Series comparison

-[PULL 00/11] aspeed queue
+[PULL v2 00/19] aspeed queue
-The following changes since commit a2b5f8b8ab7b2c947823088103a40f0ff11fe06b:
+The following changes since commit 08c9f7eec7002dac2da52c8265eb319aba381c86:
-  Merge tag 'pull-tcg-20230301' of https://gitlab.com/rth7680/qemu into staging (2023-03-01 19:19:20 +0000)
+  Merge tag 'darwin-20220712' of https://github.com/philmd/qemu into staging (2022-07-14 09:30:55 +0100)
 are available in the Git repository at:
-  https://github.com/legoater/qemu/ tags/pull-aspeed-20230302
+  https://github.com/legoater/qemu/ tags/pull-aspeed-20220714
-for you to fetch changes up to b22a2d409b1acfdf0d63d1bb3595194ceb3d94da:
+for you to fetch changes up to f0418558302ef9e140681e04250fc1ca265f3140:
-  aspeed/smc: Replace SysBus IRQs with GPIO lines (2023-03-02 13:57:50 +0100)
+  aspeed: Add fby35-bmc slot GPIO's (2022-07-14 16:24:38 +0200)
 ----------------------------------------------------------------
 aspeed queue:
-* fix for the Aspeed I2C slave mode
+* New ISL69259 device model
-* a new I2C echo device from Klaus and its associated test in avocado.
+* New fby35 multi-SoC machine (AST1030 BIC + AST2600 BMC)
-* initial SoC cleanups to allow the use of block devices instead of
+* Aspeed GPIO fixes
-  drives on the command line.
+* Extension of m25p80 with write protect bits
-* new facebook machines and eeprom fixes for the Fuji
+* More avocado tests using the Aspeed SDK
 * readline fix
 ----------------------------------------------------------------
-Cédric Le Goater (4):
+Cédric Le Goater (3):
-      tests/avocado/machine_aspeed.py: Add an I2C slave test
+      aspeed: fby35: Add a bootrom for the BMC
-      aspeed: Introduce a spi_boot region under the SoC
+      docs: aspeed: Minor updates
-      aspeed: Add a boot_rom overlap region in the SoC spi_boot container
+      test/avocado/machine_aspeed.py: Add SDK tests
       aspeed/smc: Replace SysBus IRQs with GPIO lines
-Dongli Zhang (1):
+Iris Chen (2):
-      readline: fix hmp completion issue
+      hw: m25p80: Add Block Protect and Top Bottom bits for write protect
       hw: m25p80: add tests for BP and TB bit write protect
-Karthikeyan Pasupathi (2):
+Joel Stanley (1):
-      hw/arm/aspeed: Adding new machine Yosemitev2 in QEMU
+      aspeed: sbc: Allow per-machine settings
       hw/arm/aspeed: Adding new machine Tiogapass in QEMU
-Klaus Jensen (2):
+Peter Delevoryas (13):
-      hw/i2c: only schedule pending master when bus is idle
+      hw/i2c/pmbus: Add idle state to return 0xff's
-      hw/misc: add a toy i2c echo device
+      hw/sensor: Add IC_DEVICE_ID to ISL voltage regulators
       hw/sensor: Add Renesas ISL69259 device model
       aspeed: Create SRAM name from first CPU index
       aspeed: Refactor UART init for multi-SoC machines
       aspeed: Make aspeed_board_init_flashes public
       aspeed: Add fby35 skeleton
       aspeed: Add AST2600 (BMC) to fby35
       aspeed: Add AST1030 (BIC) to fby35
       docs: aspeed: Add fby35 multi-SoC machine section
       qtest/aspeed_gpio: Add input pin modification test
       hw/gpio/aspeed: Don't let guests modify input pins
       aspeed: Add fby35-bmc slot GPIO's
-Sittisak Sinprem (2):
+ docs/system/arm/aspeed.rst       |  62 ++++++++++++-
-      hw/at24c : modify at24c to support 1 byte address mode
+ include/hw/arm/aspeed_soc.h      |   9 +-
-      aspeed/fuji : correct the eeprom size
+ include/hw/i2c/pmbus_device.h    |   7 ++
  include/hw/misc/aspeed_sbc.h     |  13 +++
  include/hw/sensor/isl_pmbus_vr.h |   5 ++
  hw/arm/aspeed.c                  |  38 ++++++--
  hw/arm/aspeed_ast10x0.c          |  13 ++-
  hw/arm/aspeed_ast2600.c          |  13 ++-
  hw/arm/aspeed_soc.c              |  55 ++++++++----
  hw/arm/fby35.c                   | 188 +++++++++++++++++++++++++++++++++++++++
  hw/block/m25p80.c                | 102 ++++++++++++++++++---
  hw/gpio/aspeed_gpio.c            |  15 ++--
  hw/i2c/pmbus_device.c            |   9 ++
  hw/misc/aspeed_sbc.c             |  42 ++++++++-
  hw/sensor/isl_pmbus_vr.c         |  40 +++++++++
  tests/qtest/aspeed_gpio-test.c   |  27 ++++++
  tests/qtest/aspeed_smc-test.c    | 111 +++++++++++++++++++++++
  MAINTAINERS                      |   1 +
  hw/arm/meson.build               |   3 +-
  tests/avocado/machine_aspeed.py  |  68 ++++++++++++++
 files changed, 764 insertions(+), 57 deletions(-)
  create mode 100644 hw/arm/fby35.c
- docs/system/arm/aspeed.rst      |   2 +
- hw/arm/aspeed_eeprom.h          |   6 ++
- include/hw/arm/aspeed_soc.h     |   5 ++
- include/hw/i2c/i2c.h            |   2 +
- hw/arm/aspeed.c                 | 159 ++++++++++++++++++++++++++++------------
- hw/arm/aspeed_ast2600.c         |  13 ++++
- hw/arm/aspeed_eeprom.c          |  45 ++++++++++++
- hw/arm/aspeed_soc.c             |  14 ++++
- hw/arm/fby35.c                  |   8 +-
- hw/i2c/aspeed_i2c.c             |   2 +
- hw/i2c/core.c                   |  37 ++++++----
- hw/misc/i2c-echo.c              | 156 +++++++++++++++++++++++++++++++++++++++
- hw/nvram/eeprom_at24c.c         |  30 +++++++-
- hw/ssi/aspeed_smc.c             |   5 +-
- monitor/hmp.c                   |   8 +-
- hw/misc/meson.build             |   2 +
- tests/avocado/machine_aspeed.py |  10 +++
-files changed, 421 insertions(+), 83 deletions(-)
- create mode 100644 hw/misc/i2c-echo.c

-New patch
+[PULL 01/19] aspeed: sbc: Allow per-machine settings
+From: Joel Stanley <joel@jms.id.au>
+In order to correctly report secure boot running firmware the values
+of certain registers must be set.
+We don't yet have documentation from ASPEED on what they mean. The
+meaning is inferred from u-boot's use of them.
+Introduce properties so the settings can be configured per-machine.
+Reviewed-by: Peter Delevoryas <pdel@fb.com>
+Tested-by: Peter Delevoryas <pdel@fb.com>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Message-Id: <20220628154740.1117349-4-clg@kaod.org>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+---
+ include/hw/misc/aspeed_sbc.h | 13 +++++++++++
+ hw/misc/aspeed_sbc.c         | 42 ++++++++++++++++++++++++++++++++++--
+files changed, 53 insertions(+), 2 deletions(-)
+diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/misc/aspeed_sbc.h
++++ b/include/hw/misc/aspeed_sbc.h
+@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(AspeedSBCState, AspeedSBCClass, ASPEED_SBC)
+ #define ASPEED_SBC_NR_REGS (0x93c >> 2)
++#define QSR_AES                     BIT(27)
++#define QSR_RSA1024                 (0x0 << 12)
++#define QSR_RSA2048                 (0x1 << 12)
++#define QSR_RSA3072                 (0x2 << 12)
++#define QSR_RSA4096                 (0x3 << 12)
++#define QSR_SHA224                  (0x0 << 10)
++#define QSR_SHA256                  (0x1 << 10)
++#define QSR_SHA384                  (0x2 << 10)
++#define QSR_SHA512                  (0x3 << 10)
++
+ struct AspeedSBCState {
+     SysBusDevice parent;
++    bool emmc_abr;
++    uint32_t signing_settings;
++
+     MemoryRegion iomem;
+     uint32_t regs[ASPEED_SBC_NR_REGS];
+diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/aspeed_sbc.c
++++ b/hw/misc/aspeed_sbc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qemu/log.h"
+ #include "qemu/error-report.h"
++#include "hw/qdev-properties.h"
+ #include "hw/misc/aspeed_sbc.h"
+ #include "qapi/error.h"
+ #include "migration/vmstate.h"
+@@ -XXX,XX +XXX,XX @@
+ #define R_STATUS        (0x014 / 4)
+ #define R_QSR           (0x040 / 4)
++/* R_STATUS */
++#define ABR_EN                  BIT(14) /* Mirrors SCU510[11] */
++#define ABR_IMAGE_SOURCE        BIT(13)
++#define SPI_ABR_IMAGE_SOURCE    BIT(12)
++#define SB_CRYPTO_KEY_EXP_DONE  BIT(11)
++#define SB_CRYPTO_BUSY          BIT(10)
++#define OTP_WP_EN               BIT(9)
++#define OTP_ADDR_WP_EN          BIT(8)
++#define LOW_SEC_KEY_EN          BIT(7)
++#define SECURE_BOOT_EN          BIT(6)
++#define UART_BOOT_EN            BIT(5)
++/* bit 4 reserved*/
++#define OTP_CHARGE_PUMP_READY   BIT(3)
++#define OTP_IDLE                BIT(2)
++#define OTP_MEM_IDLE            BIT(1)
++#define OTP_COMPARE_STATUS      BIT(0)
++
++/* QSR */
++#define QSR_RSA_MASK           (0x3 << 12)
++#define QSR_HASH_MASK          (0x3 << 10)
++
+ static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
+ {
+     AspeedSBCState *s = ASPEED_SBC(opaque);
+@@ -XXX,XX +XXX,XX @@ static void aspeed_sbc_reset(DeviceState *dev)
+     memset(s->regs, 0, sizeof(s->regs));
+     /* Set secure boot enabled with RSA4096_SHA256 and enable eMMC ABR */
+-    s->regs[R_STATUS] = 0x000044C6;
+-    s->regs[R_QSR] = 0x07C07C89;
++    s->regs[R_STATUS] = OTP_IDLE | OTP_MEM_IDLE;
++
++    if (s->emmc_abr) {
++        s->regs[R_STATUS] &= ABR_EN;
++    }
++
++    if (s->signing_settings) {
++        s->regs[R_STATUS] &= SECURE_BOOT_EN;
++    }
++
++    s->regs[R_QSR] = s->signing_settings;
+ }
+ static void aspeed_sbc_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_sbc = {
+     }
+ };
++static Property aspeed_sbc_properties[] = {
++    DEFINE_PROP_BOOL("emmc-abr", AspeedSBCState, emmc_abr, 0),
++    DEFINE_PROP_UINT32("signing-settings", AspeedSBCState, signing_settings, 0),
++    DEFINE_PROP_END_OF_LIST(),
++};
++
+ static void aspeed_sbc_class_init(ObjectClass *klass, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(klass);
+@@ -XXX,XX +XXX,XX @@ static void aspeed_sbc_class_init(ObjectClass *klass, void *data)
+     dc->realize = aspeed_sbc_realize;
+     dc->reset = aspeed_sbc_reset;
+     dc->vmsd = &vmstate_aspeed_sbc;
++    device_class_set_props(dc, aspeed_sbc_properties);
+ }
+ static const TypeInfo aspeed_sbc_info = {
+--
+.35.3

-[PULL 11/11] aspeed/smc: Replace SysBus IRQs with GPIO lines
+[PULL 02/19] hw/i2c/pmbus: Add idle state to return 0xff's
-It's cleaner and removes the curious '+ 1' required to skip the DMA
+From: Peter Delevoryas <pdel@fb.com>
 IRQ line of the controller.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Peter Delevoryas <pdel@fb.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Titus Rwantare <titusr@google.com>
 Message-Id: <20220701000626.77395-2-me@pjd.dev>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/arm/aspeed.c     | 2 +-
+ include/hw/i2c/pmbus_device.h | 7 +++++++
- hw/ssi/aspeed_smc.c | 5 +----
+ hw/i2c/pmbus_device.c         | 9 +++++++++
-files changed, 2 insertions(+), 5 deletions(-)
+files changed, 16 insertions(+)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+diff --git a/include/hw/i2c/pmbus_device.h b/include/hw/i2c/pmbus_device.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/include/hw/i2c/pmbus_device.h
-+++ b/hw/arm/aspeed.c
++++ b/include/hw/i2c/pmbus_device.h
-@@ -XXX,XX +XXX,XX @@ void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
+@@ -XXX,XX +XXX,XX @@ enum pmbus_registers {
-         qdev_realize_and_unref(dev, BUS(s->spi), &error_fatal);
+     PMBUS_MFR_MAX_TEMP_1            = 0xC0, /* R/W word */
+     PMBUS_MFR_MAX_TEMP_2            = 0xC1, /* R/W word */
-         cs_line = qdev_get_gpio_in_named(dev, SSI_GPIO_CS, 0);
+     PMBUS_MFR_MAX_TEMP_3            = 0xC2, /* R/W word */
--        sysbus_connect_irq(SYS_BUS_DEVICE(s), i + 1, cs_line);
++    PMBUS_IDLE_STATE                = 0xFF,
-+        qdev_connect_gpio_out_named(DEVICE(s), "cs", i, cs_line);
+ };
  /* STATUS_WORD */
@@ -XXX,XX +XXX,XX @@ int pmbus_page_config(PMBusDevice *pmdev, uint8_t page_index, uint64_t flags);
   */
  void pmbus_check_limits(PMBusDevice *pmdev);
 +/**
 + * Enter an idle state where only the PMBUS_ERR_BYTE will be returned
 + * indefinitely until a new command is issued.
 + */
 +void pmbus_idle(PMBusDevice *pmdev);
 +
  extern const VMStateDescription vmstate_pmbus_device;
  #define VMSTATE_PMBUS_DEVICE(_field, _state) {                       \
 diff --git a/hw/i2c/pmbus_device.c b/hw/i2c/pmbus_device.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/i2c/pmbus_device.c
 +++ b/hw/i2c/pmbus_device.c
@@ -XXX,XX +XXX,XX @@ void pmbus_check_limits(PMBusDevice *pmdev)
      }
  }
-diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
++void pmbus_idle(PMBusDevice *pmdev)
-index XXXXXXX..XXXXXXX 100644
++{
---- a/hw/ssi/aspeed_smc.c
++    pmdev->code = PMBUS_IDLE_STATE;
-+++ b/hw/ssi/aspeed_smc.c
++}
-@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
++
+ /* assert the status_cml error upon receipt of malformed command */
-     /* Setup cs_lines for peripherals */
+ static void pmbus_cml_error(PMBusDevice *pmdev)
-     s->cs_lines = g_new0(qemu_irq, asc->cs_num_max);
+ {
--
+@@ -XXX,XX +XXX,XX @@ static uint8_t pmbus_receive_byte(SMBusDevice *smd)
--    for (i = 0; i < asc->cs_num_max; ++i) {
+         }
--        sysbus_init_irq(sbd, &s->cs_lines[i]);
+         break;
--    }
-+    qdev_init_gpio_out_named(DEVICE(s), s->cs_lines, "cs", asc->cs_num_max);
++    case PMBUS_IDLE_STATE:
++        pmbus_send8(pmdev, PMBUS_ERR_BYTE);
-     /* The memory region for the controller registers */
++        break;
-     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
++
      case PMBUS_CLEAR_FAULTS:              /* Send Byte */
      case PMBUS_PAGE_PLUS_WRITE:           /* Block Write-only */
      case PMBUS_STORE_DEFAULT_ALL:         /* Send Byte */
 --
-.39.2
+.35.3

-New patch
+[PULL 03/19] hw/sensor: Add IC_DEVICE_ID to ISL voltage regulators
+From: Peter Delevoryas <pdel@fb.com>
+This commit adds a passthrough for PMBUS_IC_DEVICE_ID to allow Renesas
+voltage regulators to return the integrated circuit device ID if they
+would like to.
+The behavior is very device specific, so it hasn't been added to the
+general PMBUS model. Additionally, if the device ID hasn't been set,
+then the voltage regulator will respond with the error byte value.  The
+guest error message will change slightly for IC_DEVICE_ID with this
+commit.
+Signed-off-by: Peter Delevoryas <pdel@fb.com>
+Reviewed-by: Titus Rwantare <titusr@google.com>
+Message-Id: <20220701000626.77395-3-me@pjd.dev>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+---
+ include/hw/sensor/isl_pmbus_vr.h |  5 +++++
+ hw/sensor/isl_pmbus_vr.c         | 12 ++++++++++++
+files changed, 17 insertions(+)
+diff --git a/include/hw/sensor/isl_pmbus_vr.h b/include/hw/sensor/isl_pmbus_vr.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/sensor/isl_pmbus_vr.h
++++ b/include/hw/sensor/isl_pmbus_vr.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/i2c/pmbus_device.h"
+ #include "qom/object.h"
++#define TYPE_ISL69259   "isl69259"
+ #define TYPE_ISL69260   "isl69260"
+ #define TYPE_RAA228000  "raa228000"
+ #define TYPE_RAA229004  "raa229004"
++#define ISL_MAX_IC_DEVICE_ID_LEN 16
+ struct ISLState {
+     PMBusDevice parent;
++
++    uint8_t ic_device_id[ISL_MAX_IC_DEVICE_ID_LEN];
++    uint8_t ic_device_id_len;
+ };
+ OBJECT_DECLARE_SIMPLE_TYPE(ISLState, ISL69260)
+diff --git a/hw/sensor/isl_pmbus_vr.c b/hw/sensor/isl_pmbus_vr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sensor/isl_pmbus_vr.c
++++ b/hw/sensor/isl_pmbus_vr.c
+@@ -XXX,XX +XXX,XX @@
+ static uint8_t isl_pmbus_vr_read_byte(PMBusDevice *pmdev)
+ {
++    ISLState *s = ISL69260(pmdev);
++
++    switch (pmdev->code) {
++    case PMBUS_IC_DEVICE_ID:
++        if (!s->ic_device_id_len) {
++            break;
++        }
++        pmbus_send(pmdev, s->ic_device_id, s->ic_device_id_len);
++        pmbus_idle(pmdev);
++        return 0;
++    }
++
+     qemu_log_mask(LOG_GUEST_ERROR,
+                   "%s: reading from unsupported register: 0x%02x\n",
+                   __func__, pmdev->code);
+--
+.35.3

