785 fan controllers in machines so that the Linux driver
-populates the sysfs interface.
-Firework has two MAX31785 Fan controllers at 0x52, and 0x54 on bus 9.
-Witherspoon has one at 0x52 on bus 3.
-Rainier has one at 0x52 on bus 7.
-Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com>
-Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220627154703.148943-6-quic_jaehyoo@quicinc.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/arm/aspeed.c | 8 ++++++--
- hw/arm/Kconfig  | 2 ++
-files changed, 8 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
-     LEDState *led;
-     /* Bus 3: TODO bmp280@77 */
--    /* Bus 3: TODO max31785@52 */
-     dev = DEVICE(i2c_slave_new(TYPE_PCA9552, 0x60));
-     qdev_prop_set_string(dev, "description", "pca1");
-     i2c_slave_realize_and_unref(I2C_SLAVE(dev),
-@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
-                               qdev_get_gpio_in(DEVICE(led), 0));
-     }
-     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3), "dps310", 0x76);
-+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3), "max31785", 0x52);
-     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), "tmp423", 0x4c);
-     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5), "tmp423", 0x4c);
-@@ -XXX,XX +XXX,XX @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
-     create_pca9552(soc, 7, 0x31);
-     create_pca9552(soc, 7, 0x32);
-     create_pca9552(soc, 7, 0x33);
--    /* Bus 7: TODO max31785@52 */
-     create_pca9552(soc, 7, 0x60);
-     create_pca9552(soc, 7, 0x61);
-     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), "dps310", 0x76);
-     /* Bus 7: TODO si7021-a20@20 */
-     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), TYPE_TMP105,
-x48);
-+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), "max31785", 0x52);
-     aspeed_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 7), 0x50, 64 * KiB);
-     aspeed_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 7), 0x51, 64 * KiB);
-@@ -XXX,XX +XXX,XX @@ static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
-     qcom_dc_scm_bmc_i2c_init(bmc);
-     /* Now create the Firework specific hardware */
-+
-+    /* I2C9 Fan Controller (MAX31785) */
-+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x52);
-+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x54);
- }
- static bool aspeed_get_mmio_exec(Object *obj, Error **errp)
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
-+++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config ASPEED_SOC
-     select EMC141X
-     select UNIMP
-     select LED
-+    select PMBUS
-+    select MAX31785
- config MPS2
-     bool
---
-.35.3

-[PULL 18/27] hw/arm/aspeed: firework: Add Thermal Diodes
+Deleted patch
-From: Maheswara Kurapati <quic_mkurapat@quicinc.com>
-Add Thermal Diodes for Firework machine.
-Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com>
-Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220627154703.148943-7-quic_jaehyoo@quicinc.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/arm/aspeed.c | 10 ++++++++++
-file changed, 10 insertions(+)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
- static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
- {
-     AspeedSoCState *soc = &bmc->soc;
-+    I2CSlave *therm_mux;
-     /* Create the generic DC-SCM hardware */
-     qcom_dc_scm_bmc_i2c_init(bmc);
-     /* Now create the Firework specific hardware */
-+    /* I2C8 Thermal Diodes*/
-+    therm_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8),
-+                                        "pca9548", 0x70);
-+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 0), TYPE_LM75, 0x4C);
-+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 1), TYPE_LM75, 0x4C);
-+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 2), TYPE_LM75, 0x48);
-+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 3), TYPE_LM75, 0x48);
-+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 4), TYPE_LM75, 0x48);
-+
-     /* I2C9 Fan Controller (MAX31785) */
-     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x52);
-     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x54);
---
-.35.3

-[PULL 19/27] hw/arm/aspeed: firework: add I2C MUXes for VR channels
+Deleted patch
-From: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
-Add 2-level cascaded I2C MUXes for SOC VR channels into the Firework
-machine.
-Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220627154703.148943-8-quic_jaehyoo@quicinc.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/arm/aspeed.c | 10 +++++++++-
-file changed, 9 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
- static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
- {
-     AspeedSoCState *soc = &bmc->soc;
--    I2CSlave *therm_mux;
-+    I2CSlave *therm_mux, *cpuvr_mux;
-     /* Create the generic DC-SCM hardware */
-     qcom_dc_scm_bmc_i2c_init(bmc);
-     /* Now create the Firework specific hardware */
-+    /* I2C7 CPUVR MUX */
-+    cpuvr_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7),
-+                                        "pca9546", 0x70);
-+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 0), "pca9548", 0x72);
-+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 1), "pca9548", 0x72);
-+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 2), "pca9548", 0x72);
-+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 3), "pca9548", 0x72);
-+
-     /* I2C8 Thermal Diodes*/
-     therm_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8),
-                                         "pca9548", 0x70);
---
-.35.3

-[PULL 20/27] hw/i2c/aspeed: Fix R_I2CD_FUN_CTRL reference
+Deleted patch
-From: Peter Delevoryas <pdel@fb.com>
-Very minor, doesn't effect functionality, but this is supposed to be
-R_I2CC_FUN_CTRL (new-mode, not old-mode).
-Fixes: ba2cccd64e9 ("aspeed: i2c: Add new mode support")
-Signed-off-by: Peter Delevoryas <pdel@fb.com>
-Message-Id: <20220630045133.32251-2-me@pjd.dev>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/i2c/aspeed_i2c.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
-+++ b/hw/i2c/aspeed_i2c.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
-                           __func__);
-             break;
-         }
--        bus->regs[R_I2CD_FUN_CTRL] = value & 0x007dc3ff;
-+        bus->regs[R_I2CC_FUN_CTRL] = value & 0x007dc3ff;
-         break;
-     case A_I2CC_AC_TIMING:
-         bus->regs[R_I2CC_AC_TIMING] = value & 0x1ffff0ff;
---
-.35.3

-[PULL 21/27] hw/i2c/aspeed: Fix DMA len write-enable bit handling
+Deleted patch
-From: Peter Delevoryas <pdel@fb.com>
-I noticed i2c rx transfers were getting shortened to "1" on Zephyr. It
-seems to be because the Zephyr i2c driver sets the RX DMA len with the
-RX field write-enable bit set (bit 31) to avoid a read-modify-write. [1]
-/* 0x1C : I2CM Master DMA Transfer Length Register   */
-I think we should be checking the write-enable bits on the incoming
-value, not checking the register array. I'm not sure we're even writing
-the write-enable bits to the register array, actually.
-[1] https://github.com/AspeedTech-BMC/zephyr/blob/db3dbcc9c52e67a47180890ac938ed380b33f91c/drivers/i2c/i2c_aspeed.c#L145-L148
-Fixes: ba2cccd64e90f34 ("aspeed: i2c: Add new mode support")
-Signed-off-by: Peter Delevoryas <pdel@fb.com>
-Message-Id: <20220630045133.32251-3-me@pjd.dev>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/i2c/aspeed_i2c.c | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
-+++ b/hw/i2c/aspeed_i2c.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
-                                                      RX_BUF_LEN) + 1;
-         break;
-     case A_I2CM_DMA_LEN:
--        w1t = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN_W1T) ||
--                   ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN_W1T);
-+        w1t = FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T) ||
-+              FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T);
-         /* If none of the w1t bits are set, just write to the reg as normal. */
-         if (!w1t) {
-             bus->regs[R_I2CM_DMA_LEN] = value;
-             break;
-         }
--        if (ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN_W1T)) {
-+        if (FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T)) {
-             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN,
-                              FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN));
-         }
--        if (ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN_W1T)) {
-+        if (FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T)) {
-             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN,
-                              FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN));
-         }
---
-.35.3

-[PULL 22/27] hw/i2c/aspeed: Fix MASTER_EN missing error message
+Deleted patch
-From: Peter Delevoryas <pdel@fb.com>
-aspeed_i2c_bus_is_master is checking if master mode is enabled in the I2C
-bus controller's function-control register, not that slave mode is enabled
-or something.  The error here is that the guest is trying to trigger an I2C
-master mode command while master mode is not enabled.
-Fixes: ba2cccd64e90f342 ("aspeed: i2c: Add new mode support")
-Signed-off-by: Peter Delevoryas <pdel@fb.com>
-Message-Id: <20220630045133.32251-4-me@pjd.dev>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/i2c/aspeed_i2c.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
-+++ b/hw/i2c/aspeed_i2c.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
-         }
-         if (!aspeed_i2c_bus_is_master(bus)) {
--            qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
-+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
-                           __func__);
-             break;
-         }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
-         }
-         if (!aspeed_i2c_bus_is_master(bus)) {
--            qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
-+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
-                           __func__);
-             break;
-         }
---
-.35.3

-[PULL 23/27] hw/i2c: support multiple masters
+Deleted patch
-From: Klaus Jensen <k.jensen@samsung.com>
-Allow slaves to master the bus by registering a bottom halve. If the bus
-is busy, the bottom half is queued up. When a slave has succesfully
-mastered the bus, the bottom half is scheduled.
-Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
-[ clg : - fixed typos in commit log ]
-Message-Id: <20220601210831.67259-4-its@irrelevant.dk>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220630045133.32251-5-me@pjd.dev>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- include/hw/i2c/i2c.h | 14 ++++++++++++++
- hw/i2c/core.c        | 34 +++++++++++++++++++++++++++++++++-
-files changed, 47 insertions(+), 1 deletion(-)
-diff --git a/include/hw/i2c/i2c.h b/include/hw/i2c/i2c.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i2c/i2c.h
-+++ b/include/hw/i2c/i2c.h
-@@ -XXX,XX +XXX,XX @@ struct I2CNode {
-     QLIST_ENTRY(I2CNode) next;
- };
-+typedef struct I2CPendingMaster I2CPendingMaster;
-+
-+struct I2CPendingMaster {
-+    QEMUBH *bh;
-+    QSIMPLEQ_ENTRY(I2CPendingMaster) entry;
-+};
-+
- typedef QLIST_HEAD(I2CNodeList, I2CNode) I2CNodeList;
-+typedef QSIMPLEQ_HEAD(I2CPendingMasters, I2CPendingMaster) I2CPendingMasters;
- struct I2CBus {
-     BusState qbus;
-     I2CNodeList current_devs;
-+    I2CPendingMasters pending_masters;
-     uint8_t saved_address;
-     bool broadcast;
-+
-+    /* Set from slave currently mastering the bus. */
-+    QEMUBH *bh;
- };
- I2CBus *i2c_init_bus(DeviceState *parent, const char *name);
-@@ -XXX,XX +XXX,XX @@ int i2c_start_send(I2CBus *bus, uint8_t address);
- void i2c_end_transfer(I2CBus *bus);
- void i2c_nack(I2CBus *bus);
-+void i2c_bus_master(I2CBus *bus, QEMUBH *bh);
-+void i2c_bus_release(I2CBus *bus);
- int i2c_send(I2CBus *bus, uint8_t data);
- uint8_t i2c_recv(I2CBus *bus);
- bool i2c_scan_bus(I2CBus *bus, uint8_t address, bool broadcast,
-diff --git a/hw/i2c/core.c b/hw/i2c/core.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/core.c
-+++ b/hw/i2c/core.c
-@@ -XXX,XX +XXX,XX @@
- #include "migration/vmstate.h"
- #include "qapi/error.h"
- #include "qemu/module.h"
-+#include "qemu/main-loop.h"
- #include "trace.h"
- #define I2C_BROADCAST 0x00
-@@ -XXX,XX +XXX,XX @@ I2CBus *i2c_init_bus(DeviceState *parent, const char *name)
-     bus = I2C_BUS(qbus_new(TYPE_I2C_BUS, parent, name));
-     QLIST_INIT(&bus->current_devs);
-+    QSIMPLEQ_INIT(&bus->pending_masters);
-     vmstate_register(NULL, VMSTATE_INSTANCE_ID_ANY, &vmstate_i2c_bus, bus);
-     return bus;
- }
-@@ -XXX,XX +XXX,XX @@ void i2c_slave_set_address(I2CSlave *dev, uint8_t address)
- /* Return nonzero if bus is busy.  */
- int i2c_bus_busy(I2CBus *bus)
- {
--    return !QLIST_EMPTY(&bus->current_devs);
-+    return !QLIST_EMPTY(&bus->current_devs) || bus->bh;
- }
- bool i2c_scan_bus(I2CBus *bus, uint8_t address, bool broadcast,
-@@ -XXX,XX +XXX,XX @@ int i2c_start_transfer(I2CBus *bus, uint8_t address, bool is_recv)
-                                                : I2C_START_SEND);
- }
-+void i2c_bus_master(I2CBus *bus, QEMUBH *bh)
-+{
-+    if (i2c_bus_busy(bus)) {
-+        I2CPendingMaster *node = g_new(struct I2CPendingMaster, 1);
-+        node->bh = bh;
-+
-+        QSIMPLEQ_INSERT_TAIL(&bus->pending_masters, node, entry);
-+
-+        return;
-+    }
-+
-+    bus->bh = bh;
-+    qemu_bh_schedule(bus->bh);
-+}
-+
-+void i2c_bus_release(I2CBus *bus)
-+{
-+    bus->bh = NULL;
-+}
-+
- int i2c_start_recv(I2CBus *bus, uint8_t address)
- {
-     return i2c_do_start_transfer(bus, address, I2C_START_RECV);
-@@ -XXX,XX +XXX,XX @@ void i2c_end_transfer(I2CBus *bus)
-         g_free(node);
-     }
-     bus->broadcast = false;
-+
-+    if (!QSIMPLEQ_EMPTY(&bus->pending_masters)) {
-+        I2CPendingMaster *node = QSIMPLEQ_FIRST(&bus->pending_masters);
-+        bus->bh = node->bh;
-+
-+        QSIMPLEQ_REMOVE_HEAD(&bus->pending_masters, entry);
-+        g_free(node);
-+
-+        qemu_bh_schedule(bus->bh);
-+    }
- }
- int i2c_send(I2CBus *bus, uint8_t data)
---
-.35.3

-[PULL 24/27] hw/i2c: add asynchronous send
+Deleted patch
-From: Klaus Jensen <k.jensen@samsung.com>
-Add an asynchronous version of i2c_send() that requires the slave to
-explicitly acknowledge on the bus with i2c_ack().
-The current master must use the new i2c_start_send_async() to indicate
-that it wants to do an asynchronous transfer. This allows the i2c core
-to check if the target slave supports this or not. This approach relies
-on adding a new enum i2c_event member, which is why a bunch of other
-devices needs changes in their event handling switches.
-Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
-Message-Id: <20220601210831.67259-5-its@irrelevant.dk>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220630045133.32251-6-me@pjd.dev>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- include/hw/i2c/i2c.h       | 16 ++++++++++++++++
- hw/arm/pxa2xx.c            |  2 ++
- hw/display/sii9022.c       |  2 ++
- hw/display/ssd0303.c       |  2 ++
- hw/i2c/core.c              | 36 +++++++++++++++++++++++++++++++++++-
- hw/i2c/smbus_slave.c       |  4 ++++
- hw/nvram/eeprom_at24c.c    |  2 ++
- hw/sensor/lsm303dlhc_mag.c |  2 ++
- hw/i2c/trace-events        |  2 ++
-files changed, 67 insertions(+), 1 deletion(-)
-diff --git a/include/hw/i2c/i2c.h b/include/hw/i2c/i2c.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i2c/i2c.h
-+++ b/include/hw/i2c/i2c.h
-@@ -XXX,XX +XXX,XX @@
- enum i2c_event {
-     I2C_START_RECV,
-     I2C_START_SEND,
-+    I2C_START_SEND_ASYNC,
-     I2C_FINISH,
-     I2C_NACK /* Masker NACKed a receive byte.  */
- };
-@@ -XXX,XX +XXX,XX @@ struct I2CSlaveClass {
-     /* Master to slave. Returns non-zero for a NAK, 0 for success. */
-     int (*send)(I2CSlave *s, uint8_t data);
-+    /* Master to slave (asynchronous). Receiving slave must call i2c_ack(). */
-+    void (*send_async)(I2CSlave *s, uint8_t data);
-+
-     /*
-      * Slave to master.  This cannot fail, the device should always
-      * return something here.
-@@ -XXX,XX +XXX,XX @@ int i2c_start_recv(I2CBus *bus, uint8_t address);
-  */
- int i2c_start_send(I2CBus *bus, uint8_t address);
-+/**
-+ * i2c_start_send_async: start an asynchronous 'send' transfer on an I2C bus.
-+ *
-+ * @bus: #I2CBus to be used
-+ * @address: address of the slave
-+ *
-+ * Return: 0 on success, -1 on error
-+ */
-+int i2c_start_send_async(I2CBus *bus, uint8_t address);
-+
- void i2c_end_transfer(I2CBus *bus);
- void i2c_nack(I2CBus *bus);
-+void i2c_ack(I2CBus *bus);
- void i2c_bus_master(I2CBus *bus, QEMUBH *bh);
- void i2c_bus_release(I2CBus *bus);
- int i2c_send(I2CBus *bus, uint8_t data);
-+int i2c_send_async(I2CBus *bus, uint8_t data);
- uint8_t i2c_recv(I2CBus *bus);
- bool i2c_scan_bus(I2CBus *bus, uint8_t address, bool broadcast,
-                   I2CNodeList *current_devs);
-diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/pxa2xx.c
-+++ b/hw/arm/pxa2xx.c
-@@ -XXX,XX +XXX,XX @@ static int pxa2xx_i2c_event(I2CSlave *i2c, enum i2c_event event)
-     case I2C_NACK:
-         s->status |= 1 << 1;                /* set ACKNAK */
-         break;
-+    default:
-+        return -1;
-     }
-     pxa2xx_i2c_update(s);
-diff --git a/hw/display/sii9022.c b/hw/display/sii9022.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/sii9022.c
-+++ b/hw/display/sii9022.c
-@@ -XXX,XX +XXX,XX @@ static int sii9022_event(I2CSlave *i2c, enum i2c_event event)
-         break;
-     case I2C_NACK:
-         break;
-+    default:
-+        return -1;
-     }
-     return 0;
-diff --git a/hw/display/ssd0303.c b/hw/display/ssd0303.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/ssd0303.c
-+++ b/hw/display/ssd0303.c
-@@ -XXX,XX +XXX,XX @@ static int ssd0303_event(I2CSlave *i2c, enum i2c_event event)
-     case I2C_NACK:
-         /* Nothing to do.  */
-         break;
-+    default:
-+        return -1;
-     }
-     return 0;
-diff --git a/hw/i2c/core.c b/hw/i2c/core.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/core.c
-+++ b/hw/i2c/core.c
-@@ -XXX,XX +XXX,XX @@ static int i2c_do_start_transfer(I2CBus *bus, uint8_t address,
-            start condition.  */
-         if (sc->event) {
--            trace_i2c_event("start", s->address);
-+            trace_i2c_event(event == I2C_START_SEND ? "start" : "start_async",
-+                            s->address);
-             rv = sc->event(s, event);
-             if (rv && !bus->broadcast) {
-                 if (bus_scanned) {
-@@ -XXX,XX +XXX,XX @@ int i2c_start_send(I2CBus *bus, uint8_t address)
-     return i2c_do_start_transfer(bus, address, I2C_START_SEND);
- }
-+int i2c_start_send_async(I2CBus *bus, uint8_t address)
-+{
-+    return i2c_do_start_transfer(bus, address, I2C_START_SEND_ASYNC);
-+}
-+
- void i2c_end_transfer(I2CBus *bus)
- {
-     I2CSlaveClass *sc;
-@@ -XXX,XX +XXX,XX @@ int i2c_send(I2CBus *bus, uint8_t data)
-     return ret ? -1 : 0;
- }
-+int i2c_send_async(I2CBus *bus, uint8_t data)
-+{
-+    I2CNode *node = QLIST_FIRST(&bus->current_devs);
-+    I2CSlave *slave = node->elt;
-+    I2CSlaveClass *sc = I2C_SLAVE_GET_CLASS(slave);
-+
-+    if (!sc->send_async) {
-+        return -1;
-+    }
-+
-+    trace_i2c_send_async(slave->address, data);
-+
-+    sc->send_async(slave, data);
-+
-+    return 0;
-+}
-+
- uint8_t i2c_recv(I2CBus *bus)
- {
-     uint8_t data = 0xff;
-@@ -XXX,XX +XXX,XX @@ void i2c_nack(I2CBus *bus)
-     }
- }
-+void i2c_ack(I2CBus *bus)
-+{
-+    if (!bus->bh) {
-+        return;
-+    }
-+
-+    trace_i2c_ack();
-+
-+    qemu_bh_schedule(bus->bh);
-+}
-+
- static int i2c_slave_post_load(void *opaque, int version_id)
- {
-     I2CSlave *dev = opaque;
-diff --git a/hw/i2c/smbus_slave.c b/hw/i2c/smbus_slave.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/smbus_slave.c
-+++ b/hw/i2c/smbus_slave.c
-@@ -XXX,XX +XXX,XX @@ static int smbus_i2c_event(I2CSlave *s, enum i2c_event event)
-             dev->mode = SMBUS_CONFUSED;
-             break;
-         }
-+        break;
-+
-+    default:
-+        return -1;
-     }
-     return 0;
-diff --git a/hw/nvram/eeprom_at24c.c b/hw/nvram/eeprom_at24c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/nvram/eeprom_at24c.c
-+++ b/hw/nvram/eeprom_at24c.c
-@@ -XXX,XX +XXX,XX @@ int at24c_eeprom_event(I2CSlave *s, enum i2c_event event)
-         break;
-     case I2C_NACK:
-         break;
-+    default:
-+        return -1;
-     }
-     return 0;
- }
-diff --git a/hw/sensor/lsm303dlhc_mag.c b/hw/sensor/lsm303dlhc_mag.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sensor/lsm303dlhc_mag.c
-+++ b/hw/sensor/lsm303dlhc_mag.c
-@@ -XXX,XX +XXX,XX @@ static int lsm303dlhc_mag_event(I2CSlave *i2c, enum i2c_event event)
-         break;
-     case I2C_NACK:
-         break;
-+    default:
-+        return -1;
-     }
-     s->len = 0;
-diff --git a/hw/i2c/trace-events b/hw/i2c/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/trace-events
-+++ b/hw/i2c/trace-events
-@@ -XXX,XX +XXX,XX @@
- i2c_event(const char *event, uint8_t address) "%s(addr:0x%02x)"
- i2c_send(uint8_t address, uint8_t data) "send(addr:0x%02x) data:0x%02x"
-+i2c_send_async(uint8_t address, uint8_t data) "send_async(addr:0x%02x) data:0x%02x"
- i2c_recv(uint8_t address, uint8_t data) "recv(addr:0x%02x) data:0x%02x"
-+i2c_ack(void) ""
- # aspeed_i2c.c
---
-.35.3