-New patch
+[PULL 04/19] hw/sensor: Add Renesas ISL69259 device model
+From: Peter Delevoryas <pdel@fb.com>
+This adds the ISL69259, using all the same functionality as the existing
+ISL69260 but overriding the IC_DEVICE_ID.
+Signed-off-by: Peter Delevoryas <pdel@fb.com>
+Reviewed-by: Titus Rwantare <titusr@google.com>
+Message-Id: <20220701000626.77395-4-me@pjd.dev>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+---
+ hw/sensor/isl_pmbus_vr.c | 28 ++++++++++++++++++++++++++++
+file changed, 28 insertions(+)
+diff --git a/hw/sensor/isl_pmbus_vr.c b/hw/sensor/isl_pmbus_vr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sensor/isl_pmbus_vr.c
++++ b/hw/sensor/isl_pmbus_vr.c
+@@ -XXX,XX +XXX,XX @@ static void raa228000_exit_reset(Object *obj)
+     pmdev->pages[0].read_temperature_3 = 0;
+ }
++static void isl69259_exit_reset(Object *obj)
++{
++    ISLState *s = ISL69260(obj);
++    static const uint8_t ic_device_id[] = {0x04, 0x00, 0x81, 0xD2, 0x49, 0x3c};
++    g_assert(sizeof(ic_device_id) <= sizeof(s->ic_device_id));
++
++    isl_pmbus_vr_exit_reset(obj);
++
++    s->ic_device_id_len = sizeof(ic_device_id);
++    memcpy(s->ic_device_id, ic_device_id, sizeof(ic_device_id));
++}
++
+ static void isl_pmbus_vr_add_props(Object *obj, uint64_t *flags, uint8_t pages)
+ {
+     PMBusDevice *pmdev = PMBUS_DEVICE(obj);
+@@ -XXX,XX +XXX,XX @@ static void raa229004_class_init(ObjectClass *klass, void *data)
+     isl_pmbus_vr_class_init(klass, data, 2);
+ }
++static void isl69259_class_init(ObjectClass *klass, void *data)
++{
++    ResettableClass *rc = RESETTABLE_CLASS(klass);
++    DeviceClass *dc = DEVICE_CLASS(klass);
++    dc->desc = "Renesas ISL69259 Digital Multiphase Voltage Regulator";
++    rc->phases.exit = isl69259_exit_reset;
++    isl_pmbus_vr_class_init(klass, data, 2);
++}
++
++static const TypeInfo isl69259_info = {
++    .name = TYPE_ISL69259,
++    .parent = TYPE_ISL69260,
++    .class_init = isl69259_class_init,
++};
++
+ static const TypeInfo isl69260_info = {
+     .name = TYPE_ISL69260,
+     .parent = TYPE_PMBUS_DEVICE,
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo raa228000_info = {
+ static void isl_pmbus_vr_register_types(void)
+ {
++    type_register_static(&isl69259_info);
+     type_register_static(&isl69260_info);
+     type_register_static(&raa228000_info);
+     type_register_static(&raa229004_info);
+--
+.35.3

-New patch
+[PULL 05/19] aspeed: Create SRAM name from first CPU index
+From: Peter Delevoryas <peter@pjd.dev>
+To support multiple SoC's running simultaneously, we need a unique name for
+each RAM region. DRAM is created by the machine, but SRAM is created by the
+SoC, since in hardware it is part of the SoC's internals.
+We need a way to uniquely identify each SRAM region though, for VM
+migration. Since each of the SoC's CPU's has an index which identifies it
+uniquely from other CPU's in the machine, we can use the index of any of the
+CPU's in the SoC to uniquely identify differentiate the SRAM name from other
+SoC SRAM's. In this change, I just elected to use the index of the first CPU
+in each SoC.
+Signed-off-by: Peter Delevoryas <peter@pjd.dev>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Message-Id: <20220705191400.41632-3-peter@pjd.dev>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+---
+ hw/arm/aspeed_ast10x0.c | 5 ++++-
+ hw/arm/aspeed_ast2600.c | 5 +++--
+ hw/arm/aspeed_soc.c     | 5 +++--
+files changed, 10 insertions(+), 5 deletions(-)
+diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/aspeed_ast10x0.c
++++ b/hw/arm/aspeed_ast10x0.c
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
+     DeviceState *armv7m;
+     Error *err = NULL;
+     int i;
++    g_autofree char *sram_name = NULL;
+     if (!clock_has_source(s->sysclk)) {
+         error_setg(errp, "sysclk clock must be wired up by the board code");
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
+     sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), &error_abort);
+     /* Internal SRAM */
+-    memory_region_init_ram(&s->sram, NULL, "aspeed.sram", sc->sram_size, &err);
++    sram_name = g_strdup_printf("aspeed.sram.%d",
++                                CPU(s->armv7m.cpu)->cpu_index);
++    memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size, &err);
+     if (err != NULL) {
+         error_propagate(errp, err);
+         return;
+diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/aspeed_ast2600.c
++++ b/hw/arm/aspeed_ast2600.c
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
+     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+     Error *err = NULL;
+     qemu_irq irq;
++    g_autofree char *sram_name = NULL;
+     /* IO space */
+     aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
+     }
+     /* SRAM */
+-    memory_region_init_ram(&s->sram, OBJECT(dev), "aspeed.sram",
+-                           sc->sram_size, &err);
++    sram_name = g_strdup_printf("aspeed.sram.%d", CPU(&s->cpu[0])->cpu_index);
++    memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size, &err);
+     if (err) {
+         error_propagate(errp, err);
+         return;
+diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/aspeed_soc.c
++++ b/hw/arm/aspeed_soc.c
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
+     AspeedSoCState *s = ASPEED_SOC(dev);
+     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+     Error *err = NULL;
++    g_autofree char *sram_name = NULL;
+     /* IO space */
+     aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
+     }
+     /* SRAM */
+-    memory_region_init_ram(&s->sram, OBJECT(dev), "aspeed.sram",
+-                           sc->sram_size, &err);
++    sram_name = g_strdup_printf("aspeed.sram.%d", CPU(&s->cpu[0])->cpu_index);
++    memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size, &err);
+     if (err) {
+         error_propagate(errp, err);
+         return;
+--
+.35.3

-[PULL 09/11] aspeed: Introduce a spi_boot region under the SoC
+[PULL 06/19] aspeed: Refactor UART init for multi-SoC machines
-The default boot address of the Aspeed SoCs is 0x0. For this reason,
+From: Peter Delevoryas <peter@pjd.dev>
-the FMC flash device contents are remapped by HW on the first 256MB of
-the address space. In QEMU, this is currently done in the machine init
+This change moves the code that connects the SoC UART's to serial_hd's
-with the setup of a region alias.
+to the machine.
-Move this code to the SoC and introduce an extra container to prepare
+It makes each UART a proper child member of the SoC, and then allows the
-ground for the boot ROM region which will overlap the FMC flash
+machine to selectively initialize the chardev for each UART with a
-remapping.
+serial_hd.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+This should preserve backwards compatibility, but also allow multi-SoC
 boards to completely change the wiring of serial devices from the
 command line to specific SoC UART's.
 This also removes the uart-default property from the SoC, since the SoC
 doesn't need to know what UART is the "default" on the machine anymore.
 I tested this using the images and commands from the previous
 refactoring, and another test image for the ast1030:
     wget https://github.com/facebook/openbmc/releases/download/v2021.49.0/fuji.mtd
     wget https://github.com/facebook/openbmc/releases/download/v2021.49.0/wedge100.mtd
     wget https://github.com/peterdelevoryas/OpenBIC/releases/download/oby35-cl-2022.13.01/Y35BCL.elf
 Fuji uses UART1:
     qemu-system-arm -machine fuji-bmc \
         -drive file=fuji.mtd,format=raw,if=mtd \
         -nographic
 ast2600-evb uses uart-default=UART5:
     qemu-system-arm -machine ast2600-evb \
         -drive file=fuji.mtd,format=raw,if=mtd \
         -serial null -serial mon:stdio -display none
 Wedge100 uses UART3:
     qemu-system-arm -machine palmetto-bmc \
         -drive file=wedge100.mtd,format=raw,if=mtd \
         -serial null -serial null -serial null \
         -serial mon:stdio -display none
 AST1030 EVB uses UART5:
     qemu-system-arm -machine ast1030-evb \
         -kernel Y35BCL.elf -nographic
 Fixes: 6827ff20b2975 ("hw: aspeed: Init all UART's with serial devices")
 Signed-off-by: Peter Delevoryas <peter@pjd.dev>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-Id: <20220705191400.41632-4-peter@pjd.dev>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- include/hw/arm/aspeed_soc.h |  5 +++++
+ include/hw/arm/aspeed_soc.h |  7 ++++--
- hw/arm/aspeed.c             | 13 +------------
+ hw/arm/aspeed.c             | 22 +++++++++++++---
- hw/arm/aspeed_ast2600.c     | 13 +++++++++++++
+ hw/arm/aspeed_ast10x0.c     |  8 +++++-
- hw/arm/aspeed_soc.c         | 14 ++++++++++++++
+ hw/arm/aspeed_ast2600.c     |  8 +++++-
- hw/arm/fby35.c              |  8 +-------
+ hw/arm/aspeed_soc.c         | 50 +++++++++++++++++++++++++------------
-files changed, 34 insertions(+), 19 deletions(-)
+files changed, 71 insertions(+), 24 deletions(-)
 diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/aspeed_soc.h
 +++ b/include/hw/arm/aspeed_soc.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/misc/aspeed_lpc.h"
+ #include "hw/misc/unimp.h"
+ #include "hw/misc/aspeed_peci.h"
++#include "hw/char/serial.h"
+ #define ASPEED_SPIS_NUM  2
+ #define ASPEED_EHCIS_NUM 2
+ #define ASPEED_WDTS_NUM  4
+ #define ASPEED_CPUS_NUM  2
+ #define ASPEED_MACS_NUM  4
++#define ASPEED_UARTS_NUM 13
+ struct AspeedSoCState {
+     /*< private >*/
 @@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
-     MemoryRegion *dram_mr;
+     AspeedSDHCIState emmc;
-     MemoryRegion dram_container;
+     AspeedLPCState lpc;
-     MemoryRegion sram;
+     AspeedPECIState peci;
-+    MemoryRegion spi_boot_container;
+-    uint32_t uart_default;
-+    MemoryRegion spi_boot;
++    SerialMM uart[ASPEED_UARTS_NUM];
-     AspeedVICState vic;
+     Clock *sysclk;
-     AspeedRtcState rtc;
+     UnimplementedDeviceState iomem;
-     AspeedTimerCtrlState timerctrl;
+     UnimplementedDeviceState video;
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCClass {
  enum {
 +    ASPEED_DEV_SPI_BOOT,
      ASPEED_DEV_IOMEM,
      ASPEED_DEV_UART1,
      ASPEED_DEV_UART2,
 @@ -XXX,XX +XXX,XX @@ enum {
-     ASPEED_DEV_JTAG1,
  };
-+#define ASPEED_SOC_SPI_BOOT_ADDR 0x0
-+
  qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
- bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp);
+-void aspeed_soc_uart_init(AspeedSoCState *s);
- void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr);
++bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp);
 +void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr);
  bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
  void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr);
  void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed.c
 +++ b/hw/arm/aspeed.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/error-report.h"
+ #include "qemu/units.h"
+ #include "hw/qdev-clock.h"
++#include "sysemu/sysemu.h"
+ static struct arm_boot_info aspeed_board_binfo = {
+     .board_id = -1, /* device-tree-only board */
+@@ -XXX,XX +XXX,XX @@ static void sdhci_attach_drive(SDHCIState *sdhci, DriveInfo *dinfo)
+                                &error_fatal);
+ }
++static void connect_serial_hds_to_uarts(AspeedMachineState *bmc)
++{
++    AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(bmc);
++    AspeedSoCState *s = &bmc->soc;
++    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
++
++    aspeed_soc_uart_set_chr(s, amc->uart_default, serial_hd(0));
++    for (int i = 1, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
++        if (uart == amc->uart_default) {
++            continue;
++        }
++        aspeed_soc_uart_set_chr(s, uart, serial_hd(i));
++    }
++}
++
+ static void aspeed_machine_init(MachineState *machine)
+ {
+     AspeedMachineState *bmc = ASPEED_MACHINE(machine);
 @@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-         MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
+         object_property_set_int(OBJECT(&bmc->soc), "hw-prot-key",
-         uint64_t size = memory_region_size(&fl->mmio);
+                                 ASPEED_SCU_PROT_KEY, &error_abort);
+     }
--        /*
+-    qdev_prop_set_uint32(DEVICE(&bmc->soc), "uart-default",
--         * create a ROM region using the default mapping window size of
+-                         amc->uart_default);
--         * the flash module. The window size is 64MB for the AST2400
++    connect_serial_hds_to_uarts(bmc);
--         * SoC and 128MB for the AST2500 SoC, which is twice as big as
+     qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
--         * needed by the flash modules of the Aspeed machines.
--         */
+     aspeed_board_init_flashes(&bmc->soc.fmc,
--        if (ASPEED_MACHINE(machine)->mmio_exec) {
+@@ -XXX,XX +XXX,XX @@ static void aspeed_minibmc_machine_init(MachineState *machine)
--            memory_region_init_alias(boot_rom, NULL, "aspeed.boot_rom",
--                                     &fl->mmio, 0, size);
+     object_property_set_link(OBJECT(&bmc->soc), "memory",
--            memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
+                              OBJECT(get_system_memory()), &error_abort);
--                                        boot_rom);
+-    qdev_prop_set_uint32(DEVICE(&bmc->soc), "uart-default",
--        } else {
+-                         amc->uart_default);
-+        if (!ASPEED_MACHINE(machine)->mmio_exec) {
++    connect_serial_hds_to_uarts(bmc);
-             memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
+     qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
-                                    size, &error_abort);
-             memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
+     aspeed_board_init_flashes(&bmc->soc.fmc,
 diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_ast10x0.c
 +++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_init(Object *obj)
          object_initialize_child(obj, "wdt[*]", &s->wdt[i], typename);
      }
 +    for (i = 0; i < sc->uarts_num; i++) {
 +        object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
 +    }
 +
      snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
      object_initialize_child(obj, "gpio", &s->gpio, typename);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
                                  sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_4));
      /* UART */
 -    aspeed_soc_uart_init(s);
 +    if (!aspeed_soc_uart_realize(s, errp)) {
 +        return;
 +    }
      /* Timer */
      object_property_set_link(OBJECT(&s->timerctrl), "scu", OBJECT(&s->scu),
 diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_ast2600.c
 +++ b/hw/arm/aspeed_ast2600.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
- #define ASPEED_SOC_DPMCU_SIZE       0x00040000
+         object_initialize_child(obj, "mii[*]", &s->mii[i], TYPE_ASPEED_MII);
+     }
- static const hwaddr aspeed_soc_ast2600_memmap[] = {
-+    [ASPEED_DEV_SPI_BOOT]  = ASPEED_SOC_SPI_BOOT_ADDR,
++    for (i = 0; i < sc->uarts_num; i++) {
-     [ASPEED_DEV_SRAM]      = 0x10000000,
++        object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
-     [ASPEED_DEV_DPMCU]     = 0x18000000,
++    }
-     /* 0x16000000     0x17FFFFFF : AHB BUS do LPC Bus bridge */
++
      snprintf(typename, sizeof(typename), TYPE_ASPEED_XDMA "-%s", socname);
      object_initialize_child(obj, "xdma", &s->xdma, typename);
 @@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
-     qemu_irq irq;
+                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
-     g_autofree char *sram_name = NULL;
+     /* UART */
-+    /* Default boot region (SPI memory or ROMs) */
+-    aspeed_soc_uart_init(s);
-+    memory_region_init(&s->spi_boot_container, OBJECT(s),
++    if (!aspeed_soc_uart_realize(s, errp)) {
-+                       "aspeed.spi_boot_container", 0x10000000);
++        return;
-+    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SPI_BOOT],
++    }
-+                                &s->spi_boot_container);
-+
+     /* I2C */
-     /* IO space */
+     object_property_set_link(OBJECT(&s->i2c), "dram", OBJECT(s->dram_mr),
      aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
                                    sc->memmap[ASPEED_DEV_IOMEM],
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                         aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
 +    /* Set up an alias on the FMC CE0 region (boot default) */
 +    MemoryRegion *fmc0_mmio = &s->fmc.flashes[0].mmio;
 +    memory_region_init_alias(&s->spi_boot, OBJECT(s), "aspeed.spi_boot",
 +                             fmc0_mmio, 0, memory_region_size(fmc0_mmio));
 +    memory_region_add_subregion(&s->spi_boot_container, 0x0, &s->spi_boot);
 +
      /* SPI */
      for (i = 0; i < sc->spis_num; i++) {
          object_property_set_link(OBJECT(&s->spi[i]), "dram",
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
- #define ASPEED_SOC_IOMEM_SIZE       0x00200000
+                                 TYPE_FTGMAC100);
+     }
- static const hwaddr aspeed_soc_ast2400_memmap[] = {
-+    [ASPEED_DEV_SPI_BOOT]  =  ASPEED_SOC_SPI_BOOT_ADDR,
++    for (i = 0; i < sc->uarts_num; i++) {
-     [ASPEED_DEV_IOMEM]  = 0x1E600000,
++        object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
-     [ASPEED_DEV_FMC]    = 0x1E620000,
++    }
-     [ASPEED_DEV_SPI1]   = 0x1E630000,
++
-@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2400_memmap[] = {
+     snprintf(typename, sizeof(typename), TYPE_ASPEED_XDMA "-%s", socname);
      object_initialize_child(obj, "xdma", &s->xdma, typename);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
                         aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
      /* UART */
 -    aspeed_soc_uart_init(s);
 +    if (!aspeed_soc_uart_realize(s, errp)) {
 +        return;
 +    }
      /* I2C */
      object_property_set_link(OBJECT(&s->i2c), "dram", OBJECT(s->dram_mr),
@@ -XXX,XX +XXX,XX @@ static Property aspeed_soc_properties[] = {
                       MemoryRegion *),
      DEFINE_PROP_LINK("dram", AspeedSoCState, dram_mr, TYPE_MEMORY_REGION,
                       MemoryRegion *),
 -    DEFINE_PROP_UINT32("uart-default", AspeedSoCState, uart_default,
 -                       ASPEED_DEV_UART5),
      DEFINE_PROP_END_OF_LIST(),
  };
- static const hwaddr aspeed_soc_ast2500_memmap[] = {
+@@ -XXX,XX +XXX,XX @@ qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev)
-+    [ASPEED_DEV_SPI_BOOT]  = ASPEED_SOC_SPI_BOOT_ADDR,
+     return ASPEED_SOC_GET_CLASS(s)->get_irq(s, dev);
-     [ASPEED_DEV_IOMEM]  = 0x1E600000,
+ }
-     [ASPEED_DEV_FMC]    = 0x1E620000,
-     [ASPEED_DEV_SPI1]   = 0x1E630000,
+-void aspeed_soc_uart_init(AspeedSoCState *s)
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
++bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp)
-     Error *err = NULL;
+ {
-     g_autofree char *sram_name = NULL;
+     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+-    int i, uart;
 +    /* Default boot region (SPI memory or ROMs) */
 +    memory_region_init(&s->spi_boot_container, OBJECT(s),
 +                       "aspeed.spi_boot_container", 0x10000000);
 +    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SPI_BOOT],
 +                                &s->spi_boot_container);
 +
      /* IO space */
      aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
                                    sc->memmap[ASPEED_DEV_IOMEM],
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                         aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
 +    /* Set up an alias on the FMC CE0 region (boot default) */
 +    MemoryRegion *fmc0_mmio = &s->fmc.flashes[0].mmio;
 +    memory_region_init_alias(&s->spi_boot, OBJECT(s), "aspeed.spi_boot",
 +                             fmc0_mmio, 0, memory_region_size(fmc0_mmio));
 +    memory_region_add_subregion(&s->spi_boot_container, 0x0, &s->spi_boot);
 +
      /* SPI */
      for (i = 0; i < sc->spis_num; i++) {
          if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
 diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fby35.c
 +++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
          MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
          uint64_t size = memory_region_size(&fl->mmio);
 -        if (s->mmio_exec) {
 -            memory_region_init_alias(boot_rom, NULL, "aspeed.boot_rom",
 -                                     &fl->mmio, 0, size);
 -            memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
 -                                        boot_rom);
 -        } else {
 -
-+        if (!s->mmio_exec) {
+-    /* Attach an 8250 to the IO space as our UART */
-             memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
+-    serial_mm_init(s->memory, sc->memmap[s->uart_default], 2,
-                                    size, &error_abort);
+-                   aspeed_soc_get_irq(s, s->uart_default), 38400,
-             memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
+-                   serial_hd(0), DEVICE_LITTLE_ENDIAN);
 -    for (i = 1, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
 -        if (uart == s->uart_default) {
 -            uart++;
 +    SerialMM *smm;
 +
 +    for (int i = 0, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
 +        smm = &s->uart[i];
 +
 +        /* Chardev property is set by the machine. */
 +        qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
 +        qdev_prop_set_uint32(DEVICE(smm), "baudbase", 38400);
 +        qdev_set_legacy_instance_id(DEVICE(smm), sc->memmap[uart], 2);
 +        qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
 +        if (!sysbus_realize(SYS_BUS_DEVICE(smm), errp)) {
 +            return false;
          }
 -        serial_mm_init(s->memory, sc->memmap[uart], 2,
 -                       aspeed_soc_get_irq(s, uart), 38400,
 -                       serial_hd(i), DEVICE_LITTLE_ENDIAN);
 +
 +        sysbus_connect_irq(SYS_BUS_DEVICE(smm), 0, aspeed_soc_get_irq(s, uart));
 +        aspeed_mmio_map(s, SYS_BUS_DEVICE(smm), 0, sc->memmap[uart]);
      }
 +
 +    return true;
 +}
 +
 +void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr)
 +{
 +    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
 +    int i = dev - ASPEED_DEV_UART1;
 +
 +    g_assert(0 <= i && i < ARRAY_SIZE(s->uart) && i < sc->uarts_num);
 +    qdev_prop_set_chr(DEVICE(&s->uart[i]), "chardev", chr);
  }
  /*
 --
-.39.2
+.35.3