-[PULL 25/27] hw/i2c/aspeed: add slave device in old register mode
+Deleted patch
-From: Klaus Jensen <k.jensen@samsung.com>
-Add slave mode functionality for the Aspeed I2C controller in old
-register mode. This is implemented by realizing an I2C slave device
-owned by the I2C controller and attached to its own bus.
-The I2C slave device only implements asynchronous sends on the bus, so
-slaves not supporting that will not be able to communicate with it.
-Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
-[ clg: checkpatch fixes ]
-Message-Id: <20220601210831.67259-6-its@irrelevant.dk>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-Id: <20220630045133.32251-7-me@pjd.dev>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- include/hw/i2c/aspeed_i2c.h |  8 ++++
- hw/i2c/aspeed_i2c.c         | 89 +++++++++++++++++++++++++++++++++----
-files changed, 88 insertions(+), 9 deletions(-)
-diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i2c/aspeed_i2c.h
-+++ b/include/hw/i2c/aspeed_i2c.h
-@@ -XXX,XX +XXX,XX @@ struct AspeedI2CBus {
-     struct AspeedI2CState *controller;
-+    /* slave mode */
-+    I2CSlave *slave;
-+
-     MemoryRegion mr;
-     I2CBus *bus;
-@@ -XXX,XX +XXX,XX @@ struct AspeedI2CState {
-     AddressSpace dram_as;
- };
-+#define TYPE_ASPEED_I2C_BUS_SLAVE "aspeed.i2c.slave"
-+OBJECT_DECLARE_SIMPLE_TYPE(AspeedI2CBusSlave, ASPEED_I2C_BUS_SLAVE)
-+struct AspeedI2CBusSlave {
-+    I2CSlave i2c;
-+};
- struct AspeedI2CClass {
-     SysBusDeviceClass parent_class;
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
-+++ b/hw/i2c/aspeed_i2c.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
-     switch (offset) {
-     case A_I2CD_FUN_CTRL:
-         if (SHARED_FIELD_EX32(value, SLAVE_EN)) {
--            qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
--                          __func__);
--            break;
-+            i2c_slave_set_address(bus->slave, bus->regs[R_I2CD_DEV_ADDR]);
-         }
-         bus->regs[R_I2CD_FUN_CTRL] = value & 0x0071C3FF;
-         break;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
-             bus->controller->intr_status &= ~(1 << bus->id);
-             qemu_irq_lower(aic->bus_get_irq(bus));
-         }
--        if (handle_rx && (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD,
--                                                  M_RX_CMD) ||
--                      SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD,
--                                              M_S_RX_CMD_LAST))) {
--            aspeed_i2c_handle_rx_cmd(bus);
--            aspeed_i2c_bus_raise_interrupt(bus);
-+        if (handle_rx) {
-+            if (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, M_RX_CMD) ||
-+                SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD,
-+                                        M_S_RX_CMD_LAST)) {
-+                aspeed_i2c_handle_rx_cmd(bus);
-+                aspeed_i2c_bus_raise_interrupt(bus);
-+            } else if (aspeed_i2c_get_state(bus) == I2CD_STXD) {
-+                i2c_ack(bus->bus);
-+            }
-         }
-         break;
-     case A_I2CD_DEV_ADDR:
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_i2c_info = {
-     .abstract   = true,
- };
-+static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
-+{
-+    BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
-+    AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
-+    uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
-+    uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
-+    uint32_t value;
-+
-+    switch (event) {
-+    case I2C_START_SEND_ASYNC:
-+        value = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_byte_buf, TX_BUF);
-+        SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, value << 1);
-+
-+        ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
-+        SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
-+
-+        aspeed_i2c_set_state(bus, I2CD_STXD);
-+
-+        break;
-+
-+    case I2C_FINISH:
-+        SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
-+
-+        aspeed_i2c_set_state(bus, I2CD_IDLE);
-+
-+        break;
-+
-+    default:
-+        return -1;
-+    }
-+
-+    aspeed_i2c_bus_raise_interrupt(bus);
-+
-+    return 0;
-+}
-+
-+static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
-+{
-+    BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
-+    AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
-+    uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
-+    uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
-+
-+    SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
-+    SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
-+
-+    aspeed_i2c_bus_raise_interrupt(bus);
-+}
-+
-+static void aspeed_i2c_bus_slave_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+    I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
-+
-+    dc->desc = "Aspeed I2C Bus Slave";
-+
-+    sc->event = aspeed_i2c_bus_slave_event;
-+    sc->send_async = aspeed_i2c_bus_slave_send_async;
-+}
-+
-+static const TypeInfo aspeed_i2c_bus_slave_info = {
-+    .name           = TYPE_ASPEED_I2C_BUS_SLAVE,
-+    .parent         = TYPE_I2C_SLAVE,
-+    .instance_size  = sizeof(AspeedI2CBusSlave),
-+    .class_init     = aspeed_i2c_bus_slave_class_init,
-+};
-+
- static void aspeed_i2c_bus_reset(DeviceState *dev)
- {
-     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)
-     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
-     s->bus = i2c_init_bus(dev, name);
-+    s->slave = i2c_slave_create_simple(s->bus, TYPE_ASPEED_I2C_BUS_SLAVE,
-+                                       0xff);
-     memory_region_init_io(&s->mr, OBJECT(s), &aspeed_i2c_bus_ops,
-                           s, name, aic->reg_size);
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_1030_i2c_info = {
- static void aspeed_i2c_register_types(void)
- {
-     type_register_static(&aspeed_i2c_bus_info);
-+    type_register_static(&aspeed_i2c_bus_slave_info);
-     type_register_static(&aspeed_i2c_info);
-     type_register_static(&aspeed_2400_i2c_info);
-     type_register_static(&aspeed_2500_i2c_info);
---
-.35.3

-[PULL 26/27] hw/i2c/aspeed: Add new-registers DMA slave mode RX support
+Deleted patch
-From: Peter Delevoryas <pdel@fb.com>
-This commit adds support for DMA RX in slave mode while using the new
-register set in the AST2600 and AST1030. This patch also pretty much
-assumes packet mode is enabled, I'm not sure if this will work in DMA
-step mode.
-This is particularly useful for testing IPMB exchanges between Zephyr
-and external devices, which requires multi-master I2C support and DMA in
-the new register mode, because the Zephyr drivers from Aspeed use DMA in
-the new mode by default. The Zephyr drivers are also using packet mode.
-The typical sequence of events for receiving data in DMA slave + packet
-mode is that the Zephyr firmware will configure the slave address
-register with an address to receive on and configure the bus's function
-control register to enable master mode and slave mode simultaneously at
-startup, before any transfers are initiated.
-RX DMA is enabled in the slave mode command register, and the slave RX
-DMA buffer address and slave RX DMA buffer length are set. TX DMA is not
-covered in this patch.
-When the Aspeed I2C controller receives data from some other I2C master,
-it will reset the I2CS_DMA_LEN RX_LEN value to zero, then buffer
-incoming data in the RX DMA buffer while incrementing the I2CC_DMA_ADDR
-address counter and decrementing the I2CC_DMA_LEN counter. It will also
-update the I2CS_DMA_LEN RX_LEN value along the way.
-Once all the data has been received, the bus controller will raise an
-interrupt indicating a packet command was completed, the slave address
-matched, a normal stop condition was seen, and the transfer was an RX
-operation.
-If the master sent a NACK instead of a normal stop condition, or the
-transfer timed out, then a slightly different set of interrupt status
-values would be set. Those conditions are not handled in this commit.
-The Zephyr firmware then collects data from the RX DMA buffer and clears
-the status register by writing the PKT_MODE_EN bit to the status
-register. In packet mode, clearing the packet mode interrupt enable bit
-also clears most of the other interrupt bits automatically (except for a
-few bits above it).
-Note: if the master transmit or receive functions were in use
-simultaneously with the slave mode receive functionality, then the
-master mode functions may have raised the interrupt line for the bus
-before the DMA slave transfer is complete. It's important to have the
-slave's interrupt status register clear throughout the receive
-operation, and if the slave attempts to raise the interrupt before the
-master interrupt status is cleared, then it needs to re-raise the
-interrupt once the master interrupt status is cleared. (And vice-versa).
-That's why in this commit, when the master interrupt status is cleared
-and the interrupt line is lowered, we call the slave interrupt _raise_
-function, to see if the interrupt was pending. (And again, vice-versa).
-Signed-off-by: Peter Delevoryas <pdel@fb.com>
-Message-Id: <20220630045133.32251-8-me@pjd.dev>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- include/hw/i2c/aspeed_i2c.h |   3 +
- hw/i2c/aspeed_i2c.c         | 133 ++++++++++++++++++++++++++++++++----
-files changed, 124 insertions(+), 12 deletions(-)
-diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i2c/aspeed_i2c.h
-+++ b/include/hw/i2c/aspeed_i2c.h
-@@ -XXX,XX +XXX,XX @@ REG32(I2CM_DMA_LEN, 0x1c)
-     FIELD(I2CM_DMA_LEN, TX_BUF_LEN_W1T, 15, 1)
-     FIELD(I2CM_DMA_LEN, TX_BUF_LEN, 0, 11)
- REG32(I2CS_INTR_CTRL, 0x20)
-+    FIELD(I2CS_INTR_CTRL, PKT_CMD_FAIL, 17, 1)
-+    FIELD(I2CS_INTR_CTRL, PKT_CMD_DONE, 16, 1)
- REG32(I2CS_INTR_STS, 0x24)
-     /* 31:29 shared with I2CD_INTR_STS[31:29] */
-     FIELD(I2CS_INTR_STS, SLAVE_PARKING_STS, 24, 2)
-@@ -XXX,XX +XXX,XX @@ REG32(I2CS_INTR_STS, 0x24)
-     FIELD(I2CS_INTR_STS, PKT_CMD_FAIL, 17, 1)
-     FIELD(I2CS_INTR_STS, PKT_CMD_DONE, 16, 1)
-     /* 14:0 shared with I2CD_INTR_STS[14:0] */
-+    FIELD(I2CS_INTR_STS, SLAVE_ADDR_RX_MATCH, 7, 1)
- REG32(I2CS_CMD, 0x28)
-     FIELD(I2CS_CMD, W1_CTRL, 31, 1)
-     FIELD(I2CS_CMD, PKT_MODE_ACTIVE_ADDR, 17, 2)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
-+++ b/hw/i2c/aspeed_i2c.c
-@@ -XXX,XX +XXX,XX @@ static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
-     }
- }
-+static inline void aspeed_i2c_bus_raise_slave_interrupt(AspeedI2CBus *bus)
-+{
-+    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
-+
-+    if (!bus->regs[R_I2CS_INTR_STS]) {
-+        return;
-+    }
-+
-+    bus->controller->intr_status |= 1 << bus->id;
-+    qemu_irq_raise(aic->bus_get_irq(bus));
-+}
-+
- static uint64_t aspeed_i2c_bus_old_read(AspeedI2CBus *bus, hwaddr offset,
-                                         unsigned size)
- {
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_i2c_bus_new_read(AspeedI2CBus *bus, hwaddr offset,
-     case A_I2CM_DMA_LEN_STS:
-     case A_I2CC_DMA_ADDR:
-     case A_I2CC_DMA_LEN:
-+
-+    case A_I2CS_DEV_ADDR:
-+    case A_I2CS_DMA_RX_ADDR:
-+    case A_I2CS_DMA_LEN:
-+    case A_I2CS_CMD:
-+    case A_I2CS_INTR_CTRL:
-+    case A_I2CS_DMA_LEN_STS:
-         /* Value is already set, don't do anything. */
-         break;
-+    case A_I2CS_INTR_STS:
-+        break;
-     case A_I2CM_CMD:
-         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
-         break;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
-     switch (offset) {
-     case A_I2CC_FUN_CTRL:
--        if (SHARED_FIELD_EX32(value, SLAVE_EN)) {
--            qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
--                          __func__);
--            break;
--        }
--        bus->regs[R_I2CC_FUN_CTRL] = value & 0x007dc3ff;
-+        bus->regs[R_I2CC_FUN_CTRL] = value;
-         break;
-     case A_I2CC_AC_TIMING:
-         bus->regs[R_I2CC_AC_TIMING] = value & 0x1ffff0ff;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
-                 bus->controller->intr_status &= ~(1 << bus->id);
-                 qemu_irq_lower(aic->bus_get_irq(bus));
-             }
-+            aspeed_i2c_bus_raise_slave_interrupt(bus);
-             break;
-         }
-         bus->regs[R_I2CM_INTR_STS] &= ~(value & 0xf007f07f);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
-     case A_I2CC_DMA_LEN:
-         /* RO */
-         break;
--    case A_I2CS_DMA_LEN_STS:
--    case A_I2CS_DMA_TX_ADDR:
--    case A_I2CS_DMA_RX_ADDR:
-     case A_I2CS_DEV_ADDR:
-+        bus->regs[R_I2CS_DEV_ADDR] = value;
-+        break;
-+    case A_I2CS_DMA_RX_ADDR:
-+        bus->regs[R_I2CS_DMA_RX_ADDR] = value;
-+        break;
-+    case A_I2CS_DMA_LEN:
-+        assert(FIELD_EX32(value, I2CS_DMA_LEN, TX_BUF_LEN) == 0);
-+        if (FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN_W1T)) {
-+            ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN,
-+                             FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN));
-+        } else {
-+            bus->regs[R_I2CS_DMA_LEN] = value;
-+        }
-+        break;
-+    case A_I2CS_CMD:
-+        if (FIELD_EX32(value, I2CS_CMD, W1_CTRL)) {
-+            bus->regs[R_I2CS_CMD] |= value;
-+        } else {
-+            bus->regs[R_I2CS_CMD] = value;
-+        }
-+        i2c_slave_set_address(bus->slave, bus->regs[R_I2CS_DEV_ADDR]);
-+        break;
-     case A_I2CS_INTR_CTRL:
-+        bus->regs[R_I2CS_INTR_CTRL] = value;
-+        break;
-+
-     case A_I2CS_INTR_STS:
--    case A_I2CS_CMD:
--    case A_I2CS_DMA_LEN:
--        qemu_log_mask(LOG_UNIMP, "%s: Slave mode is not implemented\n",
-+        if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_CTRL, PKT_CMD_DONE)) {
-+            if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE) &&
-+                FIELD_EX32(value, I2CS_INTR_STS, PKT_CMD_DONE)) {
-+                bus->regs[R_I2CS_INTR_STS] &= 0xfffc0000;
-+            }
-+        } else {
-+            bus->regs[R_I2CS_INTR_STS] &= ~value;
-+        }
-+        if (!bus->regs[R_I2CS_INTR_STS]) {
-+            bus->controller->intr_status &= ~(1 << bus->id);
-+            qemu_irq_lower(aic->bus_get_irq(bus));
-+        }
-+        aspeed_i2c_bus_raise_interrupt(bus);
-+        break;
-+    case A_I2CS_DMA_LEN_STS:
-+        bus->regs[R_I2CS_DMA_LEN_STS] = 0;
-+        break;
-+    case A_I2CS_DMA_TX_ADDR:
-+        qemu_log_mask(LOG_UNIMP, "%s: Slave mode DMA TX is not implemented\n",
-                       __func__);
-         break;
-     default:
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_i2c_info = {
-     .abstract   = true,
- };
-+static int aspeed_i2c_bus_new_slave_event(AspeedI2CBus *bus,
-+                                          enum i2c_event event)
-+{
-+    switch (event) {
-+    case I2C_START_SEND_ASYNC:
-+        if (!SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CS_CMD, RX_DMA_EN)) {
-+            qemu_log_mask(LOG_GUEST_ERROR,
-+                          "%s: Slave mode RX DMA is not enabled\n", __func__);
-+            return -1;
-+        }
-+        ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN, 0);
-+        bus->regs[R_I2CC_DMA_ADDR] =
-+            ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_RX_ADDR, ADDR);
-+        bus->regs[R_I2CC_DMA_LEN] =
-+            ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN) + 1;
-+        i2c_ack(bus->bus);
-+        break;
-+    case I2C_FINISH:
-+        ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE, 1);
-+        ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
-+        SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, NORMAL_STOP, 1);
-+        SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, RX_DONE, 1);
-+        aspeed_i2c_bus_raise_slave_interrupt(bus);
-+        break;
-+    default:
-+        qemu_log_mask(LOG_UNIMP, "%s: i2c event %d unimplemented\n",
-+                      __func__, event);
-+        return -1;
-+    }
-+
-+    return 0;
-+}
-+
- static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
- {
-     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
-@@ -XXX,XX +XXX,XX @@ static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
-     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
-     uint32_t value;
-+    if (aspeed_i2c_is_new_mode(bus->controller)) {
-+        return aspeed_i2c_bus_new_slave_event(bus, event);
-+    }
-+
-     switch (event) {
-     case I2C_START_SEND_ASYNC:
-         value = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_byte_buf, TX_BUF);
-@@ -XXX,XX +XXX,XX @@ static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
-     return 0;
- }
-+static void aspeed_i2c_bus_new_slave_send_async(AspeedI2CBus *bus, uint8_t data)
-+{
-+    assert(address_space_write(&bus->controller->dram_as,
-+                               bus->regs[R_I2CC_DMA_ADDR],
-+                               MEMTXATTRS_UNSPECIFIED, &data, 1) == MEMTX_OK);
-+
-+    bus->regs[R_I2CC_DMA_ADDR]++;
-+    bus->regs[R_I2CC_DMA_LEN]--;
-+    ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN,
-+                     ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN) + 1);
-+    i2c_ack(bus->bus);
-+}
-+
- static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
- {
-     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
-     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
-     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
-+    if (aspeed_i2c_is_new_mode(bus->controller)) {
-+        return aspeed_i2c_bus_new_slave_send_async(bus, data);
-+    }
-+
-     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
-     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
---
-.35.3

The following changes since commit 621745c4f349ac09b72706c46febee983abca916:

Merge tag 'trivial-branch-for-7.1-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-06-30 04:49:40 +0530)

are available in the Git repository at:

https://github.com/legoater/qemu/ tags/pull-aspeed-20220630

for you to fetch changes up to 55c57023b740c29151d42600af9ac43ba00e56cc:

hw/misc/aspeed: Add PECI controller (2022-06-30 09:21:14 +0200)

----------------------------------------------------------------
aspeed queue:

* m25p80 improvements (Iris)
* Code cleanup in preparation of multi SoC machine (Peter)
* New MAX31785 model (Mahesh)
* New Qualcomm machines (Jae and Graeme)
* Core I2C slave mode (Klaus)
* Aspeed I2C slave mode for old and new register interface (Peter and Klaus)
* New Aspeed PECI model (Peter)
* Various small fixes

----------------------------------------------------------------
Cédric Le Goater (4):
      aspeed: Set the dram container at the SoC level
      aspeed/scu: Add trace events for read ops
      aspeed/i2c: Change trace event for NORMAL_STOP states
      aspeed/smc: Fix potential overflow

Graeme Gregory (1):
      hw/arm/aspeed: add Qualcomm Firework BMC machine

Iris Chen (2):
      hw: m25p80: add WP# pin and SRWD bit for write protection
      hw: m25p80: add tests for write protect (WP# and SRWD bit)

Jae Hyun Yoo (2):
      hw/arm/aspeed: add support for the Qualcomm DC-SCM v1 board
      hw/arm/aspeed: firework: add I2C MUXes for VR channels

Joel Stanley (1):
      aspeed/hace: Accumulative mode supported

Klaus Jensen (3):
      hw/i2c: support multiple masters
      hw/i2c: add asynchronous send
      hw/i2c/aspeed: add slave device in old register mode

Maheswara Kurapati (4):
      hw/i2c: pmbus: Page #255 is valid page for read requests.
      hw/sensor: add Maxim MAX31785 device
      hw/arm/aspeed: Add MAX31785 Fan controllers
      hw/arm/aspeed: firework: Add Thermal Diodes

Peter Delevoryas (10):
      aspeed: Set CPU memory property explicitly
      aspeed: Add memory property to Aspeed SoC
      aspeed: Remove usage of sysbus_mmio_map
      aspeed: Map unimplemented devices in SoC memory
      aspeed: Remove use of qemu_get_cpu
      hw/i2c/aspeed: Fix R_I2CD_FUN_CTRL reference
      hw/i2c/aspeed: Fix DMA len write-enable bit handling
      hw/i2c/aspeed: Fix MASTER_EN missing error message
      hw/i2c/aspeed: Add new-registers DMA slave mode RX support
      hw/misc/aspeed: Add PECI controller

From: Iris Chen <irischenlj@gmail.com>

Signed-off-by: Iris Chen <irischenlj@gmail.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-Id: <20220621202427.2680413-1-irischenlj@fb.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/block/m25p80.c | 82 ++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 67 insertions(+), 15 deletions(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@ struct Flash {
     uint8_t spansion_cr2v;
     uint8_t spansion_cr3v;
     uint8_t spansion_cr4v;
+    bool wp_level;
     bool write_enable;
     bool four_bytes_address_mode;
     bool reset_enable;
     bool quad_enable;
     bool aai_enable;
+    bool status_register_write_disabled;
     uint8_t ear;
 
     int64_t dirty_page;
@@ -XXX,XX +XXX,XX @@ static void complete_collecting_data(Flash *s)
         flash_erase(s, s->cur_addr, s->cmd_in_progress);
         break;
     case WRSR:
+        s->status_register_write_disabled = extract32(s->data[0], 7, 1);
+
         switch (get_man(s)) {
         case MAN_SPANSION:
             s->quad_enable = !!(s->data[1] & 0x02);
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
         break;
 
     case WRSR:
-        if (s->write_enable) {
-            switch (get_man(s)) {
-            case MAN_SPANSION:
-                s->needed_bytes = 2;
-                s->state = STATE_COLLECTING_DATA;
-                break;
-            case MAN_MACRONIX:
-                s->needed_bytes = 2;
-                s->state = STATE_COLLECTING_VAR_LEN_DATA;
-                break;
-            default:
-                s->needed_bytes = 1;
-                s->state = STATE_COLLECTING_DATA;
-            }
-            s->pos = 0;
+        /*
+         * If WP# is low and status_register_write_disabled is high,
+         * status register writes are disabled.
+         * This is also called "hardware protected mode" (HPM). All other
+         * combinations of the two states are called "software protected mode"
+         * (SPM), and status register writes are permitted.
+         */
+        if ((s->wp_level == 0 && s->status_register_write_disabled)
+            || !s->write_enable) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "M25P80: Status register write is disabled!\n");
+            break;
+        }
+
+        switch (get_man(s)) {
+        case MAN_SPANSION:
+            s->needed_bytes = 2;
+            s->state = STATE_COLLECTING_DATA;
+            break;
+        case MAN_MACRONIX:
+            s->needed_bytes = 2;
+            s->state = STATE_COLLECTING_VAR_LEN_DATA;
+            break;
+        default:
+            s->needed_bytes = 1;
+            s->state = STATE_COLLECTING_DATA;
         }
+        s->pos = 0;
         break;
 
     case WRDI:
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
 
     case RDSR:
         s->data[0] = (!!s->write_enable) << 1;
+        s->data[0] |= (!!s->status_register_write_disabled) << 7;
+
         if (get_man(s) == MAN_MACRONIX || get_man(s) == MAN_ISSI) {
             s->data[0] |= (!!s->quad_enable) << 6;
         }
@@ -XXX,XX +XXX,XX @@ static uint32_t m25p80_transfer8(SSIPeripheral *ss, uint32_t tx)
     return r;
 }
 
+static void m25p80_write_protect_pin_irq_handler(void *opaque, int n, int level)
+{
+    Flash *s = M25P80(opaque);
+    /* WP# is just a single pin. */
+    assert(n == 0);
+    s->wp_level = !!level;
+}
+
 static void m25p80_realize(SSIPeripheral *ss, Error **errp)
 {
     Flash *s = M25P80(ss);
@@ -XXX,XX +XXX,XX @@ static void m25p80_realize(SSIPeripheral *ss, Error **errp)
         s->storage = blk_blockalign(NULL, s->size);
         memset(s->storage, 0xFF, s->size);
     }
+
+    qdev_init_gpio_in_named(DEVICE(s),
+                            m25p80_write_protect_pin_irq_handler, "WP#", 1);
 }
 
 static void m25p80_reset(DeviceState *d)
 {
     Flash *s = M25P80(d);
 
+    s->wp_level = true;
+    s->status_register_write_disabled = false;
+
     reset_memory(s);
 }
 
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m25p80_aai_enable = {
     }
 };
 
+static bool m25p80_wp_level_srwd_needed(void *opaque)
+{
+    Flash *s = (Flash *)opaque;
+
+    return !s->wp_level || s->status_register_write_disabled;
+}
+
+static const VMStateDescription vmstate_m25p80_write_protect = {
+    .name = "m25p80/write_protect",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = m25p80_wp_level_srwd_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(wp_level, Flash),
+        VMSTATE_BOOL(status_register_write_disabled, Flash),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_m25p80 = {
     .name = "m25p80",
     .version_id = 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m25p80 = {
     .subsections = (const VMStateDescription * []) {
         &vmstate_m25p80_data_read_loop,
         &vmstate_m25p80_aai_enable,
+        &vmstate_m25p80_write_protect,
         NULL
     }
 };
-- 
2.35.3

From: Iris Chen <irischenlj@fb.com>

Signed-off-by: Iris Chen <irischenlj@fb.com>
Message-Id: <20220624183016.2125264-1-irischenlj@fb.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 tests/qtest/aspeed_smc-test.c | 62 +++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/tests/qtest/aspeed_smc-test.c b/tests/qtest/aspeed_smc-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/aspeed_smc-test.c
+++ b/tests/qtest/aspeed_smc-test.c
@@ -XXX,XX +XXX,XX @@ enum {
     BULK_ERASE = 0xc7,
     READ = 0x03,
     PP = 0x02,
+    WRSR = 0x1,
     WREN = 0x6,
+    SRWD = 0x80,
     RESET_ENABLE = 0x66,
     RESET_MEMORY = 0x99,
     EN_4BYTE_ADDR = 0xB7,
@@ -XXX,XX +XXX,XX @@ static void test_read_status_reg(void)
     flash_reset();
 }
 
+static void test_status_reg_write_protection(void)
+{
+    uint8_t r;
+
+    spi_conf(CONF_ENABLE_W0);
+
+    /* default case: WP# is high and SRWD is low -> status register writable */
+    spi_ctrl_start_user();
+    writeb(ASPEED_FLASH_BASE, WREN);
+    /* test ability to write SRWD */
+    writeb(ASPEED_FLASH_BASE, WRSR);
+    writeb(ASPEED_FLASH_BASE, SRWD);
+    writeb(ASPEED_FLASH_BASE, RDSR);
+    r = readb(ASPEED_FLASH_BASE);
+    spi_ctrl_stop_user();
+    g_assert_cmphex(r & SRWD, ==, SRWD);
+
+    /* WP# high and SRWD high -> status register writable */
+    spi_ctrl_start_user();
+    writeb(ASPEED_FLASH_BASE, WREN);
+    /* test ability to write SRWD */
+    writeb(ASPEED_FLASH_BASE, WRSR);
+    writeb(ASPEED_FLASH_BASE, 0);
+    writeb(ASPEED_FLASH_BASE, RDSR);
+    r = readb(ASPEED_FLASH_BASE);
+    spi_ctrl_stop_user();
+    g_assert_cmphex(r & SRWD, ==, 0);
+
+    /* WP# low and SRWD low -> status register writable */
+    qtest_set_irq_in(global_qtest,
+                     "/machine/soc/fmc/ssi.0/child[0]", "WP#", 0, 0);
+    spi_ctrl_start_user();
+    writeb(ASPEED_FLASH_BASE, WREN);
+    /* test ability to write SRWD */
+    writeb(ASPEED_FLASH_BASE, WRSR);
+    writeb(ASPEED_FLASH_BASE, SRWD);
+    writeb(ASPEED_FLASH_BASE, RDSR);
+    r = readb(ASPEED_FLASH_BASE);
+    spi_ctrl_stop_user();
+    g_assert_cmphex(r & SRWD, ==, SRWD);
+
+    /* WP# low and SRWD high -> status register NOT writable */
+    spi_ctrl_start_user();
+    writeb(ASPEED_FLASH_BASE, WREN);
+    /* test ability to write SRWD */
+    writeb(ASPEED_FLASH_BASE, WRSR);
+    writeb(ASPEED_FLASH_BASE, 0);
+    writeb(ASPEED_FLASH_BASE, RDSR);
+    r = readb(ASPEED_FLASH_BASE);
+    spi_ctrl_stop_user();
+    /* write is not successful */
+    g_assert_cmphex(r & SRWD, ==, SRWD);
+
+    qtest_set_irq_in(global_qtest,
+                     "/machine/soc/fmc/ssi.0/child[0]", "WP#", 0, 1);
+    flash_reset();
+}
+
 static char tmp_path[] = "/tmp/qtest.m25p80.XXXXXX";
 
 int main(int argc, char **argv)
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     qtest_add_func("/ast2400/smc/read_page_mem", test_read_page_mem);
     qtest_add_func("/ast2400/smc/write_page_mem", test_write_page_mem);
     qtest_add_func("/ast2400/smc/read_status_reg", test_read_status_reg);
+    qtest_add_func("/ast2400/smc/status_reg_write_protection",
+                   test_status_reg_write_protection);
 
     flash_reset();
     ret = g_test_run();
-- 
2.35.3

Currently, the Aspeed machines allocate a ram container region in
which the machine ram region is mapped. See commit ad1a9782186d
("aspeed: add a RAM memory region container"). An extra region is
mapped after ram in the ram container to catch invalid access done by
FW. That's how FW determines the size of ram. See commit ebe31c0a8ef7
("aspeed: add a max_ram_size property to the memory controller").

Let's move all the logic under the SoC where it should be. It will
also ease the work on multi SoC support.

Reviewed-by: Peter Delevoryas <pdel@fb.com>
Message-Id: <20220623202123.3972977-1-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  2 ++
 hw/arm/aspeed.c             | 39 ++---------------------------
 hw/arm/aspeed_ast2600.c     |  7 ++++--
 hw/arm/aspeed_soc.c         | 49 +++++++++++++++++++++++++++++++++++--
 4 files changed, 56 insertions(+), 41 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
     A15MPPrivState     a7mpcore;
     ARMv7MState        armv7m;
     MemoryRegion *dram_mr;
+    MemoryRegion dram_container;
     MemoryRegion sram;
     AspeedVICState vic;
     AspeedRtcState rtc;
@@ -XXX,XX +XXX,XX @@ enum {
 
 qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
 void aspeed_soc_uart_init(AspeedSoCState *s);
+bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
 
 #endif /* ASPEED_SOC_H */
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ struct AspeedMachineState {
 #define BLETCHLEY_BMC_HW_STRAP1 AST2600_EVB_HW_STRAP1
 #define BLETCHLEY_BMC_HW_STRAP2 AST2600_EVB_HW_STRAP2
 
-/*
- * The max ram region is for firmwares that scan the address space
- * with load/store to guess how much RAM the SoC has.
- */
-static uint64_t max_ram_read(void *opaque, hwaddr offset, unsigned size)
-{
-    return 0;
-}
-
-static void max_ram_write(void *opaque, hwaddr offset, uint64_t value,
-                           unsigned size)
-{
-    /* Discard writes */
-}
-
-static const MemoryRegionOps max_ram_ops = {
-    .read = max_ram_read,
-    .write = max_ram_write,
-    .endianness = DEVICE_NATIVE_ENDIAN,
-};
-
 #define AST_SMP_MAILBOX_BASE            0x1e6e2180
 #define AST_SMP_MBOX_FIELD_ENTRY        (AST_SMP_MAILBOX_BASE + 0x0)
 #define AST_SMP_MBOX_FIELD_GOSIGN       (AST_SMP_MAILBOX_BASE + 0x4)
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
     AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(machine);
     AspeedSoCClass *sc;
     DriveInfo *drive0 = drive_get(IF_MTD, 0, 0);
-    ram_addr_t max_ram_size;
     int i;
     NICInfo *nd = &nd_table[0];
 
-    memory_region_init(&bmc->ram_container, NULL, "aspeed-ram-container",
-                       4 * GiB);
-    memory_region_add_subregion(&bmc->ram_container, 0, machine->ram);
-
     object_initialize_child(OBJECT(machine), "soc", &bmc->soc, amc->soc_name);
 
     sc = ASPEED_SOC_GET_CLASS(&bmc->soc);
 
     /*
-     * This will error out if isize is not supported by memory controller.
+     * This will error out if the RAM size is not supported by the
+     * memory controller of the SoC.
      */
     object_property_set_uint(OBJECT(&bmc->soc), "ram-size", machine->ram_size,
                              &error_fatal);
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
                          amc->uart_default);
     qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
 
-    memory_region_add_subregion(get_system_memory(),
-                                sc->memmap[ASPEED_DEV_SDRAM],
-                                &bmc->ram_container);
-
-    max_ram_size = object_property_get_uint(OBJECT(&bmc->soc), "max-ram-size",
-                                            &error_abort);
-    memory_region_init_io(&bmc->max_ram, NULL, &max_ram_ops, NULL,
-                          "max_ram", max_ram_size  - machine->ram_size);
-    memory_region_add_subregion(&bmc->ram_container, machine->ram_size, &bmc->max_ram);
-
     aspeed_board_init_flashes(&bmc->soc.fmc,
                               bmc->fmc_model ? bmc->fmc_model : amc->fmc_model,
                               amc->num_cs, 0);
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
     object_initialize_child(obj, "sdmc", &s->sdmc, typename);
     object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
                               "ram-size");
-    object_property_add_alias(obj, "max-ram-size", OBJECT(&s->sdmc),
-                              "max-ram-size");
 
     for (i = 0; i < sc->wdts_num; i++) {
         snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
                         sc->memmap[ASPEED_DEV_WDT] + i * awc->offset);
     }
 
+    /* RAM */
+    if (!aspeed_soc_dram_init(s, errp)) {
+        return;
+    }
+
     /* Net */
     for (i = 0; i < sc->macs_num; i++) {
         object_property_set_bool(OBJECT(&s->ftgmac100[i]), "aspeed", true,
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "hw/misc/unimp.h"
 #include "hw/arm/aspeed_soc.h"
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     object_initialize_child(obj, "sdmc", &s->sdmc, typename);
     object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
                               "ram-size");
-    object_property_add_alias(obj, "max-ram-size", OBJECT(&s->sdmc),
-                              "max-ram-size");
 
     for (i = 0; i < sc->wdts_num; i++) {
         snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
                         sc->memmap[ASPEED_DEV_WDT] + i * awc->offset);
     }
 
+    /* RAM  */
+    if (!aspeed_soc_dram_init(s, errp)) {
+        return;
+    }
+
     /* Net */
     for (i = 0; i < sc->macs_num; i++) {
         object_property_set_bool(OBJECT(&s->ftgmac100[i]), "aspeed", true,
@@ -XXX,XX +XXX,XX @@ void aspeed_soc_uart_init(AspeedSoCState *s)
                        serial_hd(i), DEVICE_LITTLE_ENDIAN);
     }
 }
+
+/*
+ * SDMC should be realized first to get correct RAM size and max size
+ * values
+ */
+bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp)
+{
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    ram_addr_t ram_size, max_ram_size;
+
+    ram_size = object_property_get_uint(OBJECT(&s->sdmc), "ram-size",
+                                        &error_abort);
+    max_ram_size = object_property_get_uint(OBJECT(&s->sdmc), "max-ram-size",
+                                            &error_abort);
+
+    memory_region_init(&s->dram_container, OBJECT(s), "ram-container",
+                       max_ram_size);
+    memory_region_add_subregion(&s->dram_container, 0, s->dram_mr);
+
+    /*
+     * Add a memory region beyond the RAM region to let firmwares scan
+     * the address space with load/store and guess how much RAM the
+     * SoC has.
+     */
+    if (ram_size < max_ram_size) {
+        DeviceState *dev = qdev_new(TYPE_UNIMPLEMENTED_DEVICE);
+
+        qdev_prop_set_string(dev, "name", "ram-empty");
+        qdev_prop_set_uint64(dev, "size", max_ram_size  - ram_size);
+        if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), errp)) {
+            return false;
+        }
+
+        memory_region_add_subregion_overlap(&s->dram_container, ram_size,
+                      sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0), -1000);
+    }
+
+    memory_region_add_subregion(get_system_memory(),
+                      sc->memmap[ASPEED_DEV_SDRAM], &s->dram_container);
+    return true;
+}
-- 
2.35.3

Reviewed-by: Peter Delevoryas <pdel@fb.com>
Message-Id: <20220628154740.1117349-2-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/misc/aspeed_scu.c | 2 ++
 hw/misc/trace-events | 1 +
 2 files changed, 3 insertions(+)

diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_scu_read(void *opaque, hwaddr offset, unsigned size)
         break;
     }
 
+    trace_aspeed_scu_read(offset, size, s->regs[reg]);
     return s->regs[reg];
 }
 
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_ast2600_scu_read(void *opaque, hwaddr offset,
         break;
     }
 
+    trace_aspeed_scu_read(offset, size, s->regs[reg]);
     return s->regs[reg];
 }
 
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ slavio_led_mem_readw(uint32_t ret) "Read diagnostic LED 0x%04x"
 
 # aspeed_scu.c
 aspeed_scu_write(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
+aspeed_scu_read(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
 
 # mps2-scc.c
 mps2_scc_read(uint64_t offset, uint64_t data, unsigned size) "MPS2 SCC read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
-- 
2.35.3

Using a 'stop' string seems more appropriate than 'normal'.

Reviewed-by: Peter Delevoryas <pdel@fb.com>
Message-Id: <20220628154740.1117349-3-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/i2c/aspeed_i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
                ARRAY_FIELD_EX32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH) ?
                                                "slave-match|" : "",
                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, NORMAL_STOP) ?
-                                               "normal|" : "",
+                                               "stop|" : "",
                SHARED_ARRAY_FIELD_EX32(bus->regs, reg_intr_sts, ABNORMAL) ?
                                                "abnormal"  : "");
 
-- 
2.35.3

From: Joel Stanley <joel@jms.id.au>

While the HMAC mode is not modelled, the accumulative mode is.

Accumulative mode is enabled by setting one of the bits in the HMAC
engine command mode part of the register, so fix the unimplemented check
to only look at the upper of the two bits.

Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220627100816.125956-1-joel@jms.id.au>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/misc/aspeed_hace.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_hace_write(void *opaque, hwaddr addr, uint64_t data,
         int algo;
         data &= ahc->hash_mask;
 
-        if ((data & HASH_HMAC_MASK)) {
+        if ((data & HASH_DIGEST_HMAC)) {
             qemu_log_mask(LOG_UNIMP,
-                          "%s: HMAC engine command mode %"PRIx64" not implemented\n",
-                          __func__, (data & HASH_HMAC_MASK) >> 8);
+                          "%s: HMAC mode not implemented\n",
+                          __func__);
         }
         if (data & BIT(1)) {
             qemu_log_mask(LOG_UNIMP,
-- 
2.35.3

Coverity warns that "ssi_transfer(s->spi, 0U) << 8 * i" might overflow
because the expression is evaluated using 32-bit arithmetic and then
used in a context expecting a uint64_t.

Fixes: Coverity CID 1487244
Message-Id: <20220628165512.1133590-1-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/ssi/aspeed_smc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
     switch (aspeed_smc_flash_mode(fl)) {
     case CTRL_USERMODE:
         for (i = 0; i < size; i++) {
-            ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
+            ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
         }
         break;
     case CTRL_READMODE:
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
         aspeed_smc_flash_setup(fl, addr);
 
         for (i = 0; i < size; i++) {
-            ret |= ssi_transfer(s->spi, 0x0) << (8 * i);
+            ret |= (uint64_t) ssi_transfer(s->spi, 0x0) << (8 * i);
         }
 
         aspeed_smc_flash_unselect(fl);
-- 
2.35.3

From: Peter Delevoryas <pdel@fb.com>

Signed-off-by: Peter Delevoryas <pdel@fb.com>
Message-Id: <20220624003701.1363500-2-pdel@fb.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed_ast2600.c | 2 ++
 hw/arm/aspeed_soc.c     | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
 
         object_property_set_int(OBJECT(&s->cpu[i]), "cntfrq", 1125000000,
                                 &error_abort);
+        object_property_set_link(OBJECT(&s->cpu[i]), "memory",
+                                 OBJECT(get_system_memory()), &error_abort);
 
         if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
             return;
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
 
     /* CPU */
     for (i = 0; i < sc->num_cpus; i++) {
+        object_property_set_link(OBJECT(&s->cpu[i]), "memory",
+                                 OBJECT(get_system_memory()), &error_abort);
         if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
             return;
         }
-- 
2.35.3

From: Peter Delevoryas <pdel@fb.com>

Multi-SoC machines can use this property to specify a memory container
for each SoC. Single SoC machines will just specify get_system_memory().