-[PULL 10/11] aspeed: Add a boot_rom overlap region in the SoC spi_boot container
+[PULL 07/19] aspeed: Make aspeed_board_init_flashes public
-To avoid the SPI transactions fetching instructions from the FMC CE0
+From: Peter Delevoryas <peter@pjd.dev>
 flash device and speed up boot, a ROM can be created if a drive is
 available.
-Reverse the logic to allow a machine to boot without a drive, using a
+Signed-off-by: Peter Delevoryas <peter@pjd.dev>
-block device instead :
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Message-Id: <20220705191400.41632-5-peter@pjd.dev>
     -blockdev node-name=fmc0,driver=file,filename=/path/to/flash.img \
     -device mx66u51235f,bus=ssi.0,drive=fmc0
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/arm/aspeed.c | 47 +++++++++++++++++++++++++++--------------------
+ include/hw/arm/aspeed_soc.h | 2 ++
-file changed, 27 insertions(+), 20 deletions(-)
+ hw/arm/aspeed.c             | 2 +-
 files changed, 3 insertions(+), 1 deletion(-)
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/aspeed_soc.h
++++ b/include/hw/arm/aspeed_soc.h
+@@ -XXX,XX +XXX,XX @@ void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr);
+ void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
+                                    const char *name, hwaddr addr,
+                                    uint64_t size);
++void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
++                               unsigned int count, int unit0);
+ #endif /* ASPEED_SOC_H */
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed.c
 +++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_reset_secondary(ARMCPU *cpu,
-     cpu_set_pc(cs, info->smp_loader_start);
- }
--#define FIRMWARE_ADDR 0x0
--
--static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
-+static void write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
-                            Error **errp)
- {
--    BlockBackend *blk = blk_by_legacy_dinfo(dinfo);
-     g_autofree void *storage = NULL;
-     int64_t size;
 @@ -XXX,XX +XXX,XX @@ static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
      rom_add_blob_fixed("aspeed.boot_rom", storage, rom_size, addr);
  }
-+/*
+-static void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
-+ * Create a ROM and copy the flash contents at the expected address
++void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
 + * (0x0). Boots faster than execute-in-place.
 + */
 +static void aspeed_install_boot_rom(AspeedSoCState *soc, BlockBackend *blk,
 +                                    uint64_t rom_size)
 +{
 +    MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
 +
 +    memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom", rom_size,
 +                           &error_abort);
 +    memory_region_add_subregion_overlap(&soc->spi_boot_container, 0,
 +                                        boot_rom, 1);
 +    write_boot_rom(blk, ASPEED_SOC_SPI_BOOT_ADDR, rom_size, &error_abort);
 +}
 +
  void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
                                        unsigned int count, int unit0)
  {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-     AspeedMachineState *bmc = ASPEED_MACHINE(machine);
-     AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(machine);
-     AspeedSoCClass *sc;
--    DriveInfo *drive0 = drive_get(IF_MTD, 0, 0);
      int i;
-     NICInfo *nd = &nd_table[0];
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-                               bmc->spi_model ? bmc->spi_model : amc->spi_model,
-, amc->num_cs);
--    /* Install first FMC flash content as a boot rom. */
--    if (drive0) {
--        AspeedSMCFlash *fl = &bmc->soc.fmc.flashes[0];
--        MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
--        uint64_t size = memory_region_size(&fl->mmio);
--
--        if (!ASPEED_MACHINE(machine)->mmio_exec) {
--            memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
--                                   size, &error_abort);
--            memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
--                                        boot_rom);
--            write_boot_rom(drive0, FIRMWARE_ADDR, size, &error_abort);
--        }
--    }
--
-     if (machine->kernel_filename && sc->num_cpus > 1) {
-         /* With no u-boot we must set up a boot stub for the secondary CPU */
-         MemoryRegion *smpboot = g_new(MemoryRegion, 1);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-                            drive_get(IF_SD, 0, bmc->soc.sdhci.num_slots));
-     }
-+    if (!bmc->mmio_exec) {
-+        DriveInfo *mtd0 = drive_get(IF_MTD, 0, 0);
-+
-+        if (mtd0) {
-+            uint64_t rom_size = memory_region_size(&bmc->soc.spi_boot);
-+            aspeed_install_boot_rom(&bmc->soc, blk_by_legacy_dinfo(mtd0),
-+                                    rom_size);
-+        }
-+    }
-+
-     arm_load_kernel(ARM_CPU(first_cpu), machine, &aspeed_board_binfo);
- }
 --
-.39.2
+.35.3

-[PULL 03/11] hw/misc: add a toy i2c echo device
+[PULL 08/19] aspeed: Add fby35 skeleton
-From: Klaus Jensen <k.jensen@samsung.com>
+From: Peter Delevoryas <peter@pjd.dev>
-Add an example I2C device to demonstrate how a slave may master the bus
+Signed-off-by: Peter Delevoryas <peter@pjd.dev>
-and send data asynchronously to another slave.
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Message-Id: <20220705191400.41632-6-peter@pjd.dev>
 The device will echo whatever it is sent to the device identified by the
 first byte received.
 Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
 [ clg: integrated fixes :
   https://lore.kernel.org/qemu-devel/Y3yMKAhOkYGtnkOp@cormorant.local/ ]
 Message-Id: <20220601210831.67259-7-its@irrelevant.dk>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/misc/i2c-echo.c  | 156 ++++++++++++++++++++++++++++++++++++++++++++
+ hw/arm/fby35.c     | 39 +++++++++++++++++++++++++++++++++++++++
- hw/misc/meson.build |   2 +
+ MAINTAINERS        |  1 +
-files changed, 158 insertions(+)
+ hw/arm/meson.build |  3 ++-
- create mode 100644 hw/misc/i2c-echo.c
+files changed, 42 insertions(+), 1 deletion(-)
  create mode 100644 hw/arm/fby35.c
-diff --git a/hw/misc/i2c-echo.c b/hw/misc/i2c-echo.c
+diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/misc/i2c-echo.c
++++ b/hw/arm/fby35.c
 @@ -XXX,XX +XXX,XX @@
++/*
++ * Copyright (c) Meta Platforms, Inc. and affiliates. (http://www.meta.com)
++ *
++ * This code is licensed under the GPL version 2 or later. See the COPYING
++ * file in the top-level directory.
++ */
++
 +#include "qemu/osdep.h"
-+#include "qemu/timer.h"
++#include "hw/boards.h"
 +#include "qemu/main-loop.h"
 +#include "block/aio.h"
 +#include "hw/i2c/i2c.h"
 +
-+#define TYPE_I2C_ECHO "i2c-echo"
++#define TYPE_FBY35 MACHINE_TYPE_NAME("fby35")
-+OBJECT_DECLARE_SIMPLE_TYPE(I2CEchoState, I2C_ECHO)
++OBJECT_DECLARE_SIMPLE_TYPE(Fby35State, FBY35);
 +
-+enum i2c_echo_state {
++struct Fby35State {
-+    I2C_ECHO_STATE_IDLE,
++    MachineState parent_obj;
 +    I2C_ECHO_STATE_START_SEND,
 +    I2C_ECHO_STATE_ACK,
 +};
 +
-+typedef struct I2CEchoState {
++static void fby35_init(MachineState *machine)
 +    I2CSlave parent_obj;
 +
 +    I2CBus *bus;
 +
 +    enum i2c_echo_state state;
 +    QEMUBH *bh;
 +
 +    unsigned int pos;
 +    uint8_t data[3];
 +} I2CEchoState;
 +
 +static void i2c_echo_bh(void *opaque)
 +{
-+    I2CEchoState *state = opaque;
-+
-+    switch (state->state) {
-+    case I2C_ECHO_STATE_IDLE:
-+        return;
-+
-+    case I2C_ECHO_STATE_START_SEND:
-+        if (i2c_start_send_async(state->bus, state->data[0])) {
-+            goto release_bus;
-+        }
-+
-+        state->pos++;
-+        state->state = I2C_ECHO_STATE_ACK;
-+        return;
-+
-+    case I2C_ECHO_STATE_ACK:
-+        if (state->pos > 2) {
-+            break;
-+        }
-+
-+        if (i2c_send_async(state->bus, state->data[state->pos++])) {
-+            break;
-+        }
-+
-+        return;
-+    }
-+
-+
-+    i2c_end_transfer(state->bus);
-+release_bus:
-+    i2c_bus_release(state->bus);
-+
-+    state->state = I2C_ECHO_STATE_IDLE;
 +}
 +
-+static int i2c_echo_event(I2CSlave *s, enum i2c_event event)
++static void fby35_class_init(ObjectClass *oc, void *data)
 +{
-+    I2CEchoState *state = I2C_ECHO(s);
++    MachineClass *mc = MACHINE_CLASS(oc);
 +
-+    switch (event) {
++    mc->desc = "Meta Platforms fby35";
-+    case I2C_START_RECV:
++    mc->init = fby35_init;
 +        state->pos = 0;
 +
 +        break;
 +
 +    case I2C_START_SEND:
 +        state->pos = 0;
 +
 +        break;
 +
 +    case I2C_FINISH:
 +        state->pos = 0;
 +        state->state = I2C_ECHO_STATE_START_SEND;
 +        i2c_bus_master(state->bus, state->bh);
 +
 +        break;
 +
 +    case I2C_NACK:
 +        break;
 +
 +    default:
 +        return -1;
 +    }
 +
 +    return 0;
 +}
 +
-+static uint8_t i2c_echo_recv(I2CSlave *s)
++static const TypeInfo fby35_types[] = {
-+{
++    {
-+    I2CEchoState *state = I2C_ECHO(s);
++        .name = MACHINE_TYPE_NAME("fby35"),
-+
++        .parent = TYPE_MACHINE,
-+    if (state->pos > 2) {
++        .class_init = fby35_class_init,
-+        return 0xff;
++        .instance_size = sizeof(Fby35State),
-+    }
++    },
 +
 +    return state->data[state->pos++];
 +}
 +
 +static int i2c_echo_send(I2CSlave *s, uint8_t data)
 +{
 +    I2CEchoState *state = I2C_ECHO(s);
 +
 +    if (state->pos > 2) {
 +        return -1;
 +    }
 +
 +    state->data[state->pos++] = data;
 +
 +    return 0;
 +}
 +
 +static void i2c_echo_realize(DeviceState *dev, Error **errp)
 +{
 +    I2CEchoState *state = I2C_ECHO(dev);
 +    BusState *bus = qdev_get_parent_bus(dev);
 +
 +    state->bus = I2C_BUS(bus);
 +    state->bh = qemu_bh_new(i2c_echo_bh, state);
 +
 +    return;
 +}
 +
 +static void i2c_echo_class_init(ObjectClass *oc, void *data)
 +{
 +    I2CSlaveClass *sc = I2C_SLAVE_CLASS(oc);
 +    DeviceClass *dc = DEVICE_CLASS(oc);
 +
 +    dc->realize = i2c_echo_realize;
 +
 +    sc->event = i2c_echo_event;
 +    sc->recv = i2c_echo_recv;
 +    sc->send = i2c_echo_send;
 +}
 +
 +static const TypeInfo i2c_echo = {
 +    .name = TYPE_I2C_ECHO,
 +    .parent = TYPE_I2C_SLAVE,
 +    .instance_size = sizeof(I2CEchoState),
 +    .class_init = i2c_echo_class_init,
 +};
 +
-+static void register_types(void)
++DEFINE_TYPES(fby35_types);
-+{
+diff --git a/MAINTAINERS b/MAINTAINERS
 +    type_register_static(&i2c_echo);
 +}
 +
 +type_init(register_types);
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/meson.build
+--- a/MAINTAINERS
-+++ b/hw/misc/meson.build
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_rng.c'))
+@@ -XXX,XX +XXX,XX @@ F: hw/net/ftgmac100.c
+ F: include/hw/net/ftgmac100.h
- softmmu_ss.add(when: 'CONFIG_GRLIB', if_true: files('grlib_ahb_apb_pnp.c'))
+ F: docs/system/arm/aspeed.rst
+ F: tests/qtest/*aspeed*
-+softmmu_ss.add(when: 'CONFIG_I2C', if_true: files('i2c-echo.c'))
++F: hw/arm/fby35.c
-+
- specific_ss.add(when: 'CONFIG_AVR_POWER', if_true: files('avr_power.c'))
+ NRF51
+ M: Joel Stanley <joel@jms.id.au>
- specific_ss.add(when: 'CONFIG_MAC_VIA', if_true: files('mac_via.c'))
+diff --git a/hw/arm/meson.build b/hw/arm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/meson.build
 +++ b/hw/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
    'aspeed_soc.c',
    'aspeed.c',
    'aspeed_ast2600.c',
 -  'aspeed_ast10x0.c'))
 +  'aspeed_ast10x0.c',
 +  'fby35.c'))
  arm_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2.c'))
  arm_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2-tz.c'))
  arm_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-soc.c'))
 --
-.39.2
+.35.3