Signed-off-by: Peter Delevoryas <pdel@fb.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220624003701.1363500-3-pdel@fb.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  1 +
 hw/arm/aspeed.c             |  4 ++++
 hw/arm/aspeed_ast10x0.c     |  5 ++---
 hw/arm/aspeed_ast2600.c     |  4 ++--
 hw/arm/aspeed_soc.c         | 12 +++++++-----
 5 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
     ARMCPU cpu[ASPEED_CPUS_NUM];
     A15MPPrivState     a7mpcore;
     ARMv7MState        armv7m;
+    MemoryRegion *memory;
     MemoryRegion *dram_mr;
     MemoryRegion dram_container;
     MemoryRegion sram;
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
                             &error_abort);
     object_property_set_int(OBJECT(&bmc->soc), "hw-strap2", amc->hw_strap2,
                             &error_abort);
+    object_property_set_link(OBJECT(&bmc->soc), "memory",
+                             OBJECT(get_system_memory()), &error_abort);
     object_property_set_link(OBJECT(&bmc->soc), "dram",
                              OBJECT(machine->ram), &error_abort);
     if (machine->kernel_filename) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_minibmc_machine_init(MachineState *machine)
     object_initialize_child(OBJECT(machine), "soc", &bmc->soc, amc->soc_name);
     qdev_connect_clock_in(DEVICE(&bmc->soc), "sysclk", sysclk);
 
+    object_property_set_link(OBJECT(&bmc->soc), "memory",
+                             OBJECT(get_system_memory()), &error_abort);
     qdev_prop_set_uint32(DEVICE(&bmc->soc), "uart-default",
                          amc->uart_default);
     qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
 {
     AspeedSoCState *s = ASPEED_SOC(dev_soc);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-    MemoryRegion *system_memory = get_system_memory();
     DeviceState *armv7m;
     Error *err = NULL;
     int i;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     qdev_prop_set_string(armv7m, "cpu-type", sc->cpu_type);
     qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
     object_property_set_link(OBJECT(&s->armv7m), "memory",
-                             OBJECT(system_memory), &error_abort);
+                             OBJECT(s->memory), &error_abort);
     sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), &error_abort);
 
     /* Internal SRAM */
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    memory_region_add_subregion(system_memory,
+    memory_region_add_subregion(s->memory,
                                 sc->memmap[ASPEED_DEV_SRAM],
                                 &s->sram);
 
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         object_property_set_int(OBJECT(&s->cpu[i]), "cntfrq", 1125000000,
                                 &error_abort);
         object_property_set_link(OBJECT(&s->cpu[i]), "memory",
-                                 OBJECT(get_system_memory()), &error_abort);
+                                 OBJECT(s->memory), &error_abort);
 
         if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
             return;
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    memory_region_add_subregion(get_system_memory(),
+    memory_region_add_subregion(s->memory,
                                 sc->memmap[ASPEED_DEV_SRAM], &s->sram);
 
     /* DPMCU */
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     /* CPU */
     for (i = 0; i < sc->num_cpus; i++) {
         object_property_set_link(OBJECT(&s->cpu[i]), "memory",
-                                 OBJECT(get_system_memory()), &error_abort);
+                                 OBJECT(s->memory), &error_abort);
         if (!qdev_realize(DEVICE(&s->cpu[i]), NULL, errp)) {
             return;
         }
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    memory_region_add_subregion(get_system_memory(),
+    memory_region_add_subregion(s->memory,
                                 sc->memmap[ASPEED_DEV_SRAM], &s->sram);
 
     /* SCU */
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
 }
 static Property aspeed_soc_properties[] = {
+    DEFINE_PROP_LINK("memory", AspeedSoCState, memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
     DEFINE_PROP_LINK("dram", AspeedSoCState, dram_mr, TYPE_MEMORY_REGION,
                      MemoryRegion *),
     DEFINE_PROP_UINT32("uart-default", AspeedSoCState, uart_default,
@@ -XXX,XX +XXX,XX @@ void aspeed_soc_uart_init(AspeedSoCState *s)
     int i, uart;
 
     /* Attach an 8250 to the IO space as our UART */
-    serial_mm_init(get_system_memory(), sc->memmap[s->uart_default], 2,
+    serial_mm_init(s->memory, sc->memmap[s->uart_default], 2,
                    aspeed_soc_get_irq(s, s->uart_default), 38400,
                    serial_hd(0), DEVICE_LITTLE_ENDIAN);
     for (i = 1, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
         if (uart == s->uart_default) {
             uart++;
         }
-        serial_mm_init(get_system_memory(), sc->memmap[uart], 2,
+        serial_mm_init(s->memory, sc->memmap[uart], 2,
                        aspeed_soc_get_irq(s, uart), 38400,
                        serial_hd(i), DEVICE_LITTLE_ENDIAN);
     }
@@ -XXX,XX +XXX,XX @@ bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp)
                       sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0), -1000);
     }
 
-    memory_region_add_subregion(get_system_memory(),
+    memory_region_add_subregion(s->memory,
                       sc->memmap[ASPEED_DEV_SDRAM], &s->dram_container);
     return true;
 }
-- 
2.35.3

From: Peter Delevoryas <pdel@fb.com>

sysbus_mmio_map maps devices into "get_system_memory()".

With the new SoC memory attribute, we want to make sure that each device is
mapped into the SoC memory.

In single SoC machines, the SoC memory is the same as "get_system_memory()",
but in multi SoC machines it will be different.

Signed-off-by: Peter Delevoryas <pdel@fb.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220624003701.1363500-4-pdel@fb.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  1 +
 hw/arm/aspeed_ast10x0.c     | 25 +++++++++---------
 hw/arm/aspeed_ast2600.c     | 51 ++++++++++++++++++++-----------------
 hw/arm/aspeed_soc.c         | 47 ++++++++++++++++++++--------------
 4 files changed, 69 insertions(+), 55 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ enum {
 qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
 void aspeed_soc_uart_init(AspeedSoCState *s);
 bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
+void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr);
 
 #endif /* ASPEED_SOC_H */
diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
 
     /* I2C */
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i2c), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
     for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
         qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->armv7m),
                                         sc->irqmap[ASPEED_DEV_I2C] + i);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
 
     /* Connect the LPC IRQ to the GIC. It is otherwise unused. */
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->timerctrl), 0,
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->timerctrl), 0,
                     sc->memmap[ASPEED_DEV_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
         qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->adc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 1,
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 1,
                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
             return;
         }
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 0,
                         sc->memmap[ASPEED_DEV_SPI1 + i]);
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 1,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 1,
                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sbc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sbc), 0, sc->memmap[ASPEED_DEV_SBC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sbc), 0, sc->memmap[ASPEED_DEV_SBC]);
 
     /* Watch dog */
     for (i = 0; i < sc->wdts_num; i++) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
             return;
         }
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->wdt[i]), 0,
                         sc->memmap[ASPEED_DEV_WDT] + i * awc->offset);
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_DEV_GPIO]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio), 0,
+                    sc->memmap[ASPEED_DEV_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
 }
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
                             &error_abort);
 
     sysbus_realize(SYS_BUS_DEVICE(&s->a7mpcore), &error_abort);
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->a7mpcore), 0, ASPEED_A7MPCORE_ADDR);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->a7mpcore), 0, ASPEED_A7MPCORE_ADDR);
 
     for (i = 0; i < sc->num_cpus; i++) {
         SysBusDevice *sbd = SYS_BUS_DEVICE(&s->a7mpcore);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
 
     /* RTC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->rtc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_DEV_RTC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_DEV_RTC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_RTC));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->timerctrl), 0,
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->timerctrl), 0,
                     sc->memmap[ASPEED_DEV_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
         qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->adc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i2c), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
     for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
         qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore),
                                         sc->irqmap[ASPEED_DEV_I2C] + i);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 1,
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 1,
                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
             return;
         }
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 0,
                         sc->memmap[ASPEED_DEV_SPI1 + i]);
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 1,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 1,
                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
             return;
         }
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->ehci[i]), 0,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ehci[i]), 0,
                         sc->memmap[ASPEED_DEV_EHCI1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_DEV_EHCI1 + i));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, sc->memmap[ASPEED_DEV_SDMC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdmc), 0,
+                    sc->memmap[ASPEED_DEV_SDMC]);
 
     /* Watch dog */
     for (i = 0; i < sc->wdts_num; i++) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
             return;
         }
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->wdt[i]), 0,
                         sc->memmap[ASPEED_DEV_WDT] + i * awc->offset);
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ftgmac100[i]), errp)) {
             return;
         }
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                         sc->memmap[ASPEED_DEV_ETH1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_DEV_ETH1 + i));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
             return;
         }
 
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->mii[i]), 0,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->mii[i]), 0,
                         sc->memmap[ASPEED_DEV_MII1 + i]);
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->xdma), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->xdma), 0,
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->xdma), 0,
                     sc->memmap[ASPEED_DEV_XDMA]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_XDMA));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_DEV_GPIO]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_DEV_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio_1_8v), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
                     sc->memmap[ASPEED_DEV_GPIO_1_8V]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO_1_8V));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdhci), 0,
                     sc->memmap[ASPEED_DEV_SDHCI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_SDHCI));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->emmc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->emmc), 0, sc->memmap[ASPEED_DEV_EMMC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->emmc), 0,
+                    sc->memmap[ASPEED_DEV_EMMC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->emmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_EMMC));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
 
     /* Connect the LPC IRQ to the GIC. It is otherwise unused. */
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->hace), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->hace), 0, sc->memmap[ASPEED_DEV_HACE]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->hace), 0,
+                    sc->memmap[ASPEED_DEV_HACE]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i3c), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i3c), 0, sc->memmap[ASPEED_DEV_I3C]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i3c), 0, sc->memmap[ASPEED_DEV_I3C]);
     for (i = 0; i < ASPEED_I3C_NR_DEVICES; i++) {
         qemu_irq irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore),
                                         sc->irqmap[ASPEED_DEV_I3C] + i);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sbc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sbc), 0, sc->memmap[ASPEED_DEV_SBC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sbc), 0, sc->memmap[ASPEED_DEV_SBC]);
 }
 
 static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
 
     /* VIC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->vic), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->vic), 0, sc->memmap[ASPEED_DEV_VIC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->vic), 0, sc->memmap[ASPEED_DEV_VIC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->vic), 0,
                        qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ));
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->vic), 1,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->rtc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_DEV_RTC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_DEV_RTC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_RTC));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->timerctrl), 0,
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->timerctrl), 0,
                     sc->memmap[ASPEED_DEV_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
         qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->adc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i2c), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_I2C));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->fmc), 1,
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 1,
                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
             return;
         }
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 0,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 0,
                         sc->memmap[ASPEED_DEV_SPI1 + i]);
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->spi[i]), 1,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 1,
                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
             return;
         }
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->ehci[i]), 0,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ehci[i]), 0,
                         sc->memmap[ASPEED_DEV_EHCI1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_DEV_EHCI1 + i));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, sc->memmap[ASPEED_DEV_SDMC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdmc), 0,
+                    sc->memmap[ASPEED_DEV_SDMC]);
 
     /* Watch dog */
     for (i = 0; i < sc->wdts_num; i++) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
             return;
         }
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->wdt[i]), 0,
                         sc->memmap[ASPEED_DEV_WDT] + i * awc->offset);
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ftgmac100[i]), errp)) {
             return;
         }
-        sysbus_mmio_map(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                         sc->memmap[ASPEED_DEV_ETH1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_DEV_ETH1 + i));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->xdma), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->xdma), 0,
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->xdma), 0,
                     sc->memmap[ASPEED_DEV_XDMA]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_XDMA));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->memmap[ASPEED_DEV_GPIO]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio), 0,
+                    sc->memmap[ASPEED_DEV_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdhci), 0,
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdhci), 0,
                     sc->memmap[ASPEED_DEV_SDHCI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_SDHCI));
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
 
     /* Connect the LPC IRQ to the VIC */
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->hace), errp)) {
         return;
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->hace), 0, sc->memmap[ASPEED_DEV_HACE]);
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->hace), 0,
+                    sc->memmap[ASPEED_DEV_HACE]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
 }
@@ -XXX,XX +XXX,XX @@ bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp)
                       sc->memmap[ASPEED_DEV_SDRAM], &s->dram_container);
     return true;
 }
+
+void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr)
+{
+    memory_region_add_subregion(s->memory, addr,
+                                sysbus_mmio_get_region(dev, n));
+}
-- 
2.35.3

From: Peter Delevoryas <pdel@fb.com>

Signed-off-by: Peter Delevoryas <pdel@fb.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220624003701.1363500-5-pdel@fb.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  9 +++++++++
 hw/arm/aspeed_ast10x0.c     | 16 ++++++++++------
 hw/arm/aspeed_ast2600.c     | 27 ++++++++++++++++++---------
 hw/arm/aspeed_soc.c         | 23 +++++++++++++++++++----
 4 files changed, 56 insertions(+), 19 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/usb/hcd-ehci.h"
 #include "qom/object.h"
 #include "hw/misc/aspeed_lpc.h"
+#include "hw/misc/unimp.h"
 
 #define ASPEED_SPIS_NUM  2
 #define ASPEED_EHCIS_NUM 2
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
     AspeedSMCState spi[ASPEED_SPIS_NUM];
     EHCISysBusState ehci[ASPEED_EHCIS_NUM];
     AspeedSBCState sbc;
+    UnimplementedDeviceState sbc_unimplemented;
     AspeedSDMCState sdmc;
     AspeedWDTState wdt[ASPEED_WDTS_NUM];
     FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
     AspeedLPCState lpc;
     uint32_t uart_default;
     Clock *sysclk;
+    UnimplementedDeviceState iomem;
+    UnimplementedDeviceState video;
+    UnimplementedDeviceState emmc_boot_controller;
+    UnimplementedDeviceState dpmcu;
 };
 
 #define TYPE_ASPEED_SOC "aspeed-soc"
@@ -XXX,XX +XXX,XX @@ qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
 void aspeed_soc_uart_init(AspeedSoCState *s);
 bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
 void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr);
+void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
+                                   const char *name, hwaddr addr,
+                                   uint64_t size);
 
 #endif /* ASPEED_SOC_H */
diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_init(Object *obj)
 
     snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
     object_initialize_child(obj, "gpio", &s->gpio, typename);
+
+    object_initialize_child(obj, "iomem", &s->iomem, TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "sbc-unimplemented", &s->sbc_unimplemented,
+                            TYPE_UNIMPLEMENTED_DEVICE);
 }
 
 static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     }
 
     /* General I/O memory space to catch all unimplemented device */
-    create_unimplemented_device("aspeed.sbc",
-                                sc->memmap[ASPEED_DEV_SBC],
-                                0x40000);
-    create_unimplemented_device("aspeed.io",
-                                sc->memmap[ASPEED_DEV_IOMEM],
-                                ASPEED_SOC_IOMEM_SIZE);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
+                                  sc->memmap[ASPEED_DEV_IOMEM],
+                                  ASPEED_SOC_IOMEM_SIZE);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->sbc_unimplemented),
+                                  "aspeed.sbc", sc->memmap[ASPEED_DEV_SBC],
+                                  0x40000);
 
     /* AST1030 CPU Core */
     armv7m = DEVICE(&s->armv7m);
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
     object_initialize_child(obj, "i3c", &s->i3c, TYPE_ASPEED_I3C);
 
     object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_SBC);
+
+    object_initialize_child(obj, "iomem", &s->iomem, TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "video", &s->video, TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "dpmcu", &s->dpmcu, TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "emmc-boot-controller",
+                            &s->emmc_boot_controller,
+                            TYPE_UNIMPLEMENTED_DEVICE);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     qemu_irq irq;
 
     /* IO space */
-    create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_DEV_IOMEM],
-                                ASPEED_SOC_IOMEM_SIZE);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
+                                  sc->memmap[ASPEED_DEV_IOMEM],
+                                  ASPEED_SOC_IOMEM_SIZE);
 
     /* Video engine stub */
-    create_unimplemented_device("aspeed.video", sc->memmap[ASPEED_DEV_VIDEO],
-                                0x1000);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->video), "aspeed.video",
+                                  sc->memmap[ASPEED_DEV_VIDEO], 0x1000);
 
     /* eMMC Boot Controller stub */
-    create_unimplemented_device("aspeed.emmc-boot-controller",
-                                sc->memmap[ASPEED_DEV_EMMC_BC],
-                                0x1000);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->emmc_boot_controller),
+                                  "aspeed.emmc-boot-controller",
+                                  sc->memmap[ASPEED_DEV_EMMC_BC], 0x1000);
 
     /* CPU */
     for (i = 0; i < sc->num_cpus; i++) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
                                 sc->memmap[ASPEED_DEV_SRAM], &s->sram);
 
     /* DPMCU */
-    create_unimplemented_device("aspeed.dpmcu", sc->memmap[ASPEED_DEV_DPMCU],
-                                ASPEED_SOC_DPMCU_SIZE);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->dpmcu), "aspeed.dpmcu",
+                                  sc->memmap[ASPEED_DEV_DPMCU],
+                                  ASPEED_SOC_DPMCU_SIZE);
 
     /* SCU */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
 
     snprintf(typename, sizeof(typename), "aspeed.hace-%s", socname);
     object_initialize_child(obj, "hace", &s->hace, typename);
+
+    object_initialize_child(obj, "iomem", &s->iomem, TYPE_UNIMPLEMENTED_DEVICE);
+    object_initialize_child(obj, "video", &s->video, TYPE_UNIMPLEMENTED_DEVICE);
 }
 
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     Error *err = NULL;
 
     /* IO space */
-    create_unimplemented_device("aspeed_soc.io", sc->memmap[ASPEED_DEV_IOMEM],
-                                ASPEED_SOC_IOMEM_SIZE);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
+                                  sc->memmap[ASPEED_DEV_IOMEM],
+                                  ASPEED_SOC_IOMEM_SIZE);
 
     /* Video engine stub */
-    create_unimplemented_device("aspeed.video", sc->memmap[ASPEED_DEV_VIDEO],
-                                0x1000);
+    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->video), "aspeed.video",
+                                  sc->memmap[ASPEED_DEV_VIDEO], 0x1000);
 
     /* CPU */
     for (i = 0; i < sc->num_cpus; i++) {
@@ -XXX,XX +XXX,XX @@ void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr)
     memory_region_add_subregion(s->memory, addr,
                                 sysbus_mmio_get_region(dev, n));
 }
+
+void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
+                                   const char *name, hwaddr addr, uint64_t size)
+{
+    qdev_prop_set_string(DEVICE(dev), "name", name);
+    qdev_prop_set_uint64(DEVICE(dev), "size", size);
+    sysbus_realize(dev, &error_abort);
+
+    memory_region_add_subregion_overlap(s->memory, addr,
+                                        sysbus_mmio_get_region(dev, 0), -1000);
+}
-- 
2.35.3

From: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>

Add qcom-dc-scm-v1 board support.

Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220627154703.148943-2-quic_jaehyoo@quicinc.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ struct AspeedMachineState {
 #define BLETCHLEY_BMC_HW_STRAP1 AST2600_EVB_HW_STRAP1
 #define BLETCHLEY_BMC_HW_STRAP2 AST2600_EVB_HW_STRAP2
 
+/* Qualcomm DC-SCM hardware value */
+#define QCOM_DC_SCM_V1_BMC_HW_STRAP1  0x00000000
+#define QCOM_DC_SCM_V1_BMC_HW_STRAP2  0x00000041
+
 #define AST_SMP_MAILBOX_BASE            0x1e6e2180
 #define AST_SMP_MBOX_FIELD_ENTRY        (AST_SMP_MAILBOX_BASE + 0x0)
 #define AST_SMP_MBOX_FIELD_GOSIGN       (AST_SMP_MAILBOX_BASE + 0x4)
@@ -XXX,XX +XXX,XX @@ static void fby35_i2c_init(AspeedMachineState *bmc)
      */
 }
 
+static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
+}
+
 static bool aspeed_get_mmio_exec(Object *obj, Error **errp)
 {
     return ASPEED_MACHINE(obj)->mmio_exec;
@@ -XXX,XX +XXX,XX @@ static void aspeed_minibmc_machine_ast1030_evb_class_init(ObjectClass *oc,
     amc->macs_mask = 0;
 }
 
+static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
+                                                     void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Qualcomm DC-SCM V1 BMC (Cortex A7)";
+    amc->soc_name  = "ast2600-a3";
+    amc->hw_strap1 = QCOM_DC_SCM_V1_BMC_HW_STRAP1;
+    amc->hw_strap2 = QCOM_DC_SCM_V1_BMC_HW_STRAP2;
+    amc->fmc_model = "n25q512a";
+    amc->spi_model = "n25q512a";
+    amc->num_cs    = 2;
+    amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
+    amc->i2c_init  = qcom_dc_scm_bmc_i2c_init;
+    mc->default_ram_size = 1 * GiB;
+    mc->default_cpus = mc->min_cpus = mc->max_cpus =
+        aspeed_soc_num_cpus(amc->soc_name);
+};
+
 static const TypeInfo aspeed_machine_types[] = {
     {
         .name          = MACHINE_TYPE_NAME("palmetto-bmc"),
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
         .name          = MACHINE_TYPE_NAME("g220a-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_g220a_class_init,
+    }, {
+        .name          = MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_qcom_dc_scm_v1_class_init,
     }, {
         .name          = MACHINE_TYPE_NAME("fp5280g2-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
-- 
2.35.3

From: Graeme Gregory <quic_ggregory@quicinc.com>

Add base for Qualcomm Firework BMC machine.