-New patch
+[PULL 09/19] aspeed: Add AST2600 (BMC) to fby35
+From: Peter Delevoryas <peter@pjd.dev>
+You can test booting the BMC with both '-device loader' and '-drive
+file'. This is necessary because of how the fb-openbmc boot sequence
+works (jump to 0x20000000 after U-Boot SPL).
+    wget https://github.com/facebook/openbmc/releases/download/openbmc-e2294ff5d31d/fby35.mtd
+    qemu-system-arm -machine fby35 -nographic \
+        -device loader,file=fby35.mtd,addr=0,cpu-num=0 -drive file=fby35.mtd,format=raw,if=mtd
+Signed-off-by: Peter Delevoryas <peter@pjd.dev>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Message-Id: <20220705191400.41632-7-peter@pjd.dev>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+---
+ hw/arm/fby35.c | 41 +++++++++++++++++++++++++++++++++++++++++
+file changed, 41 insertions(+)
+diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/fby35.c
++++ b/hw/arm/fby35.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
++#include "qemu/units.h"
++#include "qapi/error.h"
++#include "sysemu/sysemu.h"
+ #include "hw/boards.h"
++#include "hw/arm/aspeed_soc.h"
+ #define TYPE_FBY35 MACHINE_TYPE_NAME("fby35")
+ OBJECT_DECLARE_SIMPLE_TYPE(Fby35State, FBY35);
+ struct Fby35State {
+     MachineState parent_obj;
++
++    MemoryRegion bmc_memory;
++    MemoryRegion bmc_dram;
++    MemoryRegion bmc_boot_rom;
++
++    AspeedSoCState bmc;
+ };
++#define FBY35_BMC_RAM_SIZE (2 * GiB)
++
++static void fby35_bmc_init(Fby35State *s)
++{
++    memory_region_init(&s->bmc_memory, OBJECT(s), "bmc-memory", UINT64_MAX);
++    memory_region_init_ram(&s->bmc_dram, OBJECT(s), "bmc-dram",
++                           FBY35_BMC_RAM_SIZE, &error_abort);
++
++    object_initialize_child(OBJECT(s), "bmc", &s->bmc, "ast2600-a3");
++    object_property_set_int(OBJECT(&s->bmc), "ram-size", FBY35_BMC_RAM_SIZE,
++                            &error_abort);
++    object_property_set_link(OBJECT(&s->bmc), "memory", OBJECT(&s->bmc_memory),
++                             &error_abort);
++    object_property_set_link(OBJECT(&s->bmc), "dram", OBJECT(&s->bmc_dram),
++                             &error_abort);
++    object_property_set_int(OBJECT(&s->bmc), "hw-strap1", 0x000000C0,
++                            &error_abort);
++    object_property_set_int(OBJECT(&s->bmc), "hw-strap2", 0x00000003,
++                            &error_abort);
++    aspeed_soc_uart_set_chr(&s->bmc, ASPEED_DEV_UART5, serial_hd(0));
++    qdev_realize(DEVICE(&s->bmc), NULL, &error_abort);
++
++    aspeed_board_init_flashes(&s->bmc.fmc, "n25q00", 2, 0);
++}
++
+ static void fby35_init(MachineState *machine)
+ {
++    Fby35State *s = FBY35(machine);
++
++    fby35_bmc_init(s);
+ }
+ static void fby35_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void fby35_class_init(ObjectClass *oc, void *data)
+     mc->desc = "Meta Platforms fby35";
+     mc->init = fby35_init;
++    mc->no_floppy = 1;
++    mc->no_cdrom = 1;
++    mc->min_cpus = mc->max_cpus = mc->default_cpus = 2;
+ }
+ static const TypeInfo fby35_types[] = {
+--
+.35.3

-[PULL 07/11] hw/at24c : modify at24c to support 1 byte address mode
+[PULL 10/19] aspeed: fby35: Add a bootrom for the BMC
-From: Sittisak Sinprem <ssinprem@celestica.com>
+The BMC boots from the first flash device by fetching instructions
 from the flash contents. Add an alias region on 0x0 for this
 purpose. There are currently performance issues with this method (TBs
 being flushed too often), so as a faster alternative, install the
 flash contents as a ROM in the BMC memory space.
-Signed-off-by: Sittisak Sinprem <ssinprem@celestica.com>
+See commit 1a15311a12fa ("hw/arm/aspeed: add a 'execute-in-place'
-Reviewed-by: Peter Delevoryas <peter@pjd.dev>
+property to boot directly from CE0")
-[ clg: checkpatch issues ]
-Message-Id: <167660539263.10409.9736070122710923479-1@git.sr.ht>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Delevoryas <peter@pjd.dev>
 [ clg: blk_pread() fixes ]
 Message-Id: <20220705191400.41632-8-peter@pjd.dev>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/nvram/eeprom_at24c.c | 30 +++++++++++++++++++++++++++---
+ hw/arm/fby35.c | 83 ++++++++++++++++++++++++++++++++++++++++++++++++++
-file changed, 27 insertions(+), 3 deletions(-)
+file changed, 83 insertions(+)
-diff --git a/hw/nvram/eeprom_at24c.c b/hw/nvram/eeprom_at24c.c
+diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/nvram/eeprom_at24c.c
+--- a/hw/arm/fby35.c
-+++ b/hw/nvram/eeprom_at24c.c
++++ b/hw/arm/fby35.c
-@@ -XXX,XX +XXX,XX @@ struct EEPROMState {
+@@ -XXX,XX +XXX,XX @@
-     uint16_t cur;
+ #include "qemu/units.h"
-     /* total size in bytes */
+ #include "qapi/error.h"
-     uint32_t rsize;
+ #include "sysemu/sysemu.h"
-+    /*
++#include "sysemu/block-backend.h"
-+     * address byte number
+ #include "hw/boards.h"
-+     *  for  24c01, 24c02 size <= 256 byte, use only 1 byte
+ #include "hw/arm/aspeed_soc.h"
-+     *  otherwise size > 256, use 2 byte
-+     */
+@@ -XXX,XX +XXX,XX @@ struct Fby35State {
-+    uint8_t asize;
+     MemoryRegion bmc_boot_rom;
      AspeedSoCState bmc;
 +
-     bool writable;
++    bool mmio_exec;
-     /* cells changed since last START? */
+ };
-     bool changed;
-@@ -XXX,XX +XXX,XX @@ uint8_t at24c_eeprom_recv(I2CSlave *s)
+ #define FBY35_BMC_RAM_SIZE (2 * GiB)
-     EEPROMState *ee = AT24C_EE(s);
++#define FBY35_BMC_FIRMWARE_ADDR 0x0
-     uint8_t ret;
++
++static void fby35_bmc_write_boot_rom(DriveInfo *dinfo, MemoryRegion *mr,
--    if (ee->haveaddr == 1) {
++                                     hwaddr offset, size_t rom_size,
-+    /*
++                                     Error **errp)
-+     * If got the byte address but not completely with address size
++{
-+     * will return the invalid value
++    BlockBackend *blk = blk_by_legacy_dinfo(dinfo);
-+     */
++    g_autofree void *storage = NULL;
-+    if (ee->haveaddr > 0 && ee->haveaddr < ee->asize) {
++    int64_t size;
          return 0xff;
      }
@@ -XXX,XX +XXX,XX @@ int at24c_eeprom_send(I2CSlave *s, uint8_t data)
  {
      EEPROMState *ee = AT24C_EE(s);
 -    if (ee->haveaddr < 2) {
 +    if (ee->haveaddr < ee->asize) {
          ee->cur <<= 8;
          ee->cur |= data;
          ee->haveaddr++;
 -        if (ee->haveaddr == 2) {
 +        if (ee->haveaddr == ee->asize) {
              ee->cur %= ee->rsize;
              DPRINTK("Set pointer %04x\n", ee->cur);
          }
@@ -XXX,XX +XXX,XX @@ static void at24c_eeprom_realize(DeviceState *dev, Error **errp)
          }
          DPRINTK("Reset read backing file\n");
      }
 +
 +    /*
-+     * If address size didn't define with property set
++     * The block backend size should have already been 'validated' by
-+     *   value is 0 as default, setting it by Rom size detecting.
++     * the creation of the m25p80 object.
 +     */
-+    if (ee->asize == 0) {
++    size = blk_getlength(blk);
-+        if (ee->rsize <= 256) {
++    if (size <= 0) {
-+            ee->asize = 1;
++        error_setg(errp, "failed to get flash size");
 +        return;
 +    }
 +
 +    if (rom_size > size) {
 +        rom_size = size;
 +    }
 +
 +    storage = g_malloc0(rom_size);
 +    if (blk_pread(blk, 0, rom_size, storage, 0) < 0) {
 +        error_setg(errp, "failed to read the initial flash content");
 +        return;
 +    }
 +
 +    /* TODO: find a better way to install the ROM */
 +    memcpy(memory_region_get_ram_ptr(mr) + offset, storage, rom_size);
 +}
  static void fby35_bmc_init(Fby35State *s)
  {
 +    DriveInfo *drive0 = drive_get(IF_MTD, 0, 0);
 +
      memory_region_init(&s->bmc_memory, OBJECT(s), "bmc-memory", UINT64_MAX);
      memory_region_init_ram(&s->bmc_dram, OBJECT(s), "bmc-dram",
                             FBY35_BMC_RAM_SIZE, &error_abort);
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
      qdev_realize(DEVICE(&s->bmc), NULL, &error_abort);
      aspeed_board_init_flashes(&s->bmc.fmc, "n25q00", 2, 0);
 +
 +    /* Install first FMC flash content as a boot rom. */
 +    if (drive0) {
 +        AspeedSMCFlash *fl = &s->bmc.fmc.flashes[0];
 +        MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
 +        uint64_t size = memory_region_size(&fl->mmio);
 +
 +        if (s->mmio_exec) {
 +            memory_region_init_alias(boot_rom, NULL, "aspeed.boot_rom",
 +                                     &fl->mmio, 0, size);
 +            memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
 +                                        boot_rom);
 +        } else {
-+            ee->asize = 2;
++
 +            memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
 +                                   size, &error_abort);
 +            memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
 +                                        boot_rom);
 +            fby35_bmc_write_boot_rom(drive0, boot_rom, FBY35_BMC_FIRMWARE_ADDR,
 +                                     size, &error_abort);
 +        }
 +    }
  }
- static
+ static void fby35_init(MachineState *machine)
-@@ -XXX,XX +XXX,XX @@ void at24c_eeprom_reset(DeviceState *state)
+@@ -XXX,XX +XXX,XX @@ static void fby35_init(MachineState *machine)
+     fby35_bmc_init(s);
- static Property at24c_eeprom_props[] = {
+ }
-     DEFINE_PROP_UINT32("rom-size", EEPROMState, rsize, 0),
-+    DEFINE_PROP_UINT8("address-size", EEPROMState, asize, 0),
++
-     DEFINE_PROP_BOOL("writable", EEPROMState, writable, true),
++static bool fby35_get_mmio_exec(Object *obj, Error **errp)
-     DEFINE_PROP_DRIVE("drive", EEPROMState, blk),
++{
-     DEFINE_PROP_END_OF_LIST()
++    return FBY35(obj)->mmio_exec;
 +}
 +
 +static void fby35_set_mmio_exec(Object *obj, bool value, Error **errp)
 +{
 +    FBY35(obj)->mmio_exec = value;
 +}
 +
 +static void fby35_instance_init(Object *obj)
 +{
 +    FBY35(obj)->mmio_exec = false;
 +}
 +
  static void fby35_class_init(ObjectClass *oc, void *data)
  {
      MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void fby35_class_init(ObjectClass *oc, void *data)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->min_cpus = mc->max_cpus = mc->default_cpus = 2;
 +
 +    object_class_property_add_bool(oc, "execute-in-place",
 +                                   fby35_get_mmio_exec,
 +                                   fby35_set_mmio_exec);
 +    object_class_property_set_description(oc, "execute-in-place",
 +                           "boot directly from CE0 flash device");
  }
  static const TypeInfo fby35_types[] = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo fby35_types[] = {
          .parent = TYPE_MACHINE,
          .class_init = fby35_class_init,
          .instance_size = sizeof(Fby35State),
 +        .instance_init = fby35_instance_init,
      },
  };
 --
-.39.2
+.35.3

-New patch
+[PULL 11/19] aspeed: Add AST1030 (BIC) to fby35
+From: Peter Delevoryas <peter@pjd.dev>
+With the BIC, the easiest way to run everything is to create two pty's
+for each SoC and reserve stdin/stdout for the monitor:
+    wget https://github.com/facebook/openbmc/releases/download/openbmc-e2294ff5d31d/fby35.mtd
+    wget https://github.com/peterdelevoryas/OpenBIC/releases/download/oby35-cl-2022.13.01/Y35BCL.elf
+    qemu-system-arm -machine fby35 \
+        -drive file=fby35.mtd,format=raw,if=mtd \
+        -device loader,file=fby35.mtd,addr=0,cpu-num=0 \
+        -serial pty -serial pty -serial mon:stdio -display none -S
+    screen /dev/ttys0
+    screen /dev/ttys1
+    (qemu) c
+This commit only adds the the first server board's Bridge IC, but in the
+future we'll try to include the other three server board Bridge IC's
+too.
+Signed-off-by: Peter Delevoryas <peter@pjd.dev>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Message-Id: <20220705191400.41632-9-peter@pjd.dev>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+---
+ hw/arm/fby35.c | 27 ++++++++++++++++++++++++++-
+file changed, 26 insertions(+), 1 deletion(-)
+diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/fby35.c
++++ b/hw/arm/fby35.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/sysemu.h"
+ #include "sysemu/block-backend.h"
+ #include "hw/boards.h"
++#include "hw/qdev-clock.h"
+ #include "hw/arm/aspeed_soc.h"
++#include "hw/arm/boot.h"
+ #define TYPE_FBY35 MACHINE_TYPE_NAME("fby35")
+ OBJECT_DECLARE_SIMPLE_TYPE(Fby35State, FBY35);
+@@ -XXX,XX +XXX,XX @@ struct Fby35State {
+     MemoryRegion bmc_memory;
+     MemoryRegion bmc_dram;
+     MemoryRegion bmc_boot_rom;
++    MemoryRegion bic_memory;
++    Clock *bic_sysclk;
+     AspeedSoCState bmc;
++    AspeedSoCState bic;
+     bool mmio_exec;
+ };
+@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
+     }
+ }
++static void fby35_bic_init(Fby35State *s)
++{
++    s->bic_sysclk = clock_new(OBJECT(s), "SYSCLK");
++    clock_set_hz(s->bic_sysclk, 200000000ULL);
++
++    memory_region_init(&s->bic_memory, OBJECT(s), "bic-memory", UINT64_MAX);
++
++    object_initialize_child(OBJECT(s), "bic", &s->bic, "ast1030-a1");
++    qdev_connect_clock_in(DEVICE(&s->bic), "sysclk", s->bic_sysclk);
++    object_property_set_link(OBJECT(&s->bic), "memory", OBJECT(&s->bic_memory),
++                             &error_abort);
++    aspeed_soc_uart_set_chr(&s->bic, ASPEED_DEV_UART5, serial_hd(1));
++    qdev_realize(DEVICE(&s->bic), NULL, &error_abort);
++
++    aspeed_board_init_flashes(&s->bic.fmc, "sst25vf032b", 2, 2);
++    aspeed_board_init_flashes(&s->bic.spi[0], "sst25vf032b", 2, 4);
++    aspeed_board_init_flashes(&s->bic.spi[1], "sst25vf032b", 2, 6);
++}
++
+ static void fby35_init(MachineState *machine)
+ {
+     Fby35State *s = FBY35(machine);
+     fby35_bmc_init(s);
++    fby35_bic_init(s);
+ }
+@@ -XXX,XX +XXX,XX @@ static void fby35_class_init(ObjectClass *oc, void *data)
+     mc->init = fby35_init;
+     mc->no_floppy = 1;
+     mc->no_cdrom = 1;
+-    mc->min_cpus = mc->max_cpus = mc->default_cpus = 2;
++    mc->min_cpus = mc->max_cpus = mc->default_cpus = 3;
+     object_class_property_add_bool(oc, "execute-in-place",
+                                    fby35_get_mmio_exec,
+--
+.35.3

-[PULL 06/11] hw/arm/aspeed: Adding new machine Tiogapass in QEMU
+[PULL 12/19] docs: aspeed: Add fby35 multi-SoC machine section
-From: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
+From: Peter Delevoryas <peter@pjd.dev>
-This patch support Tiogapass in QEMU environment.
+Signed-off-by: Peter Delevoryas <peter@pjd.dev>
-and introduced EEPROM BMC FRU data support "add tiogapass_bmc_fruid data"
+Reviewed-by: Joel Stanley <joel@jms.id.au>
 along with the machine support.
 Signed-off-by: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
-[ clg: - commit log topic update
+[ clg: - fixed URL links
-       - checkpatch issues
+       - Moved Facebook Yosemite section at the end of the file ]
-       - Documentation update ]
+Message-Id: <20220705191400.41632-10-peter@pjd.dev>
 Message-Id: <20230216184342.253868-1-pkarthikeyan1509@gmail.com>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- docs/system/arm/aspeed.rst |  1 +
+ docs/system/arm/aspeed.rst | 48 ++++++++++++++++++++++++++++++++++++++
- hw/arm/aspeed_eeprom.h     |  3 +++
+file changed, 48 insertions(+)
  hw/arm/aspeed.c            | 32 ++++++++++++++++++++++++++++++++
  hw/arm/aspeed_eeprom.c     | 22 ++++++++++++++++++++++
 files changed, 58 insertions(+)
 diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/arm/aspeed.rst
 +++ b/docs/system/arm/aspeed.rst
-@@ -XXX,XX +XXX,XX @@ AST2500 SoC based machines :
+@@ -XXX,XX +XXX,XX @@ To boot a kernel directly from a Zephyr build tree:
- - ``fp5280g2-bmc``         Inspur FP5280G2 BMC
- - ``g220a-bmc``            Bytedance G220A BMC
+   $ qemu-system-arm -M ast1030-evb -nographic \
- - ``yosemitev2-bmc``       Facebook YosemiteV2 BMC
+         -kernel zephyr.elf
 +- ``tiogapass-bmc``        Facebook Tiogapass BMC
  AST2600 SoC based machines :
 diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_eeprom.h
 +++ b/hw/arm/aspeed_eeprom.h
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
 +extern const uint8_t tiogapass_bmc_fruid[];
 +extern const size_t tiogapass_bmc_fruid_len;
 +
- extern const uint8_t fby35_nic_fruid[];
++Facebook Yosemite v3.5 Platform and CraterLake Server (``fby35``)
- extern const uint8_t fby35_bb_fruid[];
++==================================================================
  extern const uint8_t fby35_bmc_fruid[];
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed.c
 +++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
      i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "ds1338", 0x32);
  }
 +static void tiogapass_bmc_i2c_init(AspeedMachineState *bmc)
 +{
 +    AspeedSoCState *soc = &bmc->soc;
 +
-+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54, 128 * KiB);
++Facebook has a series of multi-node compute server designs named
-+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 6), 0x54, 128 * KiB,
++Yosemite. The most recent version released was
-+                          tiogapass_bmc_fruid, tiogapass_bmc_fruid_len);
++`Yosemite v3 <https://www.opencompute.org/documents/ocp-yosemite-v3-platform-design-specification-1v16-pdf>`__.
 +}
 +
- static void create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
++Yosemite v3.5 is an iteration on this design, and is very similar: there's a
- {
++baseboard with a BMC, and 4 server slots. The new server board design termed
-     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, bus_id),
++"CraterLake" includes a Bridge IC (BIC), with room for expansion boards to
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_romulus_class_init(ObjectClass *oc, void *data)
++include various compute accelerators (video, inferencing, etc). At the moment,
-         aspeed_soc_num_cpus(amc->soc_name);
++only the first server slot's BIC is included.
  };
 +static void aspeed_machine_tiogapass_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
 +
-+    mc->desc       = "Facebook Tiogapass BMC (ARM1176)";
++Yosemite v3.5 is itself a sled which fits into a 40U chassis, and 3 sleds
-+    amc->soc_name  = "ast2500-a1";
++can be fit into a chassis. See `here <https://www.opencompute.org/products/423/wiwynn-yosemite-v3-server>`__
-+    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
++for an example.
 +    amc->hw_strap2 = 0;
 +    amc->fmc_model = "n25q256a";
 +    amc->spi_model = "mx25l25635e";
 +    amc->num_cs    = 2;
 +    amc->i2c_init  = tiogapass_bmc_i2c_init;
 +    mc->default_ram_size       = 1 * GiB;
 +    mc->default_cpus = mc->min_cpus = mc->max_cpus =
 +        aspeed_soc_num_cpus(amc->soc_name);
 +        aspeed_soc_num_cpus(amc->soc_name);
 +};
 +
- static void aspeed_machine_sonorapass_class_init(ObjectClass *oc, void *data)
++In this generation, the BMC is an AST2600 and each BIC is an AST1030. The BMC
- {
++runs `OpenBMC <https://github.com/facebook/openbmc>`__, and the BIC runs
-     MachineClass *mc = MACHINE_CLASS(oc);
++`OpenBIC <https://github.com/facebook/openbic>`__.
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
          .name          = MACHINE_TYPE_NAME("tacoma-bmc"),
          .parent        = TYPE_ASPEED_MACHINE,
          .class_init    = aspeed_machine_tacoma_class_init,
 +    }, {
 +        .name          = MACHINE_TYPE_NAME("tiogapass-bmc"),
 +        .parent        = TYPE_ASPEED_MACHINE,
 +        .class_init    = aspeed_machine_tiogapass_class_init,
      }, {
          .name          = MACHINE_TYPE_NAME("g220a-bmc"),
          .parent        = TYPE_ASPEED_MACHINE,
 diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_eeprom.c
 +++ b/hw/arm/aspeed_eeprom.c
@@ -XXX,XX +XXX,XX @@
  #include "aspeed_eeprom.h"
 +/* Tiogapass BMC FRU */
 +const uint8_t tiogapass_bmc_fruid[] = {
 +    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
 +    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
 +    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
 +    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
 +    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x54, 0x69, 0x6f, 0x67, 0x61,
 +    0x20, 0x50, 0x61, 0x73, 0x73, 0x20, 0x53, 0x69, 0x6e, 0x67, 0x6c, 0x65,
 +    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
 +    0x58, 0x58, 0x58, 0x58, 0xc4, 0x58, 0x58, 0x58, 0x32, 0xcd, 0x58, 0x58,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
 +    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
 +};
 +
- const uint8_t fby35_nic_fruid[] = {
++Firmware images can be retrieved from the Github releases or built from the
-x01, 0x00, 0x00, 0x01, 0x0f, 0x20, 0x00, 0xcf, 0x01, 0x0e, 0x19, 0xd7,
++source code, see the README's for instructions on that. This image uses the
-x5e, 0xcf, 0xc8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xdd,
++"fby35" machine recipe from OpenBMC, and the "yv35-cl" target from OpenBIC.
-@@ -XXX,XX +XXX,XX @@ const uint8_t yosemitev2_bmc_fruid[] = {
++Some reference images can also be found here:
-x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
++
- };
++.. code-block:: bash
++
-+const size_t tiogapass_bmc_fruid_len = sizeof(tiogapass_bmc_fruid);
++    $ wget https://github.com/facebook/openbmc/releases/download/openbmc-e2294ff5d31d/fby35.mtd
- const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
++    $ wget https://github.com/peterdelevoryas/OpenBIC/releases/download/oby35-cl-2022.13.01/Y35BCL.elf
- const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
++
- const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
++Since this machine has multiple SoC's, each with their own serial console, the
 +recommended way to run it is to allocate a pseudoterminal for each serial
 +console and let the monitor use stdio. Also, starting in a paused state is
 +useful because it allows you to attach to the pseudoterminals before the boot
 +process starts.
 +
 +.. code-block:: bash
 +
 +    $ qemu-system-arm -machine fby35 \
 +        -drive file=fby35.mtd,format=raw,if=mtd \
 +        -device loader,file=Y35BCL.elf,addr=0,cpu-num=2 \
 +        -serial pty -serial pty -serial mon:stdio \
 +        -display none -S
 +    $ screen /dev/tty0 # In a separate TMUX pane, terminal window, etc.
 +    $ screen /dev/tty1
 +    $ (qemu) c           # Start the boot process once screen is setup.
 --
-.39.2
+.35.3

-[PULL 05/11] hw/arm/aspeed: Adding new machine Yosemitev2 in QEMU
+[PULL 13/19] docs: aspeed: Minor updates
-From: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
+Some more controllers have been modeled recently. Reflect that in the
 list of supported devices. New machines were also added.
-This patch support Yosemitev2 in QEMU environment.
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
-and introduced EEPROM BMC FRU data support "add fbyv2_bmc_fruid data"
+Reviewed-by: Peter Delevoryas <peter@pjd.dev>
-along with the machine support.
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Message-Id: <20220706172131.809255-1-clg@kaod.org>
 Signed-off-by: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 [ clg: - commit log topic update
        - Documentation update ]
 Message-Id: <20230216133326.216017-1-pkarthikeyan1509@gmail.com>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- docs/system/arm/aspeed.rst |  1 +
+ docs/system/arm/aspeed.rst | 14 ++++++++++----
- hw/arm/aspeed_eeprom.h     |  3 +++
+file changed, 10 insertions(+), 4 deletions(-)
  hw/arm/aspeed.c            | 31 +++++++++++++++++++++++++++++++
  hw/arm/aspeed_eeprom.c     | 23 +++++++++++++++++++++++
 files changed, 58 insertions(+)
 diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/arm/aspeed.rst
 +++ b/docs/system/arm/aspeed.rst
-@@ -XXX,XX +XXX,XX @@ AST2500 SoC based machines :
+@@ -XXX,XX +XXX,XX @@ AST2600 SoC based machines :
- - ``sonorapass-bmc``       OCP SonoraPass BMC
+ - ``tacoma-bmc``           OpenPOWER Witherspoon POWER9 AST2600 BMC
- - ``fp5280g2-bmc``         Inspur FP5280G2 BMC
+ - ``rainier-bmc``          IBM Rainier POWER10 BMC
- - ``g220a-bmc``            Bytedance G220A BMC
+ - ``fuji-bmc``             Facebook Fuji BMC
-+- ``yosemitev2-bmc``       Facebook YosemiteV2 BMC
++- ``bletchley-bmc``        Facebook Bletchley BMC
+ - ``fby35-bmc``            Facebook fby35 BMC
- AST2600 SoC based machines :
++- ``qcom-dc-scm-v1-bmc``   Qualcomm DC-SCM V1 BMC
++- ``qcom-firework-bmc``    Qualcomm Firework BMC
-diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
-index XXXXXXX..XXXXXXX 100644
+ Supported devices
---- a/hw/arm/aspeed_eeprom.h
+ -----------------
-+++ b/hw/arm/aspeed_eeprom.h
+@@ -XXX,XX +XXX,XX @@ Supported devices
-@@ -XXX,XX +XXX,XX @@ extern const size_t fby35_nic_fruid_len;
+  * Interrupt Controller (VIC)
- extern const size_t fby35_bb_fruid_len;
+  * Timer Controller
- extern const size_t fby35_bmc_fruid_len;
+  * RTC Controller
+- * I2C Controller
-+extern const uint8_t yosemitev2_bmc_fruid[];
++ * I2C Controller, including the new register interface of the AST2600
-+extern const size_t yosemitev2_bmc_fruid_len;
+  * System Control Unit (SCU)
-+
+  * SRAM mapping
- #endif
+  * X-DMA Controller (basic interface)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+@@ -XXX,XX +XXX,XX @@ Supported devices
-index XXXXXXX..XXXXXXX 100644
+  * LPC Peripheral Controller (a subset of subdevices are supported)
---- a/hw/arm/aspeed.c
+  * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA
-+++ b/hw/arm/aspeed.c
+  * ADC
-@@ -XXX,XX +XXX,XX @@ static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
++ * Secure Boot Controller (AST2600)
-                      TYPE_TMP105, 0x4d);
++ * eMMC Boot Controller (dummy)
- }
++ * PECI Controller (minimal)
++ * I3C Controller
-+static void yosemitev2_bmc_i2c_init(AspeedMachineState *bmc)
-+{
-+    AspeedSoCState *soc = &bmc->soc;
+ Missing devices
-+
+@@ -XXX,XX +XXX,XX @@ Missing devices
-+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x51, 128 * KiB);
+  * Super I/O Controller
-+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x51, 128 * KiB,
+  * PCI-Express 1 Controller
-+                          yosemitev2_bmc_fruid, yosemitev2_bmc_fruid_len);
+  * Graphic Display Controller
-+}
+- * PECI Controller
-+
+  * MCTP Controller
- static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
+  * Mailbox Controller
- {
+  * Virtual UART
-     AspeedSoCState *soc = &bmc->soc;
+  * eSPI Controller
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc, void *data)
+- * I3C Controller
-         aspeed_soc_num_cpus(amc->soc_name);
- };
+ Boot options
+ ------------
-+static void aspeed_machine_yosemitev2_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ Supported devices
-+{
+  * LPC Peripheral Controller (a subset of subdevices are supported)
-+    MachineClass *mc = MACHINE_CLASS(oc);
+  * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA
-+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+  * ADC
-+
++ * Secure Boot Controller
-+    mc->desc       = "Facebook YosemiteV2 BMC (ARM1176)";
++ * PECI Controller (minimal)
-+    amc->soc_name  = "ast2500-a1";
-+    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
-+    amc->hw_strap2 = 0;
+ Missing devices
-+    amc->fmc_model = "n25q256a";
+@@ -XXX,XX +XXX,XX @@ Missing devices
-+    amc->spi_model = "mx25l25635e";
-+    amc->num_cs    = 2;
+  * PWM and Fan Controller
-+    amc->i2c_init  = yosemitev2_bmc_i2c_init;
+  * Slave GPIO Controller
-+    mc->default_ram_size       = 512 * MiB;
+- * PECI Controller
-+    mc->default_cpus = mc->min_cpus = mc->max_cpus =
+  * Mailbox Controller
-+        aspeed_soc_num_cpus(amc->soc_name);
+  * Virtual UART
-+};
+  * eSPI Controller
 +
  static void aspeed_machine_romulus_class_init(ObjectClass *oc, void *data)
  {
      MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
          .name          = MACHINE_TYPE_NAME("ast2600-evb"),
          .parent        = TYPE_ASPEED_MACHINE,
          .class_init    = aspeed_machine_ast2600_evb_class_init,
 +    }, {
 +        .name          = MACHINE_TYPE_NAME("yosemitev2-bmc"),
 +        .parent        = TYPE_ASPEED_MACHINE,
 +        .class_init    = aspeed_machine_yosemitev2_class_init,
      }, {
          .name          = MACHINE_TYPE_NAME("tacoma-bmc"),
          .parent        = TYPE_ASPEED_MACHINE,
 diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_eeprom.c
 +++ b/hw/arm/aspeed_eeprom.c
@@ -XXX,XX +XXX,XX @@ const uint8_t fby35_bmc_fruid[] = {
 x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
  };
 +/* Yosemite V2 BMC FRU */
 +const uint8_t yosemitev2_bmc_fruid[] = {
 +    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
 +    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
 +    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
 +    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
 +    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x59, 0x6f, 0x73, 0x65, 0x6d,
 +    0x69, 0x74, 0x65, 0x20, 0x56, 0x32, 0x2e, 0x30, 0x20, 0x45, 0x56, 0x54,
 +    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
 +    0x58, 0x58, 0x58, 0x58, 0xc4, 0x45, 0x56, 0x54, 0x32, 0xcd, 0x58, 0x58,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
 +    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
 +    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
 +};
 +
  const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
  const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
  const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
 +
 +const size_t yosemitev2_bmc_fruid_len = sizeof(yosemitev2_bmc_fruid);
 --
-.39.2
+.35.3

-[PULL 04/11] tests/avocado/machine_aspeed.py: Add an I2C slave test
+[PULL 14/19] test/avocado/machine_aspeed.py: Add SDK tests
-The Aspeed 2600 I2C controller supports a slave mode which can be
+The Aspeed SDK kernel usually includes support for the lastest HW
-tested with the I2C echo device. Test extracted from :
+features. This is interesting to exercise QEMU and discover the gaps
 in the models.
-  https://lists.nongnu.org/archive/html/qemu-devel/2022-06/msg00183.html
+Add extra I2C tests for the AST2600 EVB machine to check the new
 register interface.
-Suggested-by: Klaus Jensen <k.jensen@samsung.com>
+Message-Id: <20220707091239.1029561-1-clg@kaod.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- tests/avocado/machine_aspeed.py | 10 ++++++++++
+ tests/avocado/machine_aspeed.py | 68 +++++++++++++++++++++++++++++++++
-file changed, 10 insertions(+)
+file changed, 68 insertions(+)
 diff --git a/tests/avocado/machine_aspeed.py b/tests/avocado/machine_aspeed.py
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/avocado/machine_aspeed.py
 +++ b/tests/avocado/machine_aspeed.py
-@@ -XXX,XX +XXX,XX @@ def test_arm_ast2600_evb_buildroot(self):
+@@ -XXX,XX +XXX,XX @@ def test_arm_ast2600_evb_builroot(self):
-                          'tmp105,bus=aspeed.i2c.bus.3,address=0x4d,id=tmp-test');
+         exec_command_and_wait_for_pattern(self, 'hwclock -f /dev/rtc1', year);
-         self.vm.add_args('-device',
-                          'ds1338,bus=aspeed.i2c.bus.3,address=0x32');
+         self.do_test_arm_aspeed_buidroot_poweroff()
 +
 +
 +    def do_test_arm_aspeed_sdk_start(self, image, cpu_id):
 +        self.vm.set_console()
 +        self.vm.add_args('-drive', 'file=' + image + ',if=mtd,format=raw',
 +                         '-net', 'nic', '-net', 'user')
 +        self.vm.launch()
 +
 +        self.wait_for_console_pattern('U-Boot 2019.04')
 +        self.wait_for_console_pattern('## Loading kernel from FIT Image')
 +        self.wait_for_console_pattern('Starting kernel ...')
 +        self.wait_for_console_pattern('Booting Linux on physical CPU ' + cpu_id)
 +
 +    def test_arm_ast2500_evb_sdk(self):
 +        """
 +        :avocado: tags=arch:arm
 +        :avocado: tags=machine:ast2500-evb
 +        """
 +
 +        image_url = ('https://github.com/AspeedTech-BMC/openbmc/releases/'
 +                     'download/v08.01/ast2500-default-obmc.tar.gz')
 +        image_hash = ('5375f82b4c43a79427909342a1e18b4e48bd663e38466862145d27bb358796fd')
 +        image_path = self.fetch_asset(image_url, asset_hash=image_hash,
 +                                      algorithm='sha256')
 +        archive.extract(image_path, self.workdir)
 +
 +        self.do_test_arm_aspeed_sdk_start(
 +            self.workdir + '/ast2500-default/image-bmc', '0x0')
 +        self.wait_for_console_pattern('ast2500-default login:')
 +
 +    def test_arm_ast2600_evb_sdk(self):
 +        """
 +        :avocado: tags=arch:arm
 +        :avocado: tags=machine:ast2600-evb
 +        """
 +
 +        image_url = ('https://github.com/AspeedTech-BMC/openbmc/releases/'
 +                     'download/v08.01/ast2600-default-obmc.tar.gz')
 +        image_hash = ('f12ef15e8c1f03a214df3b91c814515c5e2b2f56119021398c1dbdd626817d15')
 +        image_path = self.fetch_asset(image_url, asset_hash=image_hash,
 +                                      algorithm='sha256')
 +        archive.extract(image_path, self.workdir)
 +
 +        self.vm.add_args('-device',
-+                         'i2c-echo,bus=aspeed.i2c.bus.3,address=0x42');
++                         'tmp105,bus=aspeed.i2c.bus.5,address=0x4d,id=tmp-test');
-         self.do_test_arm_aspeed_buildroot_start(image_path, '0xf00')
++        self.vm.add_args('-device',
++                         'ds1338,bus=aspeed.i2c.bus.5,address=0x32');
-         exec_command_and_wait_for_pattern(self,
++        self.do_test_arm_aspeed_sdk_start(
-@@ -XXX,XX +XXX,XX @@ def test_arm_ast2600_evb_buildroot(self):
++            self.workdir + '/ast2600-default/image-bmc', '0xf00')
-         year = time.strftime("%Y")
++        self.wait_for_console_pattern('ast2600-default login:')
-         exec_command_and_wait_for_pattern(self, 'hwclock -f /dev/rtc1', year);
++        exec_command_and_wait_for_pattern(self, 'root', 'Password:')
++        exec_command_and_wait_for_pattern(self, '0penBmc', 'root@ast2600-default:~#')
 +
 +        exec_command_and_wait_for_pattern(self,
-+             'echo slave-24c02 0x1064 > /sys/bus/i2c/devices/i2c-3/new_device',
++             'echo lm75 0x4d > /sys/class/i2c-dev/i2c-5/device/new_device',
-+             'i2c i2c-3: new_device: Instantiated device slave-24c02 at 0x64');
++             'i2c i2c-5: new_device: Instantiated device lm75 at 0x4d');
 +        exec_command(self, 'i2cset -y 3 0x42 0x64 0x00 0xaa i');
 +        time.sleep(0.1)
 +        exec_command_and_wait_for_pattern(self,
-+             'hexdump /sys/bus/i2c/devices/3-1064/slave-eeprom',
++                             'cat /sys/class/hwmon/hwmon19/temp1_input', '0')
-+             '0000000 ffaa ffff ffff ffff ffff ffff ffff ffff');
++        self.vm.command('qom-set', path='/machine/peripheral/tmp-test',
-         self.do_test_arm_aspeed_buildroot_poweroff()
++                        property='temperature', value=18000);
++        exec_command_and_wait_for_pattern(self,
++                             'cat /sys/class/hwmon/hwmon19/temp1_input', '18000')
 +
 +        exec_command_and_wait_for_pattern(self,
 +             'echo ds1307 0x32 > /sys/class/i2c-dev/i2c-5/device/new_device',
 +             'i2c i2c-5: new_device: Instantiated device ds1307 at 0x32');
 +        year = time.strftime("%Y")
 +        exec_command_and_wait_for_pattern(self, 'hwclock -f /dev/rtc1', year);
 --
-.39.2
+.35.3