Signed-off-by: Graeme Gregory <quic_ggregory@quicinc.com>
Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220627154703.148943-3-quic_jaehyoo@quicinc.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
 }
 
+static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    /* Create the generic DC-SCM hardware */
+    qcom_dc_scm_bmc_i2c_init(bmc);
+
+    /* Now create the Firework specific hardware */
+}
+
 static bool aspeed_get_mmio_exec(Object *obj, Error **errp)
 {
     return ASPEED_MACHINE(obj)->mmio_exec;
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
         aspeed_soc_num_cpus(amc->soc_name);
 };
 
+static void aspeed_machine_qcom_firework_class_init(ObjectClass *oc,
+                                                    void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Qualcomm DC-SCM V1/Firework BMC (Cortex A7)";
+    amc->soc_name  = "ast2600-a3";
+    amc->hw_strap1 = QCOM_DC_SCM_V1_BMC_HW_STRAP1;
+    amc->hw_strap2 = QCOM_DC_SCM_V1_BMC_HW_STRAP2;
+    amc->fmc_model = "n25q512a";
+    amc->spi_model = "n25q512a";
+    amc->num_cs    = 2;
+    amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
+    amc->i2c_init  = qcom_dc_scm_firework_i2c_init;
+    mc->default_ram_size = 1 * GiB;
+    mc->default_cpus = mc->min_cpus = mc->max_cpus =
+        aspeed_soc_num_cpus(amc->soc_name);
+};
+
 static const TypeInfo aspeed_machine_types[] = {
     {
         .name          = MACHINE_TYPE_NAME("palmetto-bmc"),
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
         .name          = MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_qcom_dc_scm_v1_class_init,
+    }, {
+        .name          = MACHINE_TYPE_NAME("qcom-firework-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_qcom_firework_class_init,
     }, {
         .name          = MACHINE_TYPE_NAME("fp5280g2-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
-- 
2.35.3

From: Maheswara Kurapati <quic_mkurapat@quicinc.com>

Current implementation of the pmbus core driver treats the read request
for page 255 as invalid request and sets the invalid command bit (bit 7)
in the STATUS_CML register. As per the PMBus specification it is a valid
request.

Refer to the PMBus specification, revision 1.3.1, section 11.10 PAGE,
on the page 58:
  "Setting the PAGE to FFh means that all subsequent comands are to be
   applied to all outputs.

Some commands, such as READ_TEMPERATURE, may use a common sensor but
   be available on all pages of a device. Such implementations are the
   decision of each device manufacturer or are specified in a PMBus
   Application Profile. Consult the manufacturer's documents or the
   Application Profile Specification as needed."

For e.g.,
The VOUT_MODE is a valid command for page 255 for maxim 31785 device.
refer to Table 1. PMBus Command Codes on page 14 in the datasheet.
https://datasheets.maximintegrated.com/en/ds/MAX31785.pdf

Fixes: 38870253f1d1 ("hw/i2c: pmbus: fix error returns and guard against out of range accesses")

Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com>
Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
Reviewed-by: Titus Rwantare <titusr@google.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220627154703.148943-4-quic_jaehyoo@quicinc.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/i2c/pmbus_device.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/hw/i2c/pmbus_device.c b/hw/i2c/pmbus_device.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/pmbus_device.c
+++ b/hw/i2c/pmbus_device.c
@@ -XXX,XX +XXX,XX @@ static uint8_t pmbus_receive_byte(SMBusDevice *smd)
 
     /*
      * Reading from all pages will return the value from page 0,
-     * this is unspecified behaviour in general.
+     * means that all subsequent commands are to be applied to all output.
      */
     if (pmdev->page == PB_ALL_PAGES) {
         index = 0;
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "%s: tried to read from all pages\n",
-                      __func__);
-        pmbus_cml_error(pmdev);
     } else if (pmdev->page > pmdev->num_pages - 1) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: page %d is out of range\n",
-- 
2.35.3

From: Maheswara Kurapati <quic_mkurapat@quicinc.com>

MAX31785 is a PMBus compliant 6-Channel fan controller. It supports 6 fan
channels, 11 temperature sensors, and 6-Channel ADC to measure the remote
voltages. Datasheet can be found here:
https://datasheets.maximintegrated.com/en/ds/MAX31785.pdf

This initial version of the driver has skeleton and support for the
fan channels. Requests for temperature sensors, and ADC Channels the
are serviced with the default values as per the datasheet.  No additional
instrumentation is done. NV Log feature is not supported.

Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com>
Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220627154703.148943-5-quic_jaehyoo@quicinc.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/sensor/max31785.c  | 573 ++++++++++++++++++++++++++++++++++++++++++
 hw/sensor/Kconfig     |   4 +
 hw/sensor/meson.build |   1 +
 3 files changed, 578 insertions(+)
 create mode 100644 hw/sensor/max31785.c

diff --git a/hw/sensor/max31785.c b/hw/sensor/max31785.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/sensor/max31785.c
@@ -XXX,XX +XXX,XX @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Maxim MAX31785 PMBus 6-Channel Fan Controller
+ *
+ * Datasheet:
+ * https://datasheets.maximintegrated.com/en/ds/MAX31785.pdf
+ *
+ * Copyright(c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/i2c/pmbus_device.h"
+#include "hw/irq.h"
+#include "migration/vmstate.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+
+#define TYPE_MAX31785 "max31785"
+#define MAX31785(obj) OBJECT_CHECK(MAX31785State, (obj), TYPE_MAX31785)
+
+/* MAX31785 mfr specific PMBus commands */
+#define MAX31785_MFR_MODE               0xD1
+#define MAX31785_MFR_PSEN_CONFIG        0xD2
+#define MAX31785_MFR_VOUT_PEAK          0xD4
+#define MAX31785_MFR_TEMPERATURE_PEAK   0xD6
+#define MAX31785_MFR_VOUT_MIN           0xD7
+#define MAX31785_MFR_FAULT_RESPONSE     0xD9
+#define MAX31785_MFR_NV_FAULT_LOG       0xDC
+#define MAX31785_MFR_TIME_COUNT         0xDD
+#define MAX31785_MFR_TEMP_SENSOR_CONFIG 0xF0
+#define MAX31785_MFR_FAN_CONFIG         0xF1
+#define MAX31785_MFR_FAN_LUT            0xF2
+#define MAX31785_MFR_READ_FAN_PWM       0xF3
+#define MAX31785_MFR_FAN_FAULT_LIMIT    0xF5
+#define MAX31785_MFR_FAN_WARN_LIMIT     0xF6
+#define MAX31785_MFR_FAN_RUN_TIME       0xF7
+#define MAX31785_MFR_FAN_PWM_AVG        0xF8
+#define MAX31785_MFR_FAN_PWM2RPM        0xF9
+
+/* defaults as per the data sheet */
+#define MAX31785_DEFAULT_CAPABILITY            0x10
+#define MAX31785_DEFAULT_VOUT_MODE             0x40
+#define MAX31785_DEFAULT_VOUT_SCALE_MONITOR    0x7FFF
+#define MAX31785_DEFAULT_FAN_COMMAND_1         0x7FFF
+#define MAX31785_DEFAULT_OV_FAULT_LIMIT        0x7FFF
+#define MAX31785_DEFAULT_OV_WARN_LIMIT         0x7FFF
+#define MAX31785_DEFAULT_OT_FAULT_LIMIT        0x7FFF
+#define MAX31785_DEFAULT_OT_WARN_LIMIT         0x7FFF
+#define MAX31785_DEFAULT_PMBUS_REVISION        0x11
+#define MAX31785_DEFAULT_MFR_ID                0x4D
+#define MAX31785_DEFAULT_MFR_MODEL             0x53
+#define MAX31785_DEFAULT_MFR_REVISION          0x3030
+#define MAX31785A_DEFAULT_MFR_REVISION         0x3040
+#define MAX31785B_DEFAULT_MFR_REVISION         0x3061
+#define MAX31785B_DEFAULT_MFR_TEMPERATURE_PEAK 0x8000
+#define MAX31785B_DEFAULT_MFR_VOUT_MIN         0x7FFF
+#define MAX31785_DEFAULT_TEXT                  0x3130313031303130
+
+/* MAX31785 pages */
+#define MAX31785_TOTAL_NUM_PAGES      23
+#define MAX31785_FAN_PAGES            6
+#define MAX31785_MIN_FAN_PAGE         0
+#define MAX31785_MAX_FAN_PAGE         5
+#define MAX31785_MIN_TEMP_PAGE        6
+#define MAX31785_MAX_TEMP_PAGE        16
+#define MAX31785_MIN_ADC_VOLTAGE_PAGE 17
+#define MAX31785_MAX_ADC_VOLTAGE_PAGE 22
+
+/* FAN_CONFIG_1_2 */
+#define MAX31785_MFR_FAN_CONFIG                0xF1
+#define MAX31785_FAN_CONFIG_ENABLE             BIT(7)
+#define MAX31785_FAN_CONFIG_RPM_PWM            BIT(6)
+#define MAX31785_FAN_CONFIG_PULSE(pulse)       (pulse << 4)
+#define MAX31785_DEFAULT_FAN_CONFIG_1_2(pulse)                                 \
+    (MAX31785_FAN_CONFIG_ENABLE | MAX31785_FAN_CONFIG_PULSE(pulse))
+#define MAX31785_DEFAULT_MFR_FAN_CONFIG        0x0000
+
+/* fan speed in RPM */
+#define MAX31785_DEFAULT_FAN_SPEED   0x7fff
+#define MAX31785_DEFAULT_FAN_STATUS  0x00
+
+#define MAX31785_DEFAULT_FAN_MAX_PWM 0x2710
+
+/*
+ * MAX31785State:
+ * @code: The command code received
+ * @page: Each page corresponds to a device monitored by the Max 31785
+ * The page register determines the available commands depending on device
+ * _____________________________________________________________________________
+ * |   0   |  Fan Connected to PWM0                                            |
+ * |_______|___________________________________________________________________|
+ * |   1   |  Fan Connected to PWM1                                            |
+ * |_______|___________________________________________________________________|
+ * |   2   |  Fan Connected to PWM2                                            |
+ * |_______|___________________________________________________________________|
+ * |   3   |  Fan Connected to PWM3                                            |
+ * |_______|___________________________________________________________________|
+ * |   4   |  Fan Connected to PWM4                                            |
+ * |_______|___________________________________________________________________|
+ * |   5   |  Fan Connected to PWM5                                            |
+ * |_______|___________________________________________________________________|
+ * |   6   |  Remote Thermal Diode Connected to ADC 0                          |
+ * |_______|___________________________________________________________________|
+ * |   7   |  Remote Thermal Diode Connected to ADC 1                          |
+ * |_______|___________________________________________________________________|
+ * |   8   |  Remote Thermal Diode Connected to ADC 2                          |
+ * |_______|___________________________________________________________________|
+ * |   9   |  Remote Thermal Diode Connected to ADC 3                          |
+ * |_______|___________________________________________________________________|
+ * |  10   |  Remote Thermal Diode Connected to ADC 4                          |
+ * |_______|___________________________________________________________________|
+ * |  11   |  Remote Thermal Diode Connected to ADC 5                          |
+ * |_______|___________________________________________________________________|
+ * |  12   |  Internal Temperature Sensor                                      |
+ * |_______|___________________________________________________________________|
+ * |  13   |  Remote I2C Temperature Sensor with Address 0                     |
+ * |_______|___________________________________________________________________|
+ * |  14   |  Remote I2C Temperature Sensor with Address 1                     |
+ * |_______|___________________________________________________________________|
+ * |  15   |  Remote I2C Temperature Sensor with Address 2                     |
+ * |_______|___________________________________________________________________|
+ * |  16   |  Remote I2C Temperature Sensor with Address 3                     |
+ * |_______|___________________________________________________________________|
+ * |  17   |  Remote I2C Temperature Sensor with Address 4                     |
+ * |_______|___________________________________________________________________|
+ * |  17   |  Remote Voltage Connected to ADC0                                 |
+ * |_______|___________________________________________________________________|
+ * |  18   |  Remote Voltage Connected to ADC1                                 |
+ * |_______|___________________________________________________________________|
+ * |  19   |  Remote Voltage Connected to ADC2                                 |
+ * |_______|___________________________________________________________________|
+ * |  20   |  Remote Voltage Connected to ADC3                                 |
+ * |_______|___________________________________________________________________|
+ * |  21   |  Remote Voltage Connected to ADC4                                 |
+ * |_______|___________________________________________________________________|
+ * |  22   |  Remote Voltage Connected to ADC5                                 |
+ * |_______|___________________________________________________________________|
+ * |23-254 |  Reserved                                                         |
+ * |_______|___________________________________________________________________|
+ * |  255  |  Applies to all pages                                             |
+ * |_______|___________________________________________________________________|
+ */
+
+/* Place holder to save the max31785 mfr specific registers */
+typedef struct MAX31785State {
+    PMBusDevice parent;
+    uint16_t mfr_mode[MAX31785_TOTAL_NUM_PAGES];
+    uint16_t vout_peak[MAX31785_TOTAL_NUM_PAGES];
+    uint16_t temperature_peak[MAX31785_TOTAL_NUM_PAGES];
+    uint16_t vout_min[MAX31785_TOTAL_NUM_PAGES];
+    uint8_t  fault_response[MAX31785_TOTAL_NUM_PAGES];
+    uint32_t time_count[MAX31785_TOTAL_NUM_PAGES];
+    uint16_t temp_sensor_config[MAX31785_TOTAL_NUM_PAGES];
+    uint16_t fan_config[MAX31785_TOTAL_NUM_PAGES];
+    uint16_t read_fan_pwm[MAX31785_TOTAL_NUM_PAGES];
+    uint16_t fan_fault_limit[MAX31785_TOTAL_NUM_PAGES];
+    uint16_t fan_warn_limit[MAX31785_TOTAL_NUM_PAGES];
+    uint16_t fan_run_time[MAX31785_TOTAL_NUM_PAGES];
+    uint16_t fan_pwm_avg[MAX31785_TOTAL_NUM_PAGES];
+    uint64_t fan_pwm2rpm[MAX31785_TOTAL_NUM_PAGES];
+    uint64_t mfr_location;
+    uint64_t mfr_date;
+    uint64_t mfr_serial;
+    uint16_t mfr_revision;
+} MAX31785State;
+
+static uint8_t max31785_read_byte(PMBusDevice *pmdev)
+{
+    MAX31785State *s = MAX31785(pmdev);
+    switch (pmdev->code) {
+
+    case PMBUS_FAN_CONFIG_1_2:
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmbus_send8(pmdev, pmdev->pages[pmdev->page].fan_config_1_2);
+        }
+        break;
+
+    case PMBUS_FAN_COMMAND_1:
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmbus_send16(pmdev, pmdev->pages[pmdev->page].fan_command_1);
+        }
+        break;
+
+    case PMBUS_READ_FAN_SPEED_1:
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmbus_send16(pmdev, pmdev->pages[pmdev->page].read_fan_speed_1);
+        }
+        break;
+
+    case PMBUS_STATUS_FANS_1_2:
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmbus_send16(pmdev, pmdev->pages[pmdev->page].status_fans_1_2);
+        }
+        break;
+
+    case PMBUS_MFR_REVISION:
+        pmbus_send16(pmdev, MAX31785_DEFAULT_MFR_REVISION);
+        break;
+
+    case PMBUS_MFR_ID:
+        pmbus_send8(pmdev, 0x4d); /* Maxim */
+        break;
+
+    case PMBUS_MFR_MODEL:
+        pmbus_send8(pmdev, 0x53);
+        break;
+
+    case PMBUS_MFR_LOCATION:
+        pmbus_send64(pmdev, s->mfr_location);
+        break;
+
+    case PMBUS_MFR_DATE:
+        pmbus_send64(pmdev, s->mfr_date);
+        break;
+
+    case PMBUS_MFR_SERIAL:
+        pmbus_send64(pmdev, s->mfr_serial);
+        break;
+
+    case MAX31785_MFR_MODE:
+        pmbus_send16(pmdev, s->mfr_mode[pmdev->page]);
+        break;
+
+    case MAX31785_MFR_VOUT_PEAK:
+        if ((pmdev->page >= MAX31785_MIN_ADC_VOLTAGE_PAGE) &&
+            (pmdev->page <= MAX31785_MAX_ADC_VOLTAGE_PAGE)) {
+            pmbus_send16(pmdev, s->vout_peak[pmdev->page]);
+        }
+        break;
+
+    case MAX31785_MFR_TEMPERATURE_PEAK:
+        if ((pmdev->page >= MAX31785_MIN_TEMP_PAGE) &&
+            (pmdev->page <= MAX31785_MAX_TEMP_PAGE)) {
+            pmbus_send16(pmdev, s->temperature_peak[pmdev->page]);
+        }
+        break;
+
+    case MAX31785_MFR_VOUT_MIN:
+        if ((pmdev->page >= MAX31785_MIN_ADC_VOLTAGE_PAGE) &&
+            (pmdev->page <= MAX31785_MAX_ADC_VOLTAGE_PAGE)) {
+            pmbus_send16(pmdev, s->vout_min[pmdev->page]);
+        }
+        break;
+
+    case MAX31785_MFR_FAULT_RESPONSE:
+        pmbus_send8(pmdev, s->fault_response[pmdev->page]);
+        break;
+
+    case MAX31785_MFR_TIME_COUNT: /* R/W 32 */
+        pmbus_send32(pmdev, s->time_count[pmdev->page]);
+        break;
+
+    case MAX31785_MFR_TEMP_SENSOR_CONFIG: /* R/W 16 */
+        if ((pmdev->page >= MAX31785_MIN_TEMP_PAGE) &&
+            (pmdev->page <= MAX31785_MAX_TEMP_PAGE)) {
+            pmbus_send16(pmdev, s->temp_sensor_config[pmdev->page]);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_CONFIG: /* R/W 16 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmbus_send16(pmdev, s->fan_config[pmdev->page]);
+        }
+        break;
+
+    case MAX31785_MFR_READ_FAN_PWM: /* R/W 16 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmbus_send16(pmdev, s->read_fan_pwm[pmdev->page]);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_FAULT_LIMIT: /* R/W 16 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmbus_send16(pmdev, s->fan_fault_limit[pmdev->page]);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_WARN_LIMIT: /* R/W 16 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmbus_send16(pmdev, s->fan_warn_limit[pmdev->page]);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_RUN_TIME: /* R/W 16 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmbus_send16(pmdev, s->fan_run_time[pmdev->page]);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_PWM_AVG: /* R/W 16 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmbus_send16(pmdev, s->fan_pwm_avg[pmdev->page]);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_PWM2RPM: /* R/W 64 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmbus_send64(pmdev, s->fan_pwm2rpm[pmdev->page]);
+        }
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+        "%s: reading from unsupported register: 0x%02x\n",
+        __func__, pmdev->code);
+        break;
+    }
+
+    return 0xFF;
+}
+
+static int max31785_write_data(PMBusDevice *pmdev, const uint8_t *buf,
+                               uint8_t len)
+{
+    MAX31785State *s = MAX31785(pmdev);
+    if (len == 0) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: writing empty data\n", __func__);
+        return -1;
+    }
+
+    pmdev->code = buf[0]; /* PMBus command code */
+
+    if (len == 1) {
+        return 0;
+    }
+
+    /* Exclude command code from buffer */
+    buf++;
+    len--;
+
+    switch (pmdev->code) {
+
+    case PMBUS_FAN_CONFIG_1_2:
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmdev->pages[pmdev->page].fan_config_1_2 = pmbus_receive8(pmdev);
+        }
+        break;
+
+    case PMBUS_FAN_COMMAND_1:
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            pmdev->pages[pmdev->page].fan_command_1 = pmbus_receive16(pmdev);
+            pmdev->pages[pmdev->page].read_fan_speed_1 =
+                ((MAX31785_DEFAULT_FAN_SPEED / MAX31785_DEFAULT_FAN_MAX_PWM) *
+                pmdev->pages[pmdev->page].fan_command_1);
+        }
+        break;
+
+    case PMBUS_MFR_LOCATION: /* R/W 64 */
+        s->mfr_location = pmbus_receive64(pmdev);
+        break;
+
+    case PMBUS_MFR_DATE: /* R/W 64 */
+        s->mfr_date = pmbus_receive64(pmdev);
+        break;
+
+    case PMBUS_MFR_SERIAL: /* R/W 64 */
+        s->mfr_serial = pmbus_receive64(pmdev);
+        break;
+
+    case MAX31785_MFR_MODE: /* R/W word */
+        s->mfr_mode[pmdev->page] = pmbus_receive16(pmdev);
+        break;
+
+    case MAX31785_MFR_VOUT_PEAK: /* R/W word */
+        if ((pmdev->page >= MAX31785_MIN_ADC_VOLTAGE_PAGE) &&
+            (pmdev->page <= MAX31785_MAX_ADC_VOLTAGE_PAGE)) {
+            s->vout_peak[pmdev->page] = pmbus_receive16(pmdev);
+        }
+        break;
+
+    case MAX31785_MFR_TEMPERATURE_PEAK: /* R/W word */
+        if ((pmdev->page >= 6) && (pmdev->page <= 16)) {
+            s->temperature_peak[pmdev->page] = pmbus_receive16(pmdev);
+        }
+        break;
+
+    case MAX31785_MFR_VOUT_MIN: /* R/W word */
+        if ((pmdev->page >= MAX31785_MIN_ADC_VOLTAGE_PAGE) &&
+            (pmdev->page <= MAX31785_MAX_ADC_VOLTAGE_PAGE)) {
+            s->vout_min[pmdev->page] = pmbus_receive16(pmdev);
+        }
+        break;
+
+    case MAX31785_MFR_FAULT_RESPONSE: /* R/W 8 */
+        s->fault_response[pmdev->page] = pmbus_receive8(pmdev);
+        break;
+
+    case MAX31785_MFR_TIME_COUNT: /* R/W 32 */
+        s->time_count[pmdev->page] = pmbus_receive32(pmdev);
+        break;
+
+    case MAX31785_MFR_TEMP_SENSOR_CONFIG: /* R/W 16 */
+        if ((pmdev->page >= MAX31785_MIN_TEMP_PAGE) &&
+            (pmdev->page <= MAX31785_MAX_TEMP_PAGE)) {
+            s->temp_sensor_config[pmdev->page] = pmbus_receive16(pmdev);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_CONFIG: /* R/W 16 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            s->fan_config[pmdev->page] = pmbus_receive16(pmdev);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_FAULT_LIMIT: /* R/W 16 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            s->fan_fault_limit[pmdev->page] = pmbus_receive16(pmdev);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_WARN_LIMIT: /* R/W 16 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            s->fan_warn_limit[pmdev->page] = pmbus_receive16(pmdev);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_RUN_TIME: /* R/W 16 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            s->fan_run_time[pmdev->page] = pmbus_receive16(pmdev);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_PWM_AVG: /* R/W 16 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            s->fan_pwm_avg[pmdev->page] = pmbus_receive16(pmdev);
+        }
+        break;
+
+    case MAX31785_MFR_FAN_PWM2RPM: /* R/W 64 */
+        if (pmdev->page <= MAX31785_MAX_FAN_PAGE) {
+            s->fan_pwm2rpm[pmdev->page] = pmbus_receive64(pmdev);
+        }
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: writing to unsupported register: 0x%02x\n",
+                      __func__, pmdev->code);
+        break;
+    }
+
+    return 0;
+}
+
+static void max31785_exit_reset(Object *obj)
+{
+    PMBusDevice *pmdev = PMBUS_DEVICE(obj);
+    MAX31785State *s = MAX31785(obj);
+
+    pmdev->capability = MAX31785_DEFAULT_CAPABILITY;
+
+    for (int i = MAX31785_MIN_FAN_PAGE; i <= MAX31785_MAX_FAN_PAGE; i++) {
+        pmdev->pages[i].vout_mode = MAX31785_DEFAULT_VOUT_MODE;
+        pmdev->pages[i].fan_command_1 = MAX31785_DEFAULT_FAN_COMMAND_1;
+        pmdev->pages[i].revision = MAX31785_DEFAULT_PMBUS_REVISION;
+        pmdev->pages[i].fan_config_1_2 = MAX31785_DEFAULT_FAN_CONFIG_1_2(0);
+        pmdev->pages[i].read_fan_speed_1 = MAX31785_DEFAULT_FAN_SPEED;
+        pmdev->pages[i].status_fans_1_2 = MAX31785_DEFAULT_FAN_STATUS;
+    }
+
+    for (int i = MAX31785_MIN_TEMP_PAGE; i <= MAX31785_MAX_TEMP_PAGE; i++) {
+        pmdev->pages[i].vout_mode = MAX31785_DEFAULT_VOUT_MODE;
+        pmdev->pages[i].revision = MAX31785_DEFAULT_PMBUS_REVISION;
+        pmdev->pages[i].ot_fault_limit = MAX31785_DEFAULT_OT_FAULT_LIMIT;
+        pmdev->pages[i].ot_warn_limit = MAX31785_DEFAULT_OT_WARN_LIMIT;
+    }
+
+    for (int i = MAX31785_MIN_ADC_VOLTAGE_PAGE;
+         i <= MAX31785_MAX_ADC_VOLTAGE_PAGE;
+         i++) {
+        pmdev->pages[i].vout_mode = MAX31785_DEFAULT_VOUT_MODE;
+        pmdev->pages[i].revision = MAX31785_DEFAULT_PMBUS_REVISION;
+        pmdev->pages[i].vout_scale_monitor =
+            MAX31785_DEFAULT_VOUT_SCALE_MONITOR;
+        pmdev->pages[i].vout_ov_fault_limit = MAX31785_DEFAULT_OV_FAULT_LIMIT;
+        pmdev->pages[i].vout_ov_warn_limit = MAX31785_DEFAULT_OV_WARN_LIMIT;
+    }
+
+    s->mfr_location = MAX31785_DEFAULT_TEXT;
+    s->mfr_date = MAX31785_DEFAULT_TEXT;
+    s->mfr_serial = MAX31785_DEFAULT_TEXT;
+}
+
+static const VMStateDescription vmstate_max31785 = {
+    .name = TYPE_MAX31785,
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]){
+        VMSTATE_PMBUS_DEVICE(parent, MAX31785State),
+        VMSTATE_UINT16_ARRAY(mfr_mode, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT16_ARRAY(vout_peak, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT16_ARRAY(temperature_peak, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT16_ARRAY(vout_min, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT8_ARRAY(fault_response, MAX31785State,
+                            MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT32_ARRAY(time_count, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT16_ARRAY(temp_sensor_config, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT16_ARRAY(fan_config, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT16_ARRAY(read_fan_pwm, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT16_ARRAY(fan_fault_limit, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT16_ARRAY(fan_warn_limit, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT16_ARRAY(fan_run_time, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT16_ARRAY(fan_pwm_avg, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT64_ARRAY(fan_pwm2rpm, MAX31785State,
+                             MAX31785_TOTAL_NUM_PAGES),
+        VMSTATE_UINT64(mfr_location, MAX31785State),
+        VMSTATE_UINT64(mfr_date, MAX31785State),
+        VMSTATE_UINT64(mfr_serial, MAX31785State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void max31785_init(Object *obj)
+{
+    PMBusDevice *pmdev = PMBUS_DEVICE(obj);
+
+    for (int i = MAX31785_MIN_FAN_PAGE; i <= MAX31785_MAX_FAN_PAGE; i++) {
+        pmbus_page_config(pmdev, i, PB_HAS_VOUT_MODE);
+    }
+
+    for (int i = MAX31785_MIN_TEMP_PAGE; i <= MAX31785_MAX_TEMP_PAGE; i++) {
+        pmbus_page_config(pmdev, i, PB_HAS_VOUT_MODE | PB_HAS_TEMPERATURE);
+    }
+
+    for (int i = MAX31785_MIN_ADC_VOLTAGE_PAGE;
+        i <= MAX31785_MAX_ADC_VOLTAGE_PAGE;
+        i++) {
+        pmbus_page_config(pmdev, i, PB_HAS_VOUT_MODE | PB_HAS_VOUT |
+                                    PB_HAS_VOUT_RATING);
+    }
+}
+
+static void max31785_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PMBusDeviceClass *k = PMBUS_DEVICE_CLASS(klass);
+    dc->desc = "Maxim MAX31785 6-Channel Fan Controller";
+    dc->vmsd = &vmstate_max31785;
+    k->write_data = max31785_write_data;
+    k->receive_byte = max31785_read_byte;
+    k->device_num_pages = MAX31785_TOTAL_NUM_PAGES;
+    rc->phases.exit = max31785_exit_reset;
+}
+
+static const TypeInfo max31785_info = {
+    .name = TYPE_MAX31785,
+    .parent = TYPE_PMBUS_DEVICE,
+    .instance_size = sizeof(MAX31785State),
+    .instance_init = max31785_init,
+    .class_init = max31785_class_init,
+};
+
+static void max31785_register_types(void)
+{
+    type_register_static(&max31785_info);
+}
+
+type_init(max31785_register_types)
diff --git a/hw/sensor/Kconfig b/hw/sensor/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/sensor/Kconfig
+++ b/hw/sensor/Kconfig
@@ -XXX,XX +XXX,XX @@ config LSM303DLHC_MAG
 config ISL_PMBUS_VR
     bool
     depends on PMBUS
+
+config MAX31785
+    bool
+    depends on PMBUS
diff --git a/hw/sensor/meson.build b/hw/sensor/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/sensor/meson.build
+++ b/hw/sensor/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ADM1272', if_true: files('adm1272.c'))
 softmmu_ss.add(when: 'CONFIG_MAX34451', if_true: files('max34451.c'))
 softmmu_ss.add(when: 'CONFIG_LSM303DLHC_MAG', if_true: files('lsm303dlhc_mag.c'))
 softmmu_ss.add(when: 'CONFIG_ISL_PMBUS_VR', if_true: files('isl_pmbus_vr.c'))
+softmmu_ss.add(when: 'CONFIG_MAX31785', if_true: files('max31785.c'))
-- 
2.35.3