-New patch
+[PULL 15/19] hw: m25p80: Add Block Protect and Top Bottom bits for write protect
+From: Iris Chen <irischenlj@fb.com>
+Signed-off-by: Iris Chen <irischenlj@fb.com>
+Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Message-Id: <20220708164552.3462620-1-irischenlj@fb.com>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+---
+ hw/block/m25p80.c | 102 ++++++++++++++++++++++++++++++++++++++++------
+file changed, 90 insertions(+), 12 deletions(-)
+diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/block/m25p80.c
++++ b/hw/block/m25p80.c
+@@ -XXX,XX +XXX,XX @@
+ #include "trace.h"
+ #include "qom/object.h"
+-/* Fields for FlashPartInfo->flags */
+-
+-/* erase capabilities */
+-#define ER_4K 1
+-#define ER_32K 2
+-/* set to allow the page program command to write 0s back to 1. Useful for
+- * modelling EEPROM with SPI flash command set
+- */
+-#define EEPROM 0x100
+-
+ /* 16 MiB max in 3 byte address mode */
+ #define MAX_3BYTES_SIZE 0x1000000
+-
+ #define SPI_NOR_MAX_ID_LEN 6
++/* Fields for FlashPartInfo->flags */
++enum spi_flash_option_flags {
++    ER_4K                  = BIT(0),
++    ER_32K                 = BIT(1),
++    EEPROM                 = BIT(2),
++    HAS_SR_TB              = BIT(3),
++    HAS_SR_BP3_BIT6        = BIT(4),
++};
++
+ typedef struct FlashPartInfo {
+     const char *part_name;
+     /*
+@@ -XXX,XX +XXX,XX @@ static const FlashPartInfo known_devices[] = {
+     { INFO("n25q512a11",  0x20bb20,      0,  64 << 10, 1024, ER_4K) },
+     { INFO("n25q512a13",  0x20ba20,      0,  64 << 10, 1024, ER_4K) },
+     { INFO("n25q128",     0x20ba18,      0,  64 << 10, 256, 0) },
+-    { INFO("n25q256a",    0x20ba19,      0,  64 << 10, 512, ER_4K) },
++    { INFO("n25q256a",    0x20ba19,      0,  64 << 10, 512,
++           ER_4K | HAS_SR_BP3_BIT6 | HAS_SR_TB) },
+     { INFO("n25q512a",    0x20ba20,      0,  64 << 10, 1024, ER_4K) },
+     { INFO("n25q512ax3",  0x20ba20,  0x1000,  64 << 10, 1024, ER_4K) },
+     { INFO("mt25ql512ab", 0x20ba20, 0x1044, 64 << 10, 1024, ER_4K | ER_32K) },
+@@ -XXX,XX +XXX,XX @@ struct Flash {
+     bool reset_enable;
+     bool quad_enable;
+     bool aai_enable;
++    bool block_protect0;
++    bool block_protect1;
++    bool block_protect2;
++    bool block_protect3;
++    bool top_bottom_bit;
+     bool status_register_write_disabled;
+     uint8_t ear;
+@@ -XXX,XX +XXX,XX @@ void flash_write8(Flash *s, uint32_t addr, uint8_t data)
+ {
+     uint32_t page = addr / s->pi->page_size;
+     uint8_t prev = s->storage[s->cur_addr];
++    uint32_t block_protect_value = (s->block_protect3 << 3) |
++                                   (s->block_protect2 << 2) |
++                                   (s->block_protect1 << 1) |
++                                   (s->block_protect0 << 0);
+     if (!s->write_enable) {
+         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: write with write protect!\n");
+         return;
+     }
++    if (block_protect_value > 0) {
++        uint32_t num_protected_sectors = 1 << (block_protect_value - 1);
++        uint32_t sector = addr / s->pi->sector_size;
++
++        /* top_bottom_bit == 0 means TOP */
++        if (!s->top_bottom_bit) {
++            if (s->pi->n_sectors <= sector + num_protected_sectors) {
++                qemu_log_mask(LOG_GUEST_ERROR,
++                              "M25P80: write with write protect!\n");
++                return;
++            }
++        } else {
++            if (sector < num_protected_sectors) {
++                qemu_log_mask(LOG_GUEST_ERROR,
++                              "M25P80: write with write protect!\n");
++                return;
++            }
++        }
++    }
++
+     if ((prev ^ data) & data) {
+         trace_m25p80_programming_zero_to_one(s, addr, prev, data);
+     }
+@@ -XXX,XX +XXX,XX @@ static void complete_collecting_data(Flash *s)
+         break;
+     case WRSR:
+         s->status_register_write_disabled = extract32(s->data[0], 7, 1);
++        s->block_protect0 = extract32(s->data[0], 2, 1);
++        s->block_protect1 = extract32(s->data[0], 3, 1);
++        s->block_protect2 = extract32(s->data[0], 4, 1);
++        if (s->pi->flags & HAS_SR_TB) {
++            s->top_bottom_bit = extract32(s->data[0], 5, 1);
++        }
++        if (s->pi->flags & HAS_SR_BP3_BIT6) {
++            s->block_protect3 = extract32(s->data[0], 6, 1);
++        }
+         switch (get_man(s)) {
+         case MAN_SPANSION:
+@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
+     case RDSR:
+         s->data[0] = (!!s->write_enable) << 1;
+         s->data[0] |= (!!s->status_register_write_disabled) << 7;
++        s->data[0] |= (!!s->block_protect0) << 2;
++        s->data[0] |= (!!s->block_protect1) << 3;
++        s->data[0] |= (!!s->block_protect2) << 4;
++        if (s->pi->flags & HAS_SR_TB) {
++            s->data[0] |= (!!s->top_bottom_bit) << 5;
++        }
++        if (s->pi->flags & HAS_SR_BP3_BIT6) {
++            s->data[0] |= (!!s->block_protect3) << 6;
++        }
+         if (get_man(s) == MAN_MACRONIX || get_man(s) == MAN_ISSI) {
+             s->data[0] |= (!!s->quad_enable) << 6;
+@@ -XXX,XX +XXX,XX @@ static void m25p80_reset(DeviceState *d)
+     s->wp_level = true;
+     s->status_register_write_disabled = false;
++    s->block_protect0 = false;
++    s->block_protect1 = false;
++    s->block_protect2 = false;
++    s->block_protect3 = false;
++    s->top_bottom_bit = false;
+     reset_memory(s);
+ }
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m25p80_write_protect = {
+     }
+ };
++static bool m25p80_block_protect_needed(void *opaque)
++{
++    Flash *s = (Flash *)opaque;
++
++    return s->block_protect0 ||
++           s->block_protect1 ||
++           s->block_protect2 ||
++           s->block_protect3 ||
++           s->top_bottom_bit;
++}
++
++static const VMStateDescription vmstate_m25p80_block_protect = {
++    .name = "m25p80/block_protect",
++    .version_id = 1,
++    .minimum_version_id = 1,
++    .needed = m25p80_block_protect_needed,
++    .fields = (VMStateField[]) {
++        VMSTATE_BOOL(block_protect0, Flash),
++        VMSTATE_BOOL(block_protect1, Flash),
++        VMSTATE_BOOL(block_protect2, Flash),
++        VMSTATE_BOOL(block_protect3, Flash),
++        VMSTATE_BOOL(top_bottom_bit, Flash),
++        VMSTATE_END_OF_LIST()
++    }
++};
++
+ static const VMStateDescription vmstate_m25p80 = {
+     .name = "m25p80",
+     .version_id = 0,
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m25p80 = {
+         &vmstate_m25p80_data_read_loop,
+         &vmstate_m25p80_aai_enable,
+         &vmstate_m25p80_write_protect,
++        &vmstate_m25p80_block_protect,
+         NULL
+     }
+ };
+--
+.35.3

-New patch
+[PULL 16/19] hw: m25p80: add tests for BP and TB bit write protect
+From: Iris Chen <irischenlj@fb.com>
+Signed-off-by: Iris Chen <irischenlj@fb.com>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Message-Id: <20220627185234.1911337-3-irischenlj@fb.com>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+---
+ tests/qtest/aspeed_smc-test.c | 111 ++++++++++++++++++++++++++++++++++
+file changed, 111 insertions(+)
+diff --git a/tests/qtest/aspeed_smc-test.c b/tests/qtest/aspeed_smc-test.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/aspeed_smc-test.c
++++ b/tests/qtest/aspeed_smc-test.c
+@@ -XXX,XX +XXX,XX @@ static void read_page_mem(uint32_t addr, uint32_t *page)
+     }
+ }
++static void write_page_mem(uint32_t addr, uint32_t write_value)
++{
++    spi_ctrl_setmode(CTRL_WRITEMODE, PP);
++
++    for (int i = 0; i < FLASH_PAGE_SIZE / 4; i++) {
++        writel(ASPEED_FLASH_BASE + addr + i * 4, write_value);
++    }
++}
++
++static void assert_page_mem(uint32_t addr, uint32_t expected_value)
++{
++    uint32_t page[FLASH_PAGE_SIZE / 4];
++    read_page_mem(addr, page);
++    for (int i = 0; i < FLASH_PAGE_SIZE / 4; i++) {
++        g_assert_cmphex(page[i], ==, expected_value);
++    }
++}
++
+ static void test_erase_sector(void)
+ {
+     uint32_t some_page_addr = 0x600 * FLASH_PAGE_SIZE;
+@@ -XXX,XX +XXX,XX @@ static void test_status_reg_write_protection(void)
+     flash_reset();
+ }
++static void test_write_block_protect(void)
++{
++    uint32_t sector_size = 65536;
++    uint32_t n_sectors = 512;
++
++    spi_ce_ctrl(1 << CRTL_EXTENDED0);
++    spi_conf(CONF_ENABLE_W0);
++
++    uint32_t bp_bits = 0b0;
++
++    for (int i = 0; i < 16; i++) {
++        bp_bits = ((i & 0b1000) << 3) | ((i & 0b0111) << 2);
++
++        spi_ctrl_start_user();
++        writeb(ASPEED_FLASH_BASE, WREN);
++        writeb(ASPEED_FLASH_BASE, BULK_ERASE);
++        writeb(ASPEED_FLASH_BASE, WREN);
++        writeb(ASPEED_FLASH_BASE, WRSR);
++        writeb(ASPEED_FLASH_BASE, bp_bits);
++        writeb(ASPEED_FLASH_BASE, EN_4BYTE_ADDR);
++        writeb(ASPEED_FLASH_BASE, WREN);
++        spi_ctrl_stop_user();
++
++        uint32_t num_protected_sectors = i ? MIN(1 << (i - 1), n_sectors) : 0;
++        uint32_t protection_start = n_sectors - num_protected_sectors;
++        uint32_t protection_end = n_sectors;
++
++        for (int sector = 0; sector < n_sectors; sector++) {
++            uint32_t addr = sector * sector_size;
++
++            assert_page_mem(addr, 0xffffffff);
++            write_page_mem(addr, make_be32(0xabcdef12));
++
++            uint32_t expected_value = protection_start <= sector
++                                      && sector < protection_end
++                                      ? 0xffffffff : 0xabcdef12;
++
++            assert_page_mem(addr, expected_value);
++        }
++    }
++
++    flash_reset();
++}
++
++static void test_write_block_protect_bottom_bit(void)
++{
++    uint32_t sector_size = 65536;
++    uint32_t n_sectors = 512;
++
++    spi_ce_ctrl(1 << CRTL_EXTENDED0);
++    spi_conf(CONF_ENABLE_W0);
++
++    /* top bottom bit is enabled */
++    uint32_t bp_bits = 0b00100 << 3;
++
++    for (int i = 0; i < 16; i++) {
++        bp_bits = (((i & 0b1000) | 0b0100) << 3) | ((i & 0b0111) << 2);
++
++        spi_ctrl_start_user();
++        writeb(ASPEED_FLASH_BASE, WREN);
++        writeb(ASPEED_FLASH_BASE, BULK_ERASE);
++        writeb(ASPEED_FLASH_BASE, WREN);
++        writeb(ASPEED_FLASH_BASE, WRSR);
++        writeb(ASPEED_FLASH_BASE, bp_bits);
++        writeb(ASPEED_FLASH_BASE, EN_4BYTE_ADDR);
++        writeb(ASPEED_FLASH_BASE, WREN);
++        spi_ctrl_stop_user();
++
++        uint32_t num_protected_sectors = i ? MIN(1 << (i - 1), n_sectors) : 0;
++        uint32_t protection_start = 0;
++        uint32_t protection_end = num_protected_sectors;
++
++        for (int sector = 0; sector < n_sectors; sector++) {
++            uint32_t addr = sector * sector_size;
++
++            assert_page_mem(addr, 0xffffffff);
++            write_page_mem(addr, make_be32(0xabcdef12));
++
++            uint32_t expected_value = protection_start <= sector
++                                      && sector < protection_end
++                                      ? 0xffffffff : 0xabcdef12;
++
++            assert_page_mem(addr, expected_value);
++        }
++    }
++
++    flash_reset();
++}
++
+ static char tmp_path[] = "/tmp/qtest.m25p80.XXXXXX";
+ int main(int argc, char **argv)
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
+     qtest_add_func("/ast2400/smc/read_status_reg", test_read_status_reg);
+     qtest_add_func("/ast2400/smc/status_reg_write_protection",
+                    test_status_reg_write_protection);
++    qtest_add_func("/ast2400/smc/write_block_protect",
++                   test_write_block_protect);
++    qtest_add_func("/ast2400/smc/write_block_protect_bottom_bit",
++                   test_write_block_protect_bottom_bit);
+     flash_reset();
+     ret = g_test_run();
+--
+.35.3

-[PULL 01/11] readline: fix hmp completion issue
+[PULL 17/19] qtest/aspeed_gpio: Add input pin modification test
-From: Dongli Zhang <dongli.zhang@oracle.com>
+From: Peter Delevoryas <peter@pjd.dev>
-The auto completion does not work in some cases.
+Verify the current behavior, which is that input pins can be modified by
 guest OS register writes.
-Case 1.
+Signed-off-by: Peter Delevoryas <peter@pjd.dev>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
-. (qemu) info reg
+Message-Id: <20220712023219.41065-2-peter@pjd.dev>
 . Press 'Tab'.
 . It does not auto complete.
 Case 2.
 . (qemu) block_resize flo
 . Press 'Tab'.
 . It does not auto complete 'floppy0'.
 Since the readline_add_completion_of() may add any completion when
 strlen(pfx) is zero, we remove the check with (name[0] == '\0') because
 strlen() always returns zero in that case.
 Fixes: 52f50b1e9f8f ("readline: Extract readline_add_completion_of() from monitor")
 Cc: Joe Jin <joe.jin@oracle.com>
 Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
 Tested-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Markus Armbruster <armbru@redhat.com>
 Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- monitor/hmp.c | 8 ++------
+ tests/qtest/aspeed_gpio-test.c | 27 +++++++++++++++++++++++++++
-file changed, 2 insertions(+), 6 deletions(-)
+file changed, 27 insertions(+)
-diff --git a/monitor/hmp.c b/monitor/hmp.c
+diff --git a/tests/qtest/aspeed_gpio-test.c b/tests/qtest/aspeed_gpio-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/monitor/hmp.c
+--- a/tests/qtest/aspeed_gpio-test.c
-+++ b/monitor/hmp.c
++++ b/tests/qtest/aspeed_gpio-test.c
-@@ -XXX,XX +XXX,XX @@ static void cmd_completion(MonitorHMP *mon, const char *name, const char *list)
+@@ -XXX,XX +XXX,XX @@
-         }
+ #include "qapi/qmp/qdict.h"
-         memcpy(cmd, pstart, len);
+ #include "libqtest-single.h"
-         cmd[len] = '\0';
--        if (name[0] == '\0') {
++#define AST2600_GPIO_BASE 0x1E780000
--            readline_add_completion_of(mon->rs, name, cmd);
++
--        }
++#define GPIO_ABCD_DATA_VALUE 0x000
-+        readline_add_completion_of(mon->rs, name, cmd);
++#define GPIO_ABCD_DIRECTION  0x004
-         if (*p == '\0') {
++
-             break;
+ static void test_set_colocated_pins(const void *data)
-         }
+ {
-@@ -XXX,XX +XXX,XX @@ static void monitor_find_completion_by_table(MonitorHMP *mon,
+     QTestState *s = (QTestState *)data;
-             /* block device name completion */
+@@ -XXX,XX +XXX,XX @@ static void test_set_colocated_pins(const void *data)
-             readline_set_completion_index(mon->rs, strlen(str));
+     g_assert(!qtest_qom_get_bool(s, "/machine/soc/gpio", "gpioV7"));
-             while ((blk = blk_next(blk)) != NULL) {
+ }
--                if (str[0] == '\0') {
--                    readline_add_completion_of(mon->rs, str, blk_name(blk));
++static void test_set_input_pins(const void *data)
--                }
++{
-+                readline_add_completion_of(mon->rs, str, blk_name(blk));
++    QTestState *s = (QTestState *)data;
-             }
++    char name[16];
-             break;
++    uint32_t value;
-         case 's':
++
 +    qtest_writel(s, AST2600_GPIO_BASE + GPIO_ABCD_DIRECTION, 0x00000000);
 +    for (char c = 'A'; c <= 'D'; c++) {
 +        for (int i = 0; i < 8; i++) {
 +            sprintf(name, "gpio%c%d", c, i);
 +            qtest_qom_set_bool(s, "/machine/soc/gpio", name, true);
 +        }
 +    }
 +    value = qtest_readl(s, AST2600_GPIO_BASE + GPIO_ABCD_DATA_VALUE);
 +    g_assert_cmphex(value, ==, 0xffffffff);
 +
 +    qtest_writel(s, AST2600_GPIO_BASE + GPIO_ABCD_DATA_VALUE, 0x00000000);
 +    value = qtest_readl(s, AST2600_GPIO_BASE + GPIO_ABCD_DATA_VALUE);
 +    g_assert_cmphex(value, ==, 0x00000000);
 +}
 +
  int main(int argc, char **argv)
  {
      QTestState *s;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
      s = qtest_init("-machine ast2600-evb");
      qtest_add_data_func("/ast2600/gpio/set_colocated_pins", s,
                          test_set_colocated_pins);
 +    qtest_add_data_func("/ast2600/gpio/set_input_pins", s, test_set_input_pins);
      r = g_test_run();
      qtest_quit(s);
 --
-.39.2
+.35.3