From: Maheswara Kurapati <quic_mkurapat@quicinc.com>

Add MAX31785 fan controllers in machines so that the Linux driver
populates the sysfs interface.

Firework has two MAX31785 Fan controllers at 0x52, and 0x54 on bus 9.
Witherspoon has one at 0x52 on bus 3.
Rainier has one at 0x52 on bus 7.

Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com>
Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220627154703.148943-6-quic_jaehyoo@quicinc.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c | 8 ++++++--
 hw/arm/Kconfig  | 2 ++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
     LEDState *led;
 
     /* Bus 3: TODO bmp280@77 */
-    /* Bus 3: TODO max31785@52 */
     dev = DEVICE(i2c_slave_new(TYPE_PCA9552, 0x60));
     qdev_prop_set_string(dev, "description", "pca1");
     i2c_slave_realize_and_unref(I2C_SLAVE(dev),
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
                               qdev_get_gpio_in(DEVICE(led), 0));
     }
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3), "dps310", 0x76);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3), "max31785", 0x52);
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), "tmp423", 0x4c);
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5), "tmp423", 0x4c);
 
@@ -XXX,XX +XXX,XX @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
     create_pca9552(soc, 7, 0x31);
     create_pca9552(soc, 7, 0x32);
     create_pca9552(soc, 7, 0x33);
-    /* Bus 7: TODO max31785@52 */
     create_pca9552(soc, 7, 0x60);
     create_pca9552(soc, 7, 0x61);
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), "dps310", 0x76);
     /* Bus 7: TODO si7021-a20@20 */
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), TYPE_TMP105,
                      0x48);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), "max31785", 0x52);
     aspeed_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 7), 0x50, 64 * KiB);
     aspeed_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 7), 0x51, 64 * KiB);
 
@@ -XXX,XX +XXX,XX @@ static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
     qcom_dc_scm_bmc_i2c_init(bmc);
 
     /* Now create the Firework specific hardware */
+
+    /* I2C9 Fan Controller (MAX31785) */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x52);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x54);
 }
 
 static bool aspeed_get_mmio_exec(Object *obj, Error **errp)
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ASPEED_SOC
     select EMC141X
     select UNIMP
     select LED
+    select PMBUS
+    select MAX31785
 
 config MPS2
     bool
-- 
2.35.3

From: Maheswara Kurapati <quic_mkurapat@quicinc.com>

Add Thermal Diodes for Firework machine.

Signed-off-by: Maheswara Kurapati <quic_mkurapat@quicinc.com>
Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220627154703.148943-7-quic_jaehyoo@quicinc.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
 static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
+    I2CSlave *therm_mux;
 
     /* Create the generic DC-SCM hardware */
     qcom_dc_scm_bmc_i2c_init(bmc);
 
     /* Now create the Firework specific hardware */
 
+    /* I2C8 Thermal Diodes*/
+    therm_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8),
+                                        "pca9548", 0x70);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 0), TYPE_LM75, 0x4C);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 1), TYPE_LM75, 0x4C);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 2), TYPE_LM75, 0x48);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 3), TYPE_LM75, 0x48);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 4), TYPE_LM75, 0x48);
+
     /* I2C9 Fan Controller (MAX31785) */
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x52);
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x54);
-- 
2.35.3

From: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>

Add 2-level cascaded I2C MUXes for SOC VR channels into the Firework
machine.

Signed-off-by: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220627154703.148943-8-quic_jaehyoo@quicinc.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
 static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
-    I2CSlave *therm_mux;
+    I2CSlave *therm_mux, *cpuvr_mux;
 
     /* Create the generic DC-SCM hardware */
     qcom_dc_scm_bmc_i2c_init(bmc);
 
     /* Now create the Firework specific hardware */
 
+    /* I2C7 CPUVR MUX */
+    cpuvr_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7),
+                                        "pca9546", 0x70);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 0), "pca9548", 0x72);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 1), "pca9548", 0x72);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 2), "pca9548", 0x72);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 3), "pca9548", 0x72);
+
     /* I2C8 Thermal Diodes*/
     therm_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8),
                                         "pca9548", 0x70);
-- 
2.35.3

From: Peter Delevoryas <pdel@fb.com>

Very minor, doesn't effect functionality, but this is supposed to be
R_I2CC_FUN_CTRL (new-mode, not old-mode).

Fixes: ba2cccd64e9 ("aspeed: i2c: Add new mode support")
Signed-off-by: Peter Delevoryas <pdel@fb.com>
Message-Id: <20220630045133.32251-2-me@pjd.dev>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/i2c/aspeed_i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: Peter Delevoryas <pdel@fb.com>

I noticed i2c rx transfers were getting shortened to "1" on Zephyr. It
seems to be because the Zephyr i2c driver sets the RX DMA len with the
RX field write-enable bit set (bit 31) to avoid a read-modify-write. [1]

/* 0x1C : I2CM Master DMA Transfer Length Register   */

I think we should be checking the write-enable bits on the incoming
value, not checking the register array. I'm not sure we're even writing
the write-enable bits to the register array, actually.

[1] https://github.com/AspeedTech-BMC/zephyr/blob/db3dbcc9c52e67a47180890ac938ed380b33f91c/drivers/i2c/i2c_aspeed.c#L145-L148

Fixes: ba2cccd64e90f34 ("aspeed: i2c: Add new mode support")
Signed-off-by: Peter Delevoryas <pdel@fb.com>
Message-Id: <20220630045133.32251-3-me@pjd.dev>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/i2c/aspeed_i2c.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
                                                      RX_BUF_LEN) + 1;
         break;
     case A_I2CM_DMA_LEN:
-        w1t = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN_W1T) ||
-                   ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN_W1T);
+        w1t = FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T) ||
+              FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T);
         /* If none of the w1t bits are set, just write to the reg as normal. */
         if (!w1t) {
             bus->regs[R_I2CM_DMA_LEN] = value;
             break;
         }
-        if (ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN_W1T)) {
+        if (FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T)) {
             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN,
                              FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN));
         }
-        if (ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN_W1T)) {
+        if (FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T)) {
             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN,
                              FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN));
         }
-- 
2.35.3

From: Peter Delevoryas <pdel@fb.com>

aspeed_i2c_bus_is_master is checking if master mode is enabled in the I2C
bus controller's function-control register, not that slave mode is enabled
or something.  The error here is that the guest is trying to trigger an I2C
master mode command while master mode is not enabled.

Fixes: ba2cccd64e90f342 ("aspeed: i2c: Add new mode support")
Signed-off-by: Peter Delevoryas <pdel@fb.com>
Message-Id: <20220630045133.32251-4-me@pjd.dev>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/i2c/aspeed_i2c.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
         }
 
         if (!aspeed_i2c_bus_is_master(bus)) {
-            qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
                           __func__);
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
         }
 
         if (!aspeed_i2c_bus_is_master(bus)) {
-            qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Master mode is not enabled\n",
                           __func__);
             break;
         }
-- 
2.35.3

From: Klaus Jensen <k.jensen@samsung.com>

Allow slaves to master the bus by registering a bottom halve. If the bus
is busy, the bottom half is queued up. When a slave has succesfully
mastered the bus, the bottom half is scheduled.

Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
[ clg : - fixed typos in commit log ]
Message-Id: <20220601210831.67259-4-its@irrelevant.dk>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220630045133.32251-5-me@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/i2c/i2c.h | 14 ++++++++++++++
 hw/i2c/core.c        | 34 +++++++++++++++++++++++++++++++++-
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/include/hw/i2c/i2c.h b/include/hw/i2c/i2c.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/i2c.h
+++ b/include/hw/i2c/i2c.h
@@ -XXX,XX +XXX,XX @@ struct I2CNode {
     QLIST_ENTRY(I2CNode) next;
 };
 
+typedef struct I2CPendingMaster I2CPendingMaster;
+
+struct I2CPendingMaster {
+    QEMUBH *bh;
+    QSIMPLEQ_ENTRY(I2CPendingMaster) entry;
+};
+
 typedef QLIST_HEAD(I2CNodeList, I2CNode) I2CNodeList;
+typedef QSIMPLEQ_HEAD(I2CPendingMasters, I2CPendingMaster) I2CPendingMasters;
 
 struct I2CBus {
     BusState qbus;
     I2CNodeList current_devs;
+    I2CPendingMasters pending_masters;
     uint8_t saved_address;
     bool broadcast;
+
+    /* Set from slave currently mastering the bus. */
+    QEMUBH *bh;
 };
 
 I2CBus *i2c_init_bus(DeviceState *parent, const char *name);
@@ -XXX,XX +XXX,XX @@ int i2c_start_send(I2CBus *bus, uint8_t address);
 
 void i2c_end_transfer(I2CBus *bus);
 void i2c_nack(I2CBus *bus);
+void i2c_bus_master(I2CBus *bus, QEMUBH *bh);
+void i2c_bus_release(I2CBus *bus);
 int i2c_send(I2CBus *bus, uint8_t data);
 uint8_t i2c_recv(I2CBus *bus);
 bool i2c_scan_bus(I2CBus *bus, uint8_t address, bool broadcast,
diff --git a/hw/i2c/core.c b/hw/i2c/core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/core.c
+++ b/hw/i2c/core.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
+#include "qemu/main-loop.h"
 #include "trace.h"
 
 #define I2C_BROADCAST 0x00
@@ -XXX,XX +XXX,XX @@ I2CBus *i2c_init_bus(DeviceState *parent, const char *name)
 
     bus = I2C_BUS(qbus_new(TYPE_I2C_BUS, parent, name));
     QLIST_INIT(&bus->current_devs);
+    QSIMPLEQ_INIT(&bus->pending_masters);
     vmstate_register(NULL, VMSTATE_INSTANCE_ID_ANY, &vmstate_i2c_bus, bus);
     return bus;
 }
@@ -XXX,XX +XXX,XX @@ void i2c_slave_set_address(I2CSlave *dev, uint8_t address)
 /* Return nonzero if bus is busy.  */
 int i2c_bus_busy(I2CBus *bus)
 {
-    return !QLIST_EMPTY(&bus->current_devs);
+    return !QLIST_EMPTY(&bus->current_devs) || bus->bh;
 }
 
 bool i2c_scan_bus(I2CBus *bus, uint8_t address, bool broadcast,
@@ -XXX,XX +XXX,XX @@ int i2c_start_transfer(I2CBus *bus, uint8_t address, bool is_recv)
                                                : I2C_START_SEND);
 }
 
+void i2c_bus_master(I2CBus *bus, QEMUBH *bh)
+{
+    if (i2c_bus_busy(bus)) {
+        I2CPendingMaster *node = g_new(struct I2CPendingMaster, 1);
+        node->bh = bh;
+
+        QSIMPLEQ_INSERT_TAIL(&bus->pending_masters, node, entry);
+
+        return;
+    }
+
+    bus->bh = bh;
+    qemu_bh_schedule(bus->bh);
+}
+
+void i2c_bus_release(I2CBus *bus)
+{
+    bus->bh = NULL;
+}
+
 int i2c_start_recv(I2CBus *bus, uint8_t address)
 {
     return i2c_do_start_transfer(bus, address, I2C_START_RECV);
@@ -XXX,XX +XXX,XX @@ void i2c_end_transfer(I2CBus *bus)
         g_free(node);
     }
     bus->broadcast = false;
+
+    if (!QSIMPLEQ_EMPTY(&bus->pending_masters)) {
+        I2CPendingMaster *node = QSIMPLEQ_FIRST(&bus->pending_masters);
+        bus->bh = node->bh;
+
+        QSIMPLEQ_REMOVE_HEAD(&bus->pending_masters, entry);
+        g_free(node);
+
+        qemu_bh_schedule(bus->bh);
+    }
 }
 
 int i2c_send(I2CBus *bus, uint8_t data)
-- 
2.35.3

From: Klaus Jensen <k.jensen@samsung.com>

Add an asynchronous version of i2c_send() that requires the slave to
explicitly acknowledge on the bus with i2c_ack().

The current master must use the new i2c_start_send_async() to indicate
that it wants to do an asynchronous transfer. This allows the i2c core
to check if the target slave supports this or not. This approach relies
on adding a new enum i2c_event member, which is why a bunch of other
devices needs changes in their event handling switches.

Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Message-Id: <20220601210831.67259-5-its@irrelevant.dk>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220630045133.32251-6-me@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/i2c/i2c.h       | 16 ++++++++++++++++
 hw/arm/pxa2xx.c            |  2 ++
 hw/display/sii9022.c       |  2 ++
 hw/display/ssd0303.c       |  2 ++
 hw/i2c/core.c              | 36 +++++++++++++++++++++++++++++++++++-
 hw/i2c/smbus_slave.c       |  4 ++++
 hw/nvram/eeprom_at24c.c    |  2 ++
 hw/sensor/lsm303dlhc_mag.c |  2 ++
 hw/i2c/trace-events        |  2 ++
 9 files changed, 67 insertions(+), 1 deletion(-)

diff --git a/include/hw/i2c/i2c.h b/include/hw/i2c/i2c.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/i2c.h
+++ b/include/hw/i2c/i2c.h
@@ -XXX,XX +XXX,XX @@
 enum i2c_event {
     I2C_START_RECV,
     I2C_START_SEND,
+    I2C_START_SEND_ASYNC,
     I2C_FINISH,
     I2C_NACK /* Masker NACKed a receive byte.  */
 };
@@ -XXX,XX +XXX,XX @@ struct I2CSlaveClass {
     /* Master to slave. Returns non-zero for a NAK, 0 for success. */
     int (*send)(I2CSlave *s, uint8_t data);
 
+    /* Master to slave (asynchronous). Receiving slave must call i2c_ack(). */
+    void (*send_async)(I2CSlave *s, uint8_t data);
+
     /*
      * Slave to master.  This cannot fail, the device should always
      * return something here.
@@ -XXX,XX +XXX,XX @@ int i2c_start_recv(I2CBus *bus, uint8_t address);
  */
 int i2c_start_send(I2CBus *bus, uint8_t address);
 
+/**
+ * i2c_start_send_async: start an asynchronous 'send' transfer on an I2C bus.
+ *
+ * @bus: #I2CBus to be used
+ * @address: address of the slave
+ *
+ * Return: 0 on success, -1 on error
+ */
+int i2c_start_send_async(I2CBus *bus, uint8_t address);
+
 void i2c_end_transfer(I2CBus *bus);
 void i2c_nack(I2CBus *bus);
+void i2c_ack(I2CBus *bus);
 void i2c_bus_master(I2CBus *bus, QEMUBH *bh);
 void i2c_bus_release(I2CBus *bus);
 int i2c_send(I2CBus *bus, uint8_t data);
+int i2c_send_async(I2CBus *bus, uint8_t data);
 uint8_t i2c_recv(I2CBus *bus);
 bool i2c_scan_bus(I2CBus *bus, uint8_t address, bool broadcast,
                   I2CNodeList *current_devs);
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@ static int pxa2xx_i2c_event(I2CSlave *i2c, enum i2c_event event)
     case I2C_NACK:
         s->status |= 1 << 1;				/* set ACKNAK */
         break;
+    default:
+        return -1;
     }
     pxa2xx_i2c_update(s);
 
diff --git a/hw/display/sii9022.c b/hw/display/sii9022.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/sii9022.c
+++ b/hw/display/sii9022.c
@@ -XXX,XX +XXX,XX @@ static int sii9022_event(I2CSlave *i2c, enum i2c_event event)
         break;
     case I2C_NACK:
         break;
+    default:
+        return -1;
     }
 
     return 0;
diff --git a/hw/display/ssd0303.c b/hw/display/ssd0303.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/ssd0303.c
+++ b/hw/display/ssd0303.c
@@ -XXX,XX +XXX,XX @@ static int ssd0303_event(I2CSlave *i2c, enum i2c_event event)
     case I2C_NACK:
         /* Nothing to do.  */
         break;
+    default:
+        return -1;
     }
 
     return 0;
diff --git a/hw/i2c/core.c b/hw/i2c/core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/core.c
+++ b/hw/i2c/core.c
@@ -XXX,XX +XXX,XX @@ static int i2c_do_start_transfer(I2CBus *bus, uint8_t address,
            start condition.  */
 
         if (sc->event) {
-            trace_i2c_event("start", s->address);
+            trace_i2c_event(event == I2C_START_SEND ? "start" : "start_async",
+                            s->address);
             rv = sc->event(s, event);
             if (rv && !bus->broadcast) {
                 if (bus_scanned) {
@@ -XXX,XX +XXX,XX @@ int i2c_start_send(I2CBus *bus, uint8_t address)
     return i2c_do_start_transfer(bus, address, I2C_START_SEND);
 }
 
+int i2c_start_send_async(I2CBus *bus, uint8_t address)
+{
+    return i2c_do_start_transfer(bus, address, I2C_START_SEND_ASYNC);
+}
+
 void i2c_end_transfer(I2CBus *bus)
 {
     I2CSlaveClass *sc;
@@ -XXX,XX +XXX,XX @@ int i2c_send(I2CBus *bus, uint8_t data)
     return ret ? -1 : 0;
 }
 
+int i2c_send_async(I2CBus *bus, uint8_t data)
+{
+    I2CNode *node = QLIST_FIRST(&bus->current_devs);
+    I2CSlave *slave = node->elt;
+    I2CSlaveClass *sc = I2C_SLAVE_GET_CLASS(slave);
+
+    if (!sc->send_async) {
+        return -1;
+    }
+
+    trace_i2c_send_async(slave->address, data);
+
+    sc->send_async(slave, data);
+
+    return 0;
+}
+
 uint8_t i2c_recv(I2CBus *bus)
 {
     uint8_t data = 0xff;
@@ -XXX,XX +XXX,XX @@ void i2c_nack(I2CBus *bus)
     }
 }
 
+void i2c_ack(I2CBus *bus)
+{
+    if (!bus->bh) {
+        return;
+    }
+
+    trace_i2c_ack();
+
+    qemu_bh_schedule(bus->bh);
+}
+
 static int i2c_slave_post_load(void *opaque, int version_id)
 {
     I2CSlave *dev = opaque;
diff --git a/hw/i2c/smbus_slave.c b/hw/i2c/smbus_slave.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/smbus_slave.c
+++ b/hw/i2c/smbus_slave.c
@@ -XXX,XX +XXX,XX @@ static int smbus_i2c_event(I2CSlave *s, enum i2c_event event)
             dev->mode = SMBUS_CONFUSED;
             break;
         }
+        break;
+
+    default:
+        return -1;
     }
 
     return 0;
diff --git a/hw/nvram/eeprom_at24c.c b/hw/nvram/eeprom_at24c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/eeprom_at24c.c
+++ b/hw/nvram/eeprom_at24c.c
@@ -XXX,XX +XXX,XX @@ int at24c_eeprom_event(I2CSlave *s, enum i2c_event event)
         break;
     case I2C_NACK:
         break;
+    default:
+        return -1;
     }
     return 0;
 }
diff --git a/hw/sensor/lsm303dlhc_mag.c b/hw/sensor/lsm303dlhc_mag.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sensor/lsm303dlhc_mag.c
+++ b/hw/sensor/lsm303dlhc_mag.c
@@ -XXX,XX +XXX,XX @@ static int lsm303dlhc_mag_event(I2CSlave *i2c, enum i2c_event event)
         break;
     case I2C_NACK:
         break;
+    default:
+        return -1;
     }
 
     s->len = 0;
diff --git a/hw/i2c/trace-events b/hw/i2c/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/trace-events
+++ b/hw/i2c/trace-events
@@ -XXX,XX +XXX,XX @@
 
 i2c_event(const char *event, uint8_t address) "%s(addr:0x%02x)"
 i2c_send(uint8_t address, uint8_t data) "send(addr:0x%02x) data:0x%02x"
+i2c_send_async(uint8_t address, uint8_t data) "send_async(addr:0x%02x) data:0x%02x"
 i2c_recv(uint8_t address, uint8_t data) "recv(addr:0x%02x) data:0x%02x"
+i2c_ack(void) ""
 
 # aspeed_i2c.c
 
-- 
2.35.3

From: Klaus Jensen <k.jensen@samsung.com>

Add slave mode functionality for the Aspeed I2C controller in old
register mode. This is implemented by realizing an I2C slave device
owned by the I2C controller and attached to its own bus.

The I2C slave device only implements asynchronous sends on the bus, so
slaves not supporting that will not be able to communicate with it.

Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
[ clg: checkpatch fixes ]
Message-Id: <20220601210831.67259-6-its@irrelevant.dk>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220630045133.32251-7-me@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/i2c/aspeed_i2c.h |  8 ++++
 hw/i2c/aspeed_i2c.c         | 89 +++++++++++++++++++++++++++++++++----
 2 files changed, 88 insertions(+), 9 deletions(-)

diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/aspeed_i2c.h
+++ b/include/hw/i2c/aspeed_i2c.h
@@ -XXX,XX +XXX,XX @@ struct AspeedI2CBus {
 
     struct AspeedI2CState *controller;
 
+    /* slave mode */
+    I2CSlave *slave;
+
     MemoryRegion mr;
 
     I2CBus *bus;
@@ -XXX,XX +XXX,XX @@ struct AspeedI2CState {
     AddressSpace dram_as;
 };
 
+#define TYPE_ASPEED_I2C_BUS_SLAVE "aspeed.i2c.slave"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedI2CBusSlave, ASPEED_I2C_BUS_SLAVE)
+struct AspeedI2CBusSlave {
+    I2CSlave i2c;
+};
 
 struct AspeedI2CClass {
     SysBusDeviceClass parent_class;
diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
     switch (offset) {
     case A_I2CD_FUN_CTRL:
         if (SHARED_FIELD_EX32(value, SLAVE_EN)) {
-            qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
-                          __func__);
-            break;
+            i2c_slave_set_address(bus->slave, bus->regs[R_I2CD_DEV_ADDR]);
         }
         bus->regs[R_I2CD_FUN_CTRL] = value & 0x0071C3FF;
         break;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
             bus->controller->intr_status &= ~(1 << bus->id);
             qemu_irq_lower(aic->bus_get_irq(bus));
         }
-        if (handle_rx && (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD,
-                                                  M_RX_CMD) ||
-                      SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD,
-                                              M_S_RX_CMD_LAST))) {
-            aspeed_i2c_handle_rx_cmd(bus);
-            aspeed_i2c_bus_raise_interrupt(bus);
+        if (handle_rx) {
+            if (SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, M_RX_CMD) ||
+                SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD,
+                                        M_S_RX_CMD_LAST)) {
+                aspeed_i2c_handle_rx_cmd(bus);
+                aspeed_i2c_bus_raise_interrupt(bus);
+            } else if (aspeed_i2c_get_state(bus) == I2CD_STXD) {
+                i2c_ack(bus->bus);
+            }
         }
         break;
     case A_I2CD_DEV_ADDR:
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_i2c_info = {
     .abstract   = true,
 };
 
+static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
+{
+    BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
+    AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
+    uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
+    uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
+    uint32_t value;
+
+    switch (event) {
+    case I2C_START_SEND_ASYNC:
+        value = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_byte_buf, TX_BUF);
+        SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, value << 1);
+
+        ARRAY_FIELD_DP32(bus->regs, I2CD_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
+        SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
+
+        aspeed_i2c_set_state(bus, I2CD_STXD);
+
+        break;
+
+    case I2C_FINISH:
+        SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, NORMAL_STOP, 1);
+
+        aspeed_i2c_set_state(bus, I2CD_IDLE);
+
+        break;
+
+    default:
+        return -1;
+    }
+
+    aspeed_i2c_bus_raise_interrupt(bus);
+
+    return 0;
+}
+
+static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
+{
+    BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
+    AspeedI2CBus *bus = ASPEED_I2C_BUS(qbus->parent);
+    uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
+    uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
+
+    SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
+    SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
+
+    aspeed_i2c_bus_raise_interrupt(bus);
+}
+
+static void aspeed_i2c_bus_slave_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    I2CSlaveClass *sc = I2C_SLAVE_CLASS(klass);
+
+    dc->desc = "Aspeed I2C Bus Slave";
+
+    sc->event = aspeed_i2c_bus_slave_event;
+    sc->send_async = aspeed_i2c_bus_slave_send_async;
+}
+
+static const TypeInfo aspeed_i2c_bus_slave_info = {
+    .name           = TYPE_ASPEED_I2C_BUS_SLAVE,
+    .parent         = TYPE_I2C_SLAVE,
+    .instance_size  = sizeof(AspeedI2CBusSlave),
+    .class_init     = aspeed_i2c_bus_slave_class_init,
+};
+
 static void aspeed_i2c_bus_reset(DeviceState *dev)
 {
     AspeedI2CBus *s = ASPEED_I2C_BUS(dev);
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_realize(DeviceState *dev, Error **errp)
     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
 
     s->bus = i2c_init_bus(dev, name);
+    s->slave = i2c_slave_create_simple(s->bus, TYPE_ASPEED_I2C_BUS_SLAVE,
+                                       0xff);
 
     memory_region_init_io(&s->mr, OBJECT(s), &aspeed_i2c_bus_ops,
                           s, name, aic->reg_size);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_1030_i2c_info = {
 static void aspeed_i2c_register_types(void)
 {
     type_register_static(&aspeed_i2c_bus_info);
+    type_register_static(&aspeed_i2c_bus_slave_info);
     type_register_static(&aspeed_i2c_info);
     type_register_static(&aspeed_2400_i2c_info);
     type_register_static(&aspeed_2500_i2c_info);
-- 
2.35.3

From: Peter Delevoryas <pdel@fb.com>

This commit adds support for DMA RX in slave mode while using the new
register set in the AST2600 and AST1030. This patch also pretty much
assumes packet mode is enabled, I'm not sure if this will work in DMA
step mode.

This is particularly useful for testing IPMB exchanges between Zephyr
and external devices, which requires multi-master I2C support and DMA in
the new register mode, because the Zephyr drivers from Aspeed use DMA in
the new mode by default. The Zephyr drivers are also using packet mode.

The typical sequence of events for receiving data in DMA slave + packet
mode is that the Zephyr firmware will configure the slave address
register with an address to receive on and configure the bus's function
control register to enable master mode and slave mode simultaneously at
startup, before any transfers are initiated.

RX DMA is enabled in the slave mode command register, and the slave RX
DMA buffer address and slave RX DMA buffer length are set. TX DMA is not
covered in this patch.

When the Aspeed I2C controller receives data from some other I2C master,
it will reset the I2CS_DMA_LEN RX_LEN value to zero, then buffer
incoming data in the RX DMA buffer while incrementing the I2CC_DMA_ADDR
address counter and decrementing the I2CC_DMA_LEN counter. It will also
update the I2CS_DMA_LEN RX_LEN value along the way.

Once all the data has been received, the bus controller will raise an
interrupt indicating a packet command was completed, the slave address
matched, a normal stop condition was seen, and the transfer was an RX
operation.

If the master sent a NACK instead of a normal stop condition, or the
transfer timed out, then a slightly different set of interrupt status
values would be set. Those conditions are not handled in this commit.

The Zephyr firmware then collects data from the RX DMA buffer and clears
the status register by writing the PKT_MODE_EN bit to the status
register. In packet mode, clearing the packet mode interrupt enable bit
also clears most of the other interrupt bits automatically (except for a
few bits above it).

Note: if the master transmit or receive functions were in use
simultaneously with the slave mode receive functionality, then the
master mode functions may have raised the interrupt line for the bus
before the DMA slave transfer is complete. It's important to have the
slave's interrupt status register clear throughout the receive
operation, and if the slave attempts to raise the interrupt before the
master interrupt status is cleared, then it needs to re-raise the
interrupt once the master interrupt status is cleared. (And vice-versa).
That's why in this commit, when the master interrupt status is cleared
and the interrupt line is lowered, we call the slave interrupt _raise_
function, to see if the interrupt was pending. (And again, vice-versa).

Signed-off-by: Peter Delevoryas <pdel@fb.com>
Message-Id: <20220630045133.32251-8-me@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/i2c/aspeed_i2c.h |   3 +
 hw/i2c/aspeed_i2c.c         | 133 ++++++++++++++++++++++++++++++++----
 2 files changed, 124 insertions(+), 12 deletions(-)

diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/aspeed_i2c.h
+++ b/include/hw/i2c/aspeed_i2c.h
@@ -XXX,XX +XXX,XX @@ REG32(I2CM_DMA_LEN, 0x1c)
     FIELD(I2CM_DMA_LEN, TX_BUF_LEN_W1T, 15, 1)
     FIELD(I2CM_DMA_LEN, TX_BUF_LEN, 0, 11)
 REG32(I2CS_INTR_CTRL, 0x20)
+    FIELD(I2CS_INTR_CTRL, PKT_CMD_FAIL, 17, 1)
+    FIELD(I2CS_INTR_CTRL, PKT_CMD_DONE, 16, 1)
 REG32(I2CS_INTR_STS, 0x24)
     /* 31:29 shared with I2CD_INTR_STS[31:29] */
     FIELD(I2CS_INTR_STS, SLAVE_PARKING_STS, 24, 2)
@@ -XXX,XX +XXX,XX @@ REG32(I2CS_INTR_STS, 0x24)
     FIELD(I2CS_INTR_STS, PKT_CMD_FAIL, 17, 1)
     FIELD(I2CS_INTR_STS, PKT_CMD_DONE, 16, 1)
     /* 14:0 shared with I2CD_INTR_STS[14:0] */
+    FIELD(I2CS_INTR_STS, SLAVE_ADDR_RX_MATCH, 7, 1)
 REG32(I2CS_CMD, 0x28)
     FIELD(I2CS_CMD, W1_CTRL, 31, 1)
     FIELD(I2CS_CMD, PKT_MODE_ACTIVE_ADDR, 17, 2)
diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static inline void aspeed_i2c_bus_raise_interrupt(AspeedI2CBus *bus)
     }
 }
 
+static inline void aspeed_i2c_bus_raise_slave_interrupt(AspeedI2CBus *bus)
+{
+    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
+
+    if (!bus->regs[R_I2CS_INTR_STS]) {
+        return;
+    }
+
+    bus->controller->intr_status |= 1 << bus->id;
+    qemu_irq_raise(aic->bus_get_irq(bus));
+}
+
 static uint64_t aspeed_i2c_bus_old_read(AspeedI2CBus *bus, hwaddr offset,
                                         unsigned size)
 {
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_i2c_bus_new_read(AspeedI2CBus *bus, hwaddr offset,
     case A_I2CM_DMA_LEN_STS:
     case A_I2CC_DMA_ADDR:
     case A_I2CC_DMA_LEN:
+
+    case A_I2CS_DEV_ADDR:
+    case A_I2CS_DMA_RX_ADDR:
+    case A_I2CS_DMA_LEN:
+    case A_I2CS_CMD:
+    case A_I2CS_INTR_CTRL:
+    case A_I2CS_DMA_LEN_STS:
         /* Value is already set, don't do anything. */
         break;
+    case A_I2CS_INTR_STS:
+        break;
     case A_I2CM_CMD:
         value = SHARED_FIELD_DP32(value, BUS_BUSY_STS, i2c_bus_busy(bus->bus));
         break;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
 
     switch (offset) {
     case A_I2CC_FUN_CTRL:
-        if (SHARED_FIELD_EX32(value, SLAVE_EN)) {
-            qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
-                          __func__);
-            break;
-        }
-        bus->regs[R_I2CC_FUN_CTRL] = value & 0x007dc3ff;
+        bus->regs[R_I2CC_FUN_CTRL] = value;
         break;
     case A_I2CC_AC_TIMING:
         bus->regs[R_I2CC_AC_TIMING] = value & 0x1ffff0ff;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
                 bus->controller->intr_status &= ~(1 << bus->id);
                 qemu_irq_lower(aic->bus_get_irq(bus));
             }
+            aspeed_i2c_bus_raise_slave_interrupt(bus);
             break;
         }
         bus->regs[R_I2CM_INTR_STS] &= ~(value & 0xf007f07f);
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
     case A_I2CC_DMA_LEN:
         /* RO */
         break;
-    case A_I2CS_DMA_LEN_STS:
-    case A_I2CS_DMA_TX_ADDR:
-    case A_I2CS_DMA_RX_ADDR:
     case A_I2CS_DEV_ADDR:
+        bus->regs[R_I2CS_DEV_ADDR] = value;
+        break;
+    case A_I2CS_DMA_RX_ADDR:
+        bus->regs[R_I2CS_DMA_RX_ADDR] = value;
+        break;
+    case A_I2CS_DMA_LEN:
+        assert(FIELD_EX32(value, I2CS_DMA_LEN, TX_BUF_LEN) == 0);
+        if (FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN_W1T)) {
+            ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN,
+                             FIELD_EX32(value, I2CS_DMA_LEN, RX_BUF_LEN));
+        } else {
+            bus->regs[R_I2CS_DMA_LEN] = value;
+        }
+        break;
+    case A_I2CS_CMD:
+        if (FIELD_EX32(value, I2CS_CMD, W1_CTRL)) {
+            bus->regs[R_I2CS_CMD] |= value;
+        } else {
+            bus->regs[R_I2CS_CMD] = value;
+        }
+        i2c_slave_set_address(bus->slave, bus->regs[R_I2CS_DEV_ADDR]);
+        break;
     case A_I2CS_INTR_CTRL:
+        bus->regs[R_I2CS_INTR_CTRL] = value;
+        break;
+
     case A_I2CS_INTR_STS:
-    case A_I2CS_CMD:
-    case A_I2CS_DMA_LEN:
-        qemu_log_mask(LOG_UNIMP, "%s: Slave mode is not implemented\n",
+        if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_CTRL, PKT_CMD_DONE)) {
+            if (ARRAY_FIELD_EX32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE) &&
+                FIELD_EX32(value, I2CS_INTR_STS, PKT_CMD_DONE)) {
+                bus->regs[R_I2CS_INTR_STS] &= 0xfffc0000;
+            }
+        } else {
+            bus->regs[R_I2CS_INTR_STS] &= ~value;
+        }
+        if (!bus->regs[R_I2CS_INTR_STS]) {
+            bus->controller->intr_status &= ~(1 << bus->id);
+            qemu_irq_lower(aic->bus_get_irq(bus));
+        }
+        aspeed_i2c_bus_raise_interrupt(bus);
+        break;
+    case A_I2CS_DMA_LEN_STS:
+        bus->regs[R_I2CS_DMA_LEN_STS] = 0;
+        break;
+    case A_I2CS_DMA_TX_ADDR:
+        qemu_log_mask(LOG_UNIMP, "%s: Slave mode DMA TX is not implemented\n",
                       __func__);
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_i2c_info = {
     .abstract   = true,
 };
 
+static int aspeed_i2c_bus_new_slave_event(AspeedI2CBus *bus,
+                                          enum i2c_event event)
+{
+    switch (event) {
+    case I2C_START_SEND_ASYNC:
+        if (!SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CS_CMD, RX_DMA_EN)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Slave mode RX DMA is not enabled\n", __func__);
+            return -1;
+        }
+        ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN, 0);
+        bus->regs[R_I2CC_DMA_ADDR] =
+            ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_RX_ADDR, ADDR);
+        bus->regs[R_I2CC_DMA_LEN] =
+            ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN, RX_BUF_LEN) + 1;
+        i2c_ack(bus->bus);
+        break;
+    case I2C_FINISH:
+        ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, PKT_CMD_DONE, 1);
+        ARRAY_FIELD_DP32(bus->regs, I2CS_INTR_STS, SLAVE_ADDR_RX_MATCH, 1);
+        SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, NORMAL_STOP, 1);
+        SHARED_ARRAY_FIELD_DP32(bus->regs, R_I2CS_INTR_STS, RX_DONE, 1);
+        aspeed_i2c_bus_raise_slave_interrupt(bus);
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "%s: i2c event %d unimplemented\n",
+                      __func__, event);
+        return -1;
+    }
+
+    return 0;
+}
+
 static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
 {
     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
@@ -XXX,XX +XXX,XX @@ static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
     uint32_t value;
 
+    if (aspeed_i2c_is_new_mode(bus->controller)) {
+        return aspeed_i2c_bus_new_slave_event(bus, event);
+    }
+
     switch (event) {
     case I2C_START_SEND_ASYNC:
         value = SHARED_ARRAY_FIELD_EX32(bus->regs, reg_byte_buf, TX_BUF);
@@ -XXX,XX +XXX,XX @@ static int aspeed_i2c_bus_slave_event(I2CSlave *slave, enum i2c_event event)
     return 0;
 }
 
+static void aspeed_i2c_bus_new_slave_send_async(AspeedI2CBus *bus, uint8_t data)
+{
+    assert(address_space_write(&bus->controller->dram_as,
+                               bus->regs[R_I2CC_DMA_ADDR],
+                               MEMTXATTRS_UNSPECIFIED, &data, 1) == MEMTX_OK);
+
+    bus->regs[R_I2CC_DMA_ADDR]++;
+    bus->regs[R_I2CC_DMA_LEN]--;
+    ARRAY_FIELD_DP32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN,
+                     ARRAY_FIELD_EX32(bus->regs, I2CS_DMA_LEN_STS, RX_LEN) + 1);
+    i2c_ack(bus->bus);
+}
+
 static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
 {
     BusState *qbus = qdev_get_parent_bus(DEVICE(slave));
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_slave_send_async(I2CSlave *slave, uint8_t data)
     uint32_t reg_intr_sts = aspeed_i2c_bus_intr_sts_offset(bus);
     uint32_t reg_byte_buf = aspeed_i2c_bus_byte_buf_offset(bus);
 
+    if (aspeed_i2c_is_new_mode(bus->controller)) {
+        return aspeed_i2c_bus_new_slave_send_async(bus, data);
+    }
+
     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_byte_buf, RX_BUF, data);
     SHARED_ARRAY_FIELD_DP32(bus->regs, reg_intr_sts, RX_DONE, 1);
 
-- 
2.35.3

From: Peter Delevoryas <pdel@fb.com>

This introduces a really basic PECI controller that responses to
commands by always setting the response code to success and then raising
an interrupt to indicate the command is done. This helps avoid getting
hit with constant errors if the driver continuously attempts to send a
command and keeps timing out.