-[PULL 02/11] hw/i2c: only schedule pending master when bus is idle
+[PULL 18/19] hw/gpio/aspeed: Don't let guests modify input pins
-From: Klaus Jensen <k.jensen@samsung.com>
+From: Peter Delevoryas <peter@pjd.dev>
-It is not given that the current master will release the bus after a
+Up until now, guests could modify input pins by overwriting the data
-transfer ends. Only schedule a pending master if the bus is idle.
+value register. The guest OS should only be allowed to modify output pin
 values, and the QOM property setter should only be permitted to modify
 input pins.
-Fixes: 37fa5ca42623 ("hw/i2c: support multiple masters")
+This change also updates the gpio input pin test to match this
-Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
+expectation.
-Acked-by: Corey Minyard <cminyard@mvista.com>
-Message-Id: <20221116084312.35808-2-its@irrelevant.dk>
+Andrew suggested this particularly refactoring here:
     https://lore.kernel.org/qemu-devel/23523aa1-ba81-412b-92cc-8174faba3612@www.fastmail.com/
 Suggested-by: Andrew Jeffery <andrew@aj.id.au>
 Signed-off-by: Peter Delevoryas <peter@pjd.dev>
 Fixes: 4b7f956862dc ("hw/gpio: Add basic Aspeed GPIO model for AST2400 and AST2500")
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-Id: <20220712023219.41065-3-peter@pjd.dev>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- include/hw/i2c/i2c.h |  2 ++
+ hw/gpio/aspeed_gpio.c          | 15 ++++++++-------
- hw/i2c/aspeed_i2c.c  |  2 ++
+ tests/qtest/aspeed_gpio-test.c |  2 +-
- hw/i2c/core.c        | 37 ++++++++++++++++++++++---------------
+files changed, 9 insertions(+), 8 deletions(-)
 files changed, 26 insertions(+), 15 deletions(-)
-diff --git a/include/hw/i2c/i2c.h b/include/hw/i2c/i2c.h
+diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i2c/i2c.h
+--- a/hw/gpio/aspeed_gpio.c
-+++ b/include/hw/i2c/i2c.h
++++ b/hw/gpio/aspeed_gpio.c
-@@ -XXX,XX +XXX,XX @@ int i2c_start_send(I2CBus *bus, uint8_t address);
+@@ -XXX,XX +XXX,XX @@ static ptrdiff_t aspeed_gpio_set_idx(AspeedGPIOState *s, GPIOSets *regs)
-  */
+ }
- int i2c_start_send_async(I2CBus *bus, uint8_t address);
+ static void aspeed_gpio_update(AspeedGPIOState *s, GPIOSets *regs,
-+void i2c_schedule_pending_master(I2CBus *bus);
+-                               uint32_t value)
-+
++                               uint32_t value, uint32_t mode_mask)
- void i2c_end_transfer(I2CBus *bus);
+ {
- void i2c_nack(I2CBus *bus);
+     uint32_t input_mask = regs->input_mask;
- void i2c_ack(I2CBus *bus);
+     uint32_t direction = regs->direction;
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
+@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_update(AspeedGPIOState *s, GPIOSets *regs,
-index XXXXXXX..XXXXXXX 100644
+     uint32_t diff;
---- a/hw/i2c/aspeed_i2c.c
+     int gpio;
-+++ b/hw/i2c/aspeed_i2c.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
+-    diff = old ^ new;
-         }
++    diff = (old ^ new);
-         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_STOP_CMD, 0);
++    diff &= mode_mask;
-         aspeed_i2c_set_state(bus, I2CD_IDLE);
+     if (diff) {
-+
+         for (gpio = 0; gpio < ASPEED_GPIOS_PER_SET; gpio++) {
-+        i2c_schedule_pending_master(bus->bus);
+             uint32_t mask = 1 << gpio;
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_set_pin_level(AspeedGPIOState *s, uint32_t set_idx,
          value &= ~pin_mask;
      }
-     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
+-    aspeed_gpio_update(s, &s->sets[set_idx], value);
-diff --git a/hw/i2c/core.c b/hw/i2c/core.c
++    aspeed_gpio_update(s, &s->sets[set_idx], value, ~s->sets[set_idx].direction);
-index XXXXXXX..XXXXXXX 100644
+ }
---- a/hw/i2c/core.c
-+++ b/hw/i2c/core.c
+ /*
-@@ -XXX,XX +XXX,XX @@ int i2c_start_transfer(I2CBus *bus, uint8_t address, bool is_recv)
+@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_write_index_mode(void *opaque, hwaddr offset,
+         reg_value = update_value_control_source(set, set->data_value,
- void i2c_bus_master(I2CBus *bus, QEMUBH *bh)
+                                                 reg_value);
- {
+         set->data_read = reg_value;
--    if (i2c_bus_busy(bus)) {
+-        aspeed_gpio_update(s, set, reg_value);
--        I2CPendingMaster *node = g_new(struct I2CPendingMaster, 1);
++        aspeed_gpio_update(s, set, reg_value, set->direction);
--        node->bh = bh;
+         return;
-+    I2CPendingMaster *node = g_new(struct I2CPendingMaster, 1);
+     case gpio_reg_idx_direction:
-+    node->bh = bh;
+         reg_value = set->direction;
-+
+@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_write_index_mode(void *opaque, hwaddr offset,
-+    QSIMPLEQ_INSERT_TAIL(&bus->pending_masters, node, entry);
+             __func__, offset, data, reg_idx_type);
 +}
 +
 +void i2c_schedule_pending_master(I2CBus *bus)
 +{
 +    I2CPendingMaster *node;
 -        QSIMPLEQ_INSERT_TAIL(&bus->pending_masters, node, entry);
 +    if (i2c_bus_busy(bus)) {
 +        /* someone is already controlling the bus; wait for it to release it */
 +        return;
 +    }
 +    if (QSIMPLEQ_EMPTY(&bus->pending_masters)) {
          return;
      }
+-    aspeed_gpio_update(s, set, set->data_value);
--    bus->bh = bh;
++    aspeed_gpio_update(s, set, set->data_value, UINT32_MAX);
-+    node = QSIMPLEQ_FIRST(&bus->pending_masters);
+     return;
 +    bus->bh = node->bh;
 +
 +    QSIMPLEQ_REMOVE_HEAD(&bus->pending_masters, entry);
 +    g_free(node);
 +
      qemu_bh_schedule(bus->bh);
  }
- void i2c_bus_release(I2CBus *bus)
+@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_write(void *opaque, hwaddr offset, uint64_t data,
- {
+         data &= props->output;
-     bus->bh = NULL;
+         data = update_value_control_source(set, set->data_value, data);
-+
+         set->data_read = data;
-+    i2c_schedule_pending_master(bus);
+-        aspeed_gpio_update(s, set, data);
 +        aspeed_gpio_update(s, set, data, set->direction);
          return;
      case gpio_reg_direction:
          /*
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_write(void *opaque, hwaddr offset, uint64_t data,
                        PRIx64"\n", __func__, offset);
          return;
      }
 -    aspeed_gpio_update(s, set, set->data_value);
 +    aspeed_gpio_update(s, set, set->data_value, UINT32_MAX);
      return;
  }
- int i2c_start_recv(I2CBus *bus, uint8_t address)
+diff --git a/tests/qtest/aspeed_gpio-test.c b/tests/qtest/aspeed_gpio-test.c
-@@ -XXX,XX +XXX,XX @@ void i2c_end_transfer(I2CBus *bus)
+index XXXXXXX..XXXXXXX 100644
-         g_free(node);
+--- a/tests/qtest/aspeed_gpio-test.c
-     }
++++ b/tests/qtest/aspeed_gpio-test.c
-     bus->broadcast = false;
+@@ -XXX,XX +XXX,XX @@ static void test_set_input_pins(const void *data)
--
--    if (!QSIMPLEQ_EMPTY(&bus->pending_masters)) {
+     qtest_writel(s, AST2600_GPIO_BASE + GPIO_ABCD_DATA_VALUE, 0x00000000);
--        I2CPendingMaster *node = QSIMPLEQ_FIRST(&bus->pending_masters);
+     value = qtest_readl(s, AST2600_GPIO_BASE + GPIO_ABCD_DATA_VALUE);
--        bus->bh = node->bh;
+-    g_assert_cmphex(value, ==, 0x00000000);
--
++    g_assert_cmphex(value, ==, 0xffffffff);
 -        QSIMPLEQ_REMOVE_HEAD(&bus->pending_masters, entry);
 -        g_free(node);
 -
 -        qemu_bh_schedule(bus->bh);
 -    }
  }
- int i2c_send(I2CBus *bus, uint8_t data)
+ int main(int argc, char **argv)
 --
-.39.2
+.35.3

-[PULL 08/11] aspeed/fuji : correct the eeprom size
+[PULL 19/19] aspeed: Add fby35-bmc slot GPIO's
-From: Sittisak Sinprem <ssinprem@celestica.com>
+From: Peter Delevoryas <peter@pjd.dev>
-Device 24C64 the size is 64 kilobits = 8kilobyte
+Signed-off-by: Peter Delevoryas <peter@pjd.dev>
-Device 24C02 the size is 2 kilobits = 256byte
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Message-Id: <20220712023219.41065-4-peter@pjd.dev>
 Signed-off-by: Sittisak Sinprem <ssinprem@celestica.com>
 Reviewed-by: Peter Delevoryas <peter@pjd.dev>
 [ clg: checkpatch issues ]
 Message-Id: <167660539263.10409.9736070122710923479-2@git.sr.ht>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 ---
- hw/arm/aspeed.c | 36 ++++++++++++++++++++----------------
+ hw/arm/aspeed.c | 14 +++++++++++++-
-file changed, 20 insertions(+), 16 deletions(-)
+file changed, 13 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed.c
 +++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void fuji_bmc_i2c_init(AspeedMachineState *bmc)
+@@ -XXX,XX +XXX,XX @@ static void fby35_reset(MachineState *state)
-     i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4c);
-     i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4d);
+     qemu_devices_reset();
--    at24c_eeprom_init(i2c[19], 0x52, 64 * KiB);
+-    /* Board ID */
--    at24c_eeprom_init(i2c[20], 0x50, 2 * KiB);
++    /* Board ID: 7 (Class-1, 4 slots) */
--    at24c_eeprom_init(i2c[22], 0x52, 2 * KiB);
+     object_property_set_bool(OBJECT(gpio), "gpioV4", true, &error_fatal);
-+    /*
+     object_property_set_bool(OBJECT(gpio), "gpioV5", true, &error_fatal);
-+     * EEPROM 24c64 size is 64Kbits or 8 Kbytes
+     object_property_set_bool(OBJECT(gpio), "gpioV6", true, &error_fatal);
-+     *        24c02 size is 2Kbits or 256 bytes
+     object_property_set_bool(OBJECT(gpio), "gpioV7", false, &error_fatal);
-+     */
++
-+    at24c_eeprom_init(i2c[19], 0x52, 8 * KiB);
++    /* Slot presence pins, inverse polarity. (False means present) */
-+    at24c_eeprom_init(i2c[20], 0x50, 256);
++    object_property_set_bool(OBJECT(gpio), "gpioH4", false, &error_fatal);
-+    at24c_eeprom_init(i2c[22], 0x52, 256);
++    object_property_set_bool(OBJECT(gpio), "gpioH5", true, &error_fatal);
++    object_property_set_bool(OBJECT(gpio), "gpioH6", true, &error_fatal);
-     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x48);
++    object_property_set_bool(OBJECT(gpio), "gpioH7", true, &error_fatal);
-     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x49);
++
-     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x4a);
++    /* Slot 12v power pins, normal polarity. (True means powered-on) */
-     i2c_slave_create_simple(i2c[3], TYPE_TMP422, 0x4c);
++    object_property_set_bool(OBJECT(gpio), "gpioB2", true, &error_fatal);
++    object_property_set_bool(OBJECT(gpio), "gpioB3", false, &error_fatal);
--    at24c_eeprom_init(i2c[8], 0x51, 64 * KiB);
++    object_property_set_bool(OBJECT(gpio), "gpioB4", false, &error_fatal);
-+    at24c_eeprom_init(i2c[8], 0x51, 8 * KiB);
++    object_property_set_bool(OBJECT(gpio), "gpioB5", false, &error_fatal);
-     i2c_slave_create_simple(i2c[8], TYPE_LM75, 0x4a);
+ }
-     i2c_slave_create_simple(i2c[50], TYPE_LM75, 0x4c);
+ static void aspeed_machine_fby35_class_init(ObjectClass *oc, void *data)
 -    at24c_eeprom_init(i2c[50], 0x52, 64 * KiB);
 +    at24c_eeprom_init(i2c[50], 0x52, 8 * KiB);
      i2c_slave_create_simple(i2c[51], TYPE_TMP75, 0x48);
      i2c_slave_create_simple(i2c[52], TYPE_TMP75, 0x49);
      i2c_slave_create_simple(i2c[59], TYPE_TMP75, 0x48);
      i2c_slave_create_simple(i2c[60], TYPE_TMP75, 0x49);
 -    at24c_eeprom_init(i2c[65], 0x53, 64 * KiB);
 +    at24c_eeprom_init(i2c[65], 0x53, 8 * KiB);
      i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x49);
      i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x48);
 -    at24c_eeprom_init(i2c[68], 0x52, 64 * KiB);
 -    at24c_eeprom_init(i2c[69], 0x52, 64 * KiB);
 -    at24c_eeprom_init(i2c[70], 0x52, 64 * KiB);
 -    at24c_eeprom_init(i2c[71], 0x52, 64 * KiB);
 +    at24c_eeprom_init(i2c[68], 0x52, 8 * KiB);
 +    at24c_eeprom_init(i2c[69], 0x52, 8 * KiB);
 +    at24c_eeprom_init(i2c[70], 0x52, 8 * KiB);
 +    at24c_eeprom_init(i2c[71], 0x52, 8 * KiB);
 -    at24c_eeprom_init(i2c[73], 0x53, 64 * KiB);
 +    at24c_eeprom_init(i2c[73], 0x53, 8 * KiB);
      i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x49);
      i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x48);
 -    at24c_eeprom_init(i2c[76], 0x52, 64 * KiB);
 -    at24c_eeprom_init(i2c[77], 0x52, 64 * KiB);
 -    at24c_eeprom_init(i2c[78], 0x52, 64 * KiB);
 -    at24c_eeprom_init(i2c[79], 0x52, 64 * KiB);
 -    at24c_eeprom_init(i2c[28], 0x50, 2 * KiB);
 +    at24c_eeprom_init(i2c[76], 0x52, 8 * KiB);
 +    at24c_eeprom_init(i2c[77], 0x52, 8 * KiB);
 +    at24c_eeprom_init(i2c[78], 0x52, 8 * KiB);
 +    at24c_eeprom_init(i2c[79], 0x52, 8 * KiB);
 +    at24c_eeprom_init(i2c[28], 0x50, 256);
      for (int i = 0; i < 8; i++) {
          at24c_eeprom_init(i2c[81 + i * 8], 0x56, 64 * KiB);
 --
-.39.2
+.35.3

The following changes since commit a2b5f8b8ab7b2c947823088103a40f0ff11fe06b:

Merge tag 'pull-tcg-20230301' of https://gitlab.com/rth7680/qemu into staging (2023-03-01 19:19:20 +0000)

are available in the Git repository at:

https://github.com/legoater/qemu/ tags/pull-aspeed-20230302

for you to fetch changes up to b22a2d409b1acfdf0d63d1bb3595194ceb3d94da:

aspeed/smc: Replace SysBus IRQs with GPIO lines (2023-03-02 13:57:50 +0100)

----------------------------------------------------------------
aspeed queue:

* fix for the Aspeed I2C slave mode
* a new I2C echo device from Klaus and its associated test in avocado.
* initial SoC cleanups to allow the use of block devices instead of
  drives on the command line.
* new facebook machines and eeprom fixes for the Fuji
* readline fix

----------------------------------------------------------------
Cédric Le Goater (4):
      tests/avocado/machine_aspeed.py: Add an I2C slave test
      aspeed: Introduce a spi_boot region under the SoC
      aspeed: Add a boot_rom overlap region in the SoC spi_boot container
      aspeed/smc: Replace SysBus IRQs with GPIO lines

Dongli Zhang (1):
      readline: fix hmp completion issue

Karthikeyan Pasupathi (2):
      hw/arm/aspeed: Adding new machine Yosemitev2 in QEMU
      hw/arm/aspeed: Adding new machine Tiogapass in QEMU

Klaus Jensen (2):
      hw/i2c: only schedule pending master when bus is idle
      hw/misc: add a toy i2c echo device

Sittisak Sinprem (2):
      hw/at24c : modify at24c to support 1 byte address mode
      aspeed/fuji : correct the eeprom size

From: Dongli Zhang <dongli.zhang@oracle.com>

The auto completion does not work in some cases.

Case 1.

1. (qemu) info reg
2. Press 'Tab'.
3. It does not auto complete.

Case 2.

1. (qemu) block_resize flo
2. Press 'Tab'.
3. It does not auto complete 'floppy0'.

Since the readline_add_completion_of() may add any completion when
strlen(pfx) is zero, we remove the check with (name[0] == '\0') because
strlen() always returns zero in that case.

Fixes: 52f50b1e9f8f ("readline: Extract readline_add_completion_of() from monitor")
Cc: Joe Jin <joe.jin@oracle.com>
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 monitor/hmp.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/monitor/hmp.c b/monitor/hmp.c
index XXXXXXX..XXXXXXX 100644
--- a/monitor/hmp.c
+++ b/monitor/hmp.c
@@ -XXX,XX +XXX,XX @@ static void cmd_completion(MonitorHMP *mon, const char *name, const char *list)
         }
         memcpy(cmd, pstart, len);
         cmd[len] = '\0';
-        if (name[0] == '\0') {
-            readline_add_completion_of(mon->rs, name, cmd);
-        }
+        readline_add_completion_of(mon->rs, name, cmd);
         if (*p == '\0') {
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void monitor_find_completion_by_table(MonitorHMP *mon,
             /* block device name completion */
             readline_set_completion_index(mon->rs, strlen(str));
             while ((blk = blk_next(blk)) != NULL) {
-                if (str[0] == '\0') {
-                    readline_add_completion_of(mon->rs, str, blk_name(blk));
-                }
+                readline_add_completion_of(mon->rs, str, blk_name(blk));
             }
             break;
         case 's':
-- 
2.39.2

From: Klaus Jensen <k.jensen@samsung.com>

It is not given that the current master will release the bus after a
transfer ends. Only schedule a pending master if the bus is idle.