The AST2400 and AST2500 only included registers up to 0x5C, not 0xFC.
They supported PECI 1.1, 2.0, and 3.0. The AST2600 and AST1030 support
PECI 4.0, which includes more read/write buffer registers from 0x80 to
0xFC to support 64-byte mode.

This patch doesn't attempt to handle that, or to create a different
version of the controller for the different generations, since it's only
implementing functionality that is common to all generations.

The basic sequence of events is that the firmware will read and write to
various registers and then trigger a command by setting the FIRE bit in
the command register (similar to the I2C controller).

Then the firmware waits for an interrupt from the PECI controller,
expecting the interrupt status register to be filled in with info on
what happened. If the command was transmitted and received successfully,
then response codes from the host CPU will be found in the data buffer
registers.

Signed-off-by: Peter Delevoryas <pdel@fb.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220630045133.32251-12-me@pjd.dev>
[ clg: s/sysbus_mmio_map/aspeed_mmio_map/ ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h   |   3 +
 include/hw/misc/aspeed_peci.h |  29 +++++++
 hw/arm/aspeed_ast10x0.c       |  13 +++
 hw/arm/aspeed_ast2600.c       |  13 +++
 hw/arm/aspeed_soc.c           |  14 ++++
 hw/misc/aspeed_peci.c         | 152 ++++++++++++++++++++++++++++++++++
 hw/misc/meson.build           |   3 +-
 hw/misc/trace-events          |   5 ++
 8 files changed, 231 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/misc/aspeed_peci.h
 create mode 100644 hw/misc/aspeed_peci.c

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "qom/object.h"
 #include "hw/misc/aspeed_lpc.h"
 #include "hw/misc/unimp.h"
+#include "hw/misc/aspeed_peci.h"
 
 #define ASPEED_SPIS_NUM  2
 #define ASPEED_EHCIS_NUM 2
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
     AspeedSDHCIState sdhci;
     AspeedSDHCIState emmc;
     AspeedLPCState lpc;
+    AspeedPECIState peci;
     uint32_t uart_default;
     Clock *sysclk;
     UnimplementedDeviceState iomem;
@@ -XXX,XX +XXX,XX @@ enum {
     ASPEED_DEV_LPC,
     ASPEED_DEV_IBT,
     ASPEED_DEV_I2C,
+    ASPEED_DEV_PECI,
     ASPEED_DEV_ETH1,
     ASPEED_DEV_ETH2,
     ASPEED_DEV_ETH3,
diff --git a/include/hw/misc/aspeed_peci.h b/include/hw/misc/aspeed_peci.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/aspeed_peci.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Aspeed PECI Controller
+ *
+ * Copyright (c) Meta Platforms, Inc. and affiliates. (http://www.meta.com)
+ *
+ * This code is licensed under the GPL version 2 or later. See the COPYING
+ * file in the top-level directory.
+ */
+
+#ifndef ASPEED_PECI_H
+#define ASPEED_PECI_H
+
+#include "hw/sysbus.h"
+
+#define ASPEED_PECI_NR_REGS ((0xFC + 4) >> 2)
+#define TYPE_ASPEED_PECI "aspeed.peci"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedPECIState, ASPEED_PECI);
+
+struct AspeedPECIState {
+    /* <private> */
+    SysBusDevice parent;
+
+    MemoryRegion mmio;
+    qemu_irq irq;
+
+    uint32_t regs[ASPEED_PECI_NR_REGS];
+};
+
+#endif
diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast1030_memmap[] = {
     [ASPEED_DEV_UART13]    = 0x7E790700,
     [ASPEED_DEV_WDT]       = 0x7E785000,
     [ASPEED_DEV_LPC]       = 0x7E789000,
+    [ASPEED_DEV_PECI]      = 0x7E78B000,
     [ASPEED_DEV_I2C]       = 0x7E7B0000,
 };
 
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast1030_irqmap[] = {
     [ASPEED_DEV_TIMER8]    = 23,
     [ASPEED_DEV_WDT]       = 24,
     [ASPEED_DEV_LPC]       = 35,
+    [ASPEED_DEV_PECI]      = 38,
     [ASPEED_DEV_FMC]       = 39,
     [ASPEED_DEV_PWM]       = 44,
     [ASPEED_DEV_ADC]       = 46,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_init(Object *obj)
 
     object_initialize_child(obj, "lpc", &s->lpc, TYPE_ASPEED_LPC);
 
+    object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
+
     object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_SBC);
 
     for (i = 0; i < sc->wdts_num; i++) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c.busses[i]), 0, irq);
     }
 
+    /* PECI */
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
+        return;
+    }
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->peci), 0,
+                    sc->memmap[ASPEED_DEV_PECI]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
+                       aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
+
     /* LPC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
         return;
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
     [ASPEED_DEV_LPC]       = 0x1E789000,
     [ASPEED_DEV_IBT]       = 0x1E789140,
     [ASPEED_DEV_I2C]       = 0x1E78A000,
+    [ASPEED_DEV_PECI]      = 0x1E78B000,
     [ASPEED_DEV_UART1]     = 0x1E783000,
     [ASPEED_DEV_UART2]     = 0x1E78D000,
     [ASPEED_DEV_UART3]     = 0x1E78E000,
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2600_irqmap[] = {
     [ASPEED_DEV_LPC]       = 35,
     [ASPEED_DEV_IBT]       = 143,
     [ASPEED_DEV_I2C]       = 110,   /* 110 -> 125 */
+    [ASPEED_DEV_PECI]      = 38,
     [ASPEED_DEV_ETH1]      = 2,
     [ASPEED_DEV_ETH2]      = 3,
     [ASPEED_DEV_HACE]      = 4,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
     snprintf(typename, sizeof(typename), "aspeed.i2c-%s", socname);
     object_initialize_child(obj, "i2c", &s->i2c, typename);
 
+    object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
+
     snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
     object_initialize_child(obj, "fmc", &s->fmc, typename);
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c.busses[i]), 0, irq);
     }
 
+    /* PECI */
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
+        return;
+    }
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->peci), 0,
+                    sc->memmap[ASPEED_DEV_PECI]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
+                       aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
+
     /* FMC, The number of CS is set at the board level */
     object_property_set_link(OBJECT(&s->fmc), "dram", OBJECT(s->dram_mr),
                              &error_abort);
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2400_memmap[] = {
     [ASPEED_DEV_LPC]    = 0x1E789000,
     [ASPEED_DEV_IBT]    = 0x1E789140,
     [ASPEED_DEV_I2C]    = 0x1E78A000,
+    [ASPEED_DEV_PECI]   = 0x1E78B000,
     [ASPEED_DEV_ETH1]   = 0x1E660000,
     [ASPEED_DEV_ETH2]   = 0x1E680000,
     [ASPEED_DEV_UART1]  = 0x1E783000,
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2500_memmap[] = {
     [ASPEED_DEV_LPC]    = 0x1E789000,
     [ASPEED_DEV_IBT]    = 0x1E789140,
     [ASPEED_DEV_I2C]    = 0x1E78A000,
+    [ASPEED_DEV_PECI]   = 0x1E78B000,
     [ASPEED_DEV_ETH1]   = 0x1E660000,
     [ASPEED_DEV_ETH2]   = 0x1E680000,
     [ASPEED_DEV_UART1]  = 0x1E783000,
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2400_irqmap[] = {
     [ASPEED_DEV_PWM]    = 28,
     [ASPEED_DEV_LPC]    = 8,
     [ASPEED_DEV_I2C]    = 12,
+    [ASPEED_DEV_PECI]   = 15,
     [ASPEED_DEV_ETH1]   = 2,
     [ASPEED_DEV_ETH2]   = 3,
     [ASPEED_DEV_XDMA]   = 6,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     snprintf(typename, sizeof(typename), "aspeed.i2c-%s", socname);
     object_initialize_child(obj, "i2c", &s->i2c, typename);
 
+    object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
+
     snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
     object_initialize_child(obj, "fmc", &s->fmc, typename);
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_I2C));
 
+    /* PECI */
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
+        return;
+    }
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->peci), 0,
+                    sc->memmap[ASPEED_DEV_PECI]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
+                       aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
+
     /* FMC, The number of CS is set at the board level */
     object_property_set_link(OBJECT(&s->fmc), "dram", OBJECT(s->dram_mr),
                              &error_abort);
diff --git a/hw/misc/aspeed_peci.c b/hw/misc/aspeed_peci.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/aspeed_peci.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Aspeed PECI Controller
+ *
+ * Copyright (c) Meta Platforms, Inc. and affiliates. (http://www.meta.com)
+ *
+ * This code is licensed under the GPL version 2 or later. See the COPYING
+ * file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/irq.h"
+#include "hw/misc/aspeed_peci.h"
+#include "hw/registerfields.h"
+#include "trace.h"
+
+#define ASPEED_PECI_CC_RSP_SUCCESS (0x40U)
+
+/* Command Register */
+REG32(PECI_CMD, 0x08)
+    FIELD(PECI_CMD, FIRE, 0, 1)
+
+/* Interrupt Control Register */
+REG32(PECI_INT_CTRL, 0x18)
+
+/* Interrupt Status Register */
+REG32(PECI_INT_STS, 0x1C)
+    FIELD(PECI_INT_STS, CMD_DONE, 0, 1)
+
+/* Rx/Tx Data Buffer Registers */
+REG32(PECI_WR_DATA0, 0x20)
+REG32(PECI_RD_DATA0, 0x30)
+
+static void aspeed_peci_raise_interrupt(AspeedPECIState *s, uint32_t status)
+{
+    trace_aspeed_peci_raise_interrupt(s->regs[R_PECI_INT_CTRL], status);
+
+    s->regs[R_PECI_INT_STS] = s->regs[R_PECI_INT_CTRL] & status;
+    if (!s->regs[R_PECI_INT_STS]) {
+        return;
+    }
+    qemu_irq_raise(s->irq);
+}
+
+static uint64_t aspeed_peci_read(void *opaque, hwaddr offset, unsigned size)
+{
+    AspeedPECIState *s = ASPEED_PECI(opaque);
+    uint64_t data;
+
+    if (offset >= ASPEED_PECI_NR_REGS << 2) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+        return 0;
+    }
+    data = s->regs[offset >> 2];
+
+    trace_aspeed_peci_read(offset, data);
+    return data;
+}
+
+static void aspeed_peci_write(void *opaque, hwaddr offset, uint64_t data,
+                              unsigned size)
+{
+    AspeedPECIState *s = ASPEED_PECI(opaque);
+
+    trace_aspeed_peci_write(offset, data);
+
+    if (offset >= ASPEED_PECI_NR_REGS << 2) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+        return;
+    }
+
+    switch (offset) {
+    case A_PECI_INT_STS:
+        s->regs[R_PECI_INT_STS] &= ~data;
+        if (!s->regs[R_PECI_INT_STS]) {
+            qemu_irq_lower(s->irq);
+        }
+        break;
+    case A_PECI_CMD:
+        /*
+         * Only the FIRE bit is writable. Once the command is complete, it
+         * should be cleared. Since we complete the command immediately, the
+         * value is not stored in the register array.
+         */
+        if (!FIELD_EX32(data, PECI_CMD, FIRE)) {
+            break;
+        }
+        if (s->regs[R_PECI_INT_STS]) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Interrupt status must be "
+                          "cleared before firing another command: 0x%08x\n",
+                          __func__, s->regs[R_PECI_INT_STS]);
+            break;
+        }
+        s->regs[R_PECI_RD_DATA0] = ASPEED_PECI_CC_RSP_SUCCESS;
+        s->regs[R_PECI_WR_DATA0] = ASPEED_PECI_CC_RSP_SUCCESS;
+        aspeed_peci_raise_interrupt(s,
+                                    FIELD_DP32(0, PECI_INT_STS, CMD_DONE, 1));
+        break;
+    default:
+        s->regs[offset / sizeof(s->regs[0])] = data;
+        break;
+    }
+}
+
+static const MemoryRegionOps aspeed_peci_ops = {
+    .read = aspeed_peci_read,
+    .write = aspeed_peci_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void aspeed_peci_realize(DeviceState *dev, Error **errp)
+{
+    AspeedPECIState *s = ASPEED_PECI(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+
+    memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_peci_ops, s,
+                          TYPE_ASPEED_PECI, 0x1000);
+    sysbus_init_mmio(sbd, &s->mmio);
+    sysbus_init_irq(sbd, &s->irq);
+}
+
+static void aspeed_peci_reset(DeviceState *dev)
+{
+    AspeedPECIState *s = ASPEED_PECI(dev);
+
+    memset(s->regs, 0, sizeof(s->regs));
+}
+
+static void aspeed_peci_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = aspeed_peci_realize;
+    dc->reset = aspeed_peci_reset;
+    dc->desc = "Aspeed PECI Controller";
+}
+
+static const TypeInfo aspeed_peci_types[] = {
+    {
+        .name = TYPE_ASPEED_PECI,
+        .parent = TYPE_SYS_BUS_DEVICE,
+        .instance_size = sizeof(AspeedPECIState),
+        .class_init = aspeed_peci_class_init,
+        .abstract = false,
+    },
+};
+
+DEFINE_TYPES(aspeed_peci_types);
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_scu.c',
   'aspeed_sbc.c',
   'aspeed_sdmc.c',
-  'aspeed_xdma.c'))
+  'aspeed_xdma.c',
+  'aspeed_peci.c'))
 
 softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
 softmmu_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_rng.c'))
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ aspeed_i3c_device_write(uint32_t deviceid, uint64_t offset, uint64_t data) "I3C
 aspeed_sdmc_write(uint64_t reg, uint64_t data) "reg @0x%" PRIx64 " data: 0x%" PRIx64
 aspeed_sdmc_read(uint64_t reg, uint64_t data) "reg @0x%" PRIx64 " data: 0x%" PRIx64
 
+# aspeed_peci.c
+aspeed_peci_read(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64
+aspeed_peci_write(uint64_t offset, uint64_t data) "offset 0x%" PRIx64 " data 0x%" PRIx64
+aspeed_peci_raise_interrupt(uint32_t ctrl, uint32_t status) "ctrl 0x%" PRIx32 " status 0x%" PRIx32
+
 # bcm2835_property.c
 bcm2835_mbox_property(uint32_t tag, uint32_t bufsize, size_t resplen) "mbox property tag:0x%08x in_sz:%u out_sz:%zu"
 
-- 
2.35.3

The following changes since commit 527dede083d3e3e5a13ee996776926e0a0c4e258:

Merge tag 'pull-request-2025-03-19' of https://gitlab.com/thuth/qemu into staging (2025-03-20 08:41:25 -0400)

are available in the Git repository at:

https://github.com/legoater/qemu/ tags/pull-aspeed-20250323

for you to fetch changes up to 78877b2e06464f49f777e086845e094ea7bc82ef:

hw/misc/aspeed_hace: Fix buffer overflow in has_padding function (2025-03-23 18:42:16 +0100)

----------------------------------------------------------------
aspeed queue:

* Fix AST2700 SoC model

----------------------------------------------------------------
Jamin Lin (1):
      hw/misc/aspeed_hace: Fix buffer overflow in has_padding function

Steven Lee (1):
      hw/intc/aspeed: Fix IRQ handler mask check

Troy Lee (1):
      aspeed: Fix maximum number of spi controller

include/hw/arm/aspeed_soc.h | 2 +-
 hw/intc/aspeed_intc.c       | 2 +-
 hw/misc/aspeed_hace.c       | 5 +++++
 3 files changed, 7 insertions(+), 2 deletions(-)

From: Troy Lee <troy_lee@aspeedtech.com>

Commit 6de4aa8dc544 ("hw/arm/aspeed_ast27x0: Add SoC Support for AST2700
A1") extends ast2700a1 spis_num to 3, but ASPEED_SPIS_NUM defines the
maximum number of spi controller to 2, result in ehci[0] is being
overwritten in runtime.

Signed-off-by: Troy Lee <troy_lee@aspeedtech.com>
Fixes: 6de4aa8dc544 ("hw/arm/aspeed_ast27x0: Add SoC Support for AST2700 A1")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250317065938.1902272-1-troy_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/arm/aspeed_soc.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/char/serial-mm.h"
 #include "hw/intc/arm_gicv3.h"
 
-#define ASPEED_SPIS_NUM  2
+#define ASPEED_SPIS_NUM  3
 #define ASPEED_EHCIS_NUM 2
 #define ASPEED_WDTS_NUM  8
 #define ASPEED_CPUS_NUM  4
-- 
2.49.0

From: Steven Lee <steven_lee@aspeedtech.com>

Updated the IRQ handler mask check to AND with select variable.
This ensures that the interrupt service routine is correctly triggered
for the interrupts within the same irq group.

For example, both `eth0` and the debug UART are handled in `GICINT132`.
Without this fix, the debug console may hang if the `eth0` ISR is not
handled.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: Ic3609eb72218dfd68be6057d78b8953b18828709
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Fixes: d831c5fd8682 ("aspeed/intc: Add AST2700 support")
Link: https://lore.kernel.org/qemu-devel/20250320092543.4040672-2-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/aspeed_intc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/aspeed_intc.c
+++ b/hw/intc/aspeed_intc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_intc_set_irq_handler(AspeedINTCState *s,
     outpin_idx = intc_irq->outpin_idx;
     inpin_idx = intc_irq->inpin_idx;
 
-    if (s->mask[inpin_idx] || s->regs[status_reg]) {
+    if ((s->mask[inpin_idx] & select) || (s->regs[status_reg] & select)) {
         /*
          * a. mask is not 0 means in ISR mode
          * sources interrupt routine are executing.
-- 
2.49.0

From: Jamin Lin <jamin_lin@aspeedtech.com>

The maximum padding size is either 64 or 128 bytes and should always be smaller
than "req_len". If "padding_size" exceeds "req_len", then
"req_len - padding_size" underflows due to "uint32_t" data type, leading to a
large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory
access, potentially leading to a buffer overflow.

Added a check to ensure "padding_size" does not exceed "req_len" before
computing "pad_offset". This prevents "req_len - padding_size" from underflowing
and avoids accessing invalid memory.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600 HACE ")
Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -XXX,XX +XXX,XX @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
     if (*total_msg_len <= s->total_req_len) {
         uint32_t padding_size = s->total_req_len - *total_msg_len;
         uint8_t *padding = iov->iov_base;
+
+        if (padding_size > req_len) {
+            return false;
+        }
+
         *pad_offset = req_len - padding_size;
         if (padding[*pad_offset] == 0x80) {
             return true;
-- 
2.49.0