Fixes: 37fa5ca42623 ("hw/i2c: support multiple masters")
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Acked-by: Corey Minyard <cminyard@mvista.com>
Message-Id: <20221116084312.35808-2-its@irrelevant.dk>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/i2c/i2c.h |  2 ++
 hw/i2c/aspeed_i2c.c  |  2 ++
 hw/i2c/core.c        | 37 ++++++++++++++++++++++---------------
 3 files changed, 26 insertions(+), 15 deletions(-)

diff --git a/include/hw/i2c/i2c.h b/include/hw/i2c/i2c.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/i2c.h
+++ b/include/hw/i2c/i2c.h
@@ -XXX,XX +XXX,XX @@ int i2c_start_send(I2CBus *bus, uint8_t address);
  */
 int i2c_start_send_async(I2CBus *bus, uint8_t address);
 
+void i2c_schedule_pending_master(I2CBus *bus);
+
 void i2c_end_transfer(I2CBus *bus);
 void i2c_nack(I2CBus *bus);
 void i2c_ack(I2CBus *bus);
diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
         }
         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_STOP_CMD, 0);
         aspeed_i2c_set_state(bus, I2CD_IDLE);
+
+        i2c_schedule_pending_master(bus->bus);
     }
 
     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
diff --git a/hw/i2c/core.c b/hw/i2c/core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/core.c
+++ b/hw/i2c/core.c
@@ -XXX,XX +XXX,XX @@ int i2c_start_transfer(I2CBus *bus, uint8_t address, bool is_recv)
 
 void i2c_bus_master(I2CBus *bus, QEMUBH *bh)
 {
-    if (i2c_bus_busy(bus)) {
-        I2CPendingMaster *node = g_new(struct I2CPendingMaster, 1);
-        node->bh = bh;
+    I2CPendingMaster *node = g_new(struct I2CPendingMaster, 1);
+    node->bh = bh;
+
+    QSIMPLEQ_INSERT_TAIL(&bus->pending_masters, node, entry);
+}
+
+void i2c_schedule_pending_master(I2CBus *bus)
+{
+    I2CPendingMaster *node;
 
-        QSIMPLEQ_INSERT_TAIL(&bus->pending_masters, node, entry);
+    if (i2c_bus_busy(bus)) {
+        /* someone is already controlling the bus; wait for it to release it */
+        return;
+    }
 
+    if (QSIMPLEQ_EMPTY(&bus->pending_masters)) {
         return;
     }
 
-    bus->bh = bh;
+    node = QSIMPLEQ_FIRST(&bus->pending_masters);
+    bus->bh = node->bh;
+
+    QSIMPLEQ_REMOVE_HEAD(&bus->pending_masters, entry);
+    g_free(node);
+
     qemu_bh_schedule(bus->bh);
 }
 
 void i2c_bus_release(I2CBus *bus)
 {
     bus->bh = NULL;
+
+    i2c_schedule_pending_master(bus);
 }
 
 int i2c_start_recv(I2CBus *bus, uint8_t address)
@@ -XXX,XX +XXX,XX @@ void i2c_end_transfer(I2CBus *bus)
         g_free(node);
     }
     bus->broadcast = false;
-
-    if (!QSIMPLEQ_EMPTY(&bus->pending_masters)) {
-        I2CPendingMaster *node = QSIMPLEQ_FIRST(&bus->pending_masters);
-        bus->bh = node->bh;
-
-        QSIMPLEQ_REMOVE_HEAD(&bus->pending_masters, entry);
-        g_free(node);
-
-        qemu_bh_schedule(bus->bh);
-    }
 }
 
 int i2c_send(I2CBus *bus, uint8_t data)
-- 
2.39.2

From: Klaus Jensen <k.jensen@samsung.com>

Add an example I2C device to demonstrate how a slave may master the bus
and send data asynchronously to another slave.

The device will echo whatever it is sent to the device identified by the
first byte received.

Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
[ clg: integrated fixes :
  https://lore.kernel.org/qemu-devel/Y3yMKAhOkYGtnkOp@cormorant.local/ ]
Message-Id: <20220601210831.67259-7-its@irrelevant.dk>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/misc/i2c-echo.c  | 156 ++++++++++++++++++++++++++++++++++++++++++++
 hw/misc/meson.build |   2 +
 2 files changed, 158 insertions(+)
 create mode 100644 hw/misc/i2c-echo.c

diff --git a/hw/misc/i2c-echo.c b/hw/misc/i2c-echo.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/i2c-echo.c
@@ -XXX,XX +XXX,XX @@
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "qemu/main-loop.h"
+#include "block/aio.h"
+#include "hw/i2c/i2c.h"
+
+#define TYPE_I2C_ECHO "i2c-echo"
+OBJECT_DECLARE_SIMPLE_TYPE(I2CEchoState, I2C_ECHO)
+
+enum i2c_echo_state {
+    I2C_ECHO_STATE_IDLE,
+    I2C_ECHO_STATE_START_SEND,
+    I2C_ECHO_STATE_ACK,
+};
+
+typedef struct I2CEchoState {
+    I2CSlave parent_obj;
+
+    I2CBus *bus;
+
+    enum i2c_echo_state state;
+    QEMUBH *bh;
+
+    unsigned int pos;
+    uint8_t data[3];
+} I2CEchoState;
+
+static void i2c_echo_bh(void *opaque)
+{
+    I2CEchoState *state = opaque;
+
+    switch (state->state) {
+    case I2C_ECHO_STATE_IDLE:
+        return;
+
+    case I2C_ECHO_STATE_START_SEND:
+        if (i2c_start_send_async(state->bus, state->data[0])) {
+            goto release_bus;
+        }
+
+        state->pos++;
+        state->state = I2C_ECHO_STATE_ACK;
+        return;
+
+    case I2C_ECHO_STATE_ACK:
+        if (state->pos > 2) {
+            break;
+        }
+
+        if (i2c_send_async(state->bus, state->data[state->pos++])) {
+            break;
+        }
+
+        return;
+    }
+
+
+    i2c_end_transfer(state->bus);
+release_bus:
+    i2c_bus_release(state->bus);
+
+    state->state = I2C_ECHO_STATE_IDLE;
+}
+
+static int i2c_echo_event(I2CSlave *s, enum i2c_event event)
+{
+    I2CEchoState *state = I2C_ECHO(s);
+
+    switch (event) {
+    case I2C_START_RECV:
+        state->pos = 0;
+
+        break;
+
+    case I2C_START_SEND:
+        state->pos = 0;
+
+        break;
+
+    case I2C_FINISH:
+        state->pos = 0;
+        state->state = I2C_ECHO_STATE_START_SEND;
+        i2c_bus_master(state->bus, state->bh);
+
+        break;
+
+    case I2C_NACK:
+        break;
+
+    default:
+        return -1;
+    }
+
+    return 0;
+}
+
+static uint8_t i2c_echo_recv(I2CSlave *s)
+{
+    I2CEchoState *state = I2C_ECHO(s);
+
+    if (state->pos > 2) {
+        return 0xff;
+    }
+
+    return state->data[state->pos++];
+}
+
+static int i2c_echo_send(I2CSlave *s, uint8_t data)
+{
+    I2CEchoState *state = I2C_ECHO(s);
+
+    if (state->pos > 2) {
+        return -1;
+    }
+
+    state->data[state->pos++] = data;
+
+    return 0;
+}
+
+static void i2c_echo_realize(DeviceState *dev, Error **errp)
+{
+    I2CEchoState *state = I2C_ECHO(dev);
+    BusState *bus = qdev_get_parent_bus(dev);
+
+    state->bus = I2C_BUS(bus);
+    state->bh = qemu_bh_new(i2c_echo_bh, state);
+
+    return;
+}
+
+static void i2c_echo_class_init(ObjectClass *oc, void *data)
+{
+    I2CSlaveClass *sc = I2C_SLAVE_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = i2c_echo_realize;
+
+    sc->event = i2c_echo_event;
+    sc->recv = i2c_echo_recv;
+    sc->send = i2c_echo_send;
+}
+
+static const TypeInfo i2c_echo = {
+    .name = TYPE_I2C_ECHO,
+    .parent = TYPE_I2C_SLAVE,
+    .instance_size = sizeof(I2CEchoState),
+    .class_init = i2c_echo_class_init,
+};
+
+static void register_types(void)
+{
+    type_register_static(&i2c_echo);
+}
+
+type_init(register_types);
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_rng.c'))
 
 softmmu_ss.add(when: 'CONFIG_GRLIB', if_true: files('grlib_ahb_apb_pnp.c'))
 
+softmmu_ss.add(when: 'CONFIG_I2C', if_true: files('i2c-echo.c'))
+
 specific_ss.add(when: 'CONFIG_AVR_POWER', if_true: files('avr_power.c'))
 
 specific_ss.add(when: 'CONFIG_MAC_VIA', if_true: files('mac_via.c'))
-- 
2.39.2

The Aspeed 2600 I2C controller supports a slave mode which can be
tested with the I2C echo device. Test extracted from :

https://lists.nongnu.org/archive/html/qemu-devel/2022-06/msg00183.html

Suggested-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 tests/avocado/machine_aspeed.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

From: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>

This patch support Yosemitev2 in QEMU environment.
and introduced EEPROM BMC FRU data support "add fbyv2_bmc_fruid data"
along with the machine support.

Signed-off-by: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
[ clg: - commit log topic update
       - Documentation update ]
Message-Id: <20230216133326.216017-1-pkarthikeyan1509@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 docs/system/arm/aspeed.rst |  1 +
 hw/arm/aspeed_eeprom.h     |  3 +++
 hw/arm/aspeed.c            | 31 +++++++++++++++++++++++++++++++
 hw/arm/aspeed_eeprom.c     | 23 +++++++++++++++++++++++
 4 files changed, 58 insertions(+)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -XXX,XX +XXX,XX @@ AST2500 SoC based machines :
 - ``sonorapass-bmc``       OCP SonoraPass BMC
 - ``fp5280g2-bmc``         Inspur FP5280G2 BMC
 - ``g220a-bmc``            Bytedance G220A BMC
+- ``yosemitev2-bmc``       Facebook YosemiteV2 BMC
 
 AST2600 SoC based machines :
 
diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_eeprom.h
+++ b/hw/arm/aspeed_eeprom.h
@@ -XXX,XX +XXX,XX @@ extern const size_t fby35_nic_fruid_len;
 extern const size_t fby35_bb_fruid_len;
 extern const size_t fby35_bmc_fruid_len;
 
+extern const uint8_t yosemitev2_bmc_fruid[];
+extern const size_t yosemitev2_bmc_fruid_len;
+
 #endif
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
                      TYPE_TMP105, 0x4d);
 }
 
+static void yosemitev2_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x51, 128 * KiB);
+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x51, 128 * KiB,
+                          yosemitev2_bmc_fruid, yosemitev2_bmc_fruid_len);
+}
+
 static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc, void *data)
         aspeed_soc_num_cpus(amc->soc_name);
 };
 
+static void aspeed_machine_yosemitev2_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Facebook YosemiteV2 BMC (ARM1176)";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
+    amc->hw_strap2 = 0;
+    amc->fmc_model = "n25q256a";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 2;
+    amc->i2c_init  = yosemitev2_bmc_i2c_init;
+    mc->default_ram_size       = 512 * MiB;
+    mc->default_cpus = mc->min_cpus = mc->max_cpus =
+        aspeed_soc_num_cpus(amc->soc_name);
+};
+
 static void aspeed_machine_romulus_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2600_evb_class_init,
+    }, {
+        .name          = MACHINE_TYPE_NAME("yosemitev2-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_yosemitev2_class_init,
     }, {
         .name          = MACHINE_TYPE_NAME("tacoma-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_eeprom.c
+++ b/hw/arm/aspeed_eeprom.c
@@ -XXX,XX +XXX,XX @@ const uint8_t fby35_bmc_fruid[] = {
     0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
 };
 
+/* Yosemite V2 BMC FRU */
+const uint8_t yosemitev2_bmc_fruid[] = {
+    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
+    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
+    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
+    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
+    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x59, 0x6f, 0x73, 0x65, 0x6d,
+    0x69, 0x74, 0x65, 0x20, 0x56, 0x32, 0x2e, 0x30, 0x20, 0x45, 0x56, 0x54,
+    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0xc4, 0x45, 0x56, 0x54, 0x32, 0xcd, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
+    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
+};
+
 const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
 const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
 const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
+
+const size_t yosemitev2_bmc_fruid_len = sizeof(yosemitev2_bmc_fruid);
-- 
2.39.2

From: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>

This patch support Tiogapass in QEMU environment.
and introduced EEPROM BMC FRU data support "add tiogapass_bmc_fruid data"
along with the machine support.

Signed-off-by: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
[ clg: - commit log topic update
       - checkpatch issues
       - Documentation update ]
Message-Id: <20230216184342.253868-1-pkarthikeyan1509@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 docs/system/arm/aspeed.rst |  1 +
 hw/arm/aspeed_eeprom.h     |  3 +++
 hw/arm/aspeed.c            | 32 ++++++++++++++++++++++++++++++++
 hw/arm/aspeed_eeprom.c     | 22 ++++++++++++++++++++++
 4 files changed, 58 insertions(+)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -XXX,XX +XXX,XX @@ AST2500 SoC based machines :
 - ``fp5280g2-bmc``         Inspur FP5280G2 BMC
 - ``g220a-bmc``            Bytedance G220A BMC
 - ``yosemitev2-bmc``       Facebook YosemiteV2 BMC
+- ``tiogapass-bmc``        Facebook Tiogapass BMC
 
 AST2600 SoC based machines :
 
diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_eeprom.h
+++ b/hw/arm/aspeed_eeprom.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 
+extern const uint8_t tiogapass_bmc_fruid[];
+extern const size_t tiogapass_bmc_fruid_len;
+
 extern const uint8_t fby35_nic_fruid[];
 extern const uint8_t fby35_bb_fruid[];
 extern const uint8_t fby35_bmc_fruid[];
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "ds1338", 0x32);
 }
 
+static void tiogapass_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54, 128 * KiB);
+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 6), 0x54, 128 * KiB,
+                          tiogapass_bmc_fruid, tiogapass_bmc_fruid_len);
+}
+
 static void create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
 {
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, bus_id),
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_romulus_class_init(ObjectClass *oc, void *data)
         aspeed_soc_num_cpus(amc->soc_name);
 };
 
+static void aspeed_machine_tiogapass_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Facebook Tiogapass BMC (ARM1176)";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
+    amc->hw_strap2 = 0;
+    amc->fmc_model = "n25q256a";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 2;
+    amc->i2c_init  = tiogapass_bmc_i2c_init;
+    mc->default_ram_size       = 1 * GiB;
+    mc->default_cpus = mc->min_cpus = mc->max_cpus =
+        aspeed_soc_num_cpus(amc->soc_name);
+        aspeed_soc_num_cpus(amc->soc_name);
+};
+
 static void aspeed_machine_sonorapass_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
         .name          = MACHINE_TYPE_NAME("tacoma-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_tacoma_class_init,
+    }, {
+        .name          = MACHINE_TYPE_NAME("tiogapass-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_tiogapass_class_init,
     }, {
         .name          = MACHINE_TYPE_NAME("g220a-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_eeprom.c
+++ b/hw/arm/aspeed_eeprom.c
@@ -XXX,XX +XXX,XX @@
 
 #include "aspeed_eeprom.h"
 
+/* Tiogapass BMC FRU */
+const uint8_t tiogapass_bmc_fruid[] = {
+    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
+    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
+    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
+    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
+    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x54, 0x69, 0x6f, 0x67, 0x61,
+    0x20, 0x50, 0x61, 0x73, 0x73, 0x20, 0x53, 0x69, 0x6e, 0x67, 0x6c, 0x65,
+    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0xc4, 0x58, 0x58, 0x58, 0x32, 0xcd, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
+    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
+};
+
 const uint8_t fby35_nic_fruid[] = {
     0x01, 0x00, 0x00, 0x01, 0x0f, 0x20, 0x00, 0xcf, 0x01, 0x0e, 0x19, 0xd7,
     0x5e, 0xcf, 0xc8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xdd,
@@ -XXX,XX +XXX,XX @@ const uint8_t yosemitev2_bmc_fruid[] = {
     0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
 };
 
+const size_t tiogapass_bmc_fruid_len = sizeof(tiogapass_bmc_fruid);
 const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
 const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
 const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
-- 
2.39.2

From: Sittisak Sinprem <ssinprem@celestica.com>

Signed-off-by: Sittisak Sinprem <ssinprem@celestica.com>
Reviewed-by: Peter Delevoryas <peter@pjd.dev>
[ clg: checkpatch issues ]
Message-Id: <167660539263.10409.9736070122710923479-1@git.sr.ht>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/nvram/eeprom_at24c.c | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/hw/nvram/eeprom_at24c.c b/hw/nvram/eeprom_at24c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/eeprom_at24c.c
+++ b/hw/nvram/eeprom_at24c.c
@@ -XXX,XX +XXX,XX @@ struct EEPROMState {
     uint16_t cur;
     /* total size in bytes */
     uint32_t rsize;
+    /*
+     * address byte number
+     *  for  24c01, 24c02 size <= 256 byte, use only 1 byte
+     *  otherwise size > 256, use 2 byte
+     */
+    uint8_t asize;
+
     bool writable;
     /* cells changed since last START? */
     bool changed;
@@ -XXX,XX +XXX,XX @@ uint8_t at24c_eeprom_recv(I2CSlave *s)
     EEPROMState *ee = AT24C_EE(s);
     uint8_t ret;
 
-    if (ee->haveaddr == 1) {
+    /*
+     * If got the byte address but not completely with address size
+     * will return the invalid value
+     */
+    if (ee->haveaddr > 0 && ee->haveaddr < ee->asize) {
         return 0xff;
     }
 
@@ -XXX,XX +XXX,XX @@ int at24c_eeprom_send(I2CSlave *s, uint8_t data)
 {
     EEPROMState *ee = AT24C_EE(s);
 
-    if (ee->haveaddr < 2) {
+    if (ee->haveaddr < ee->asize) {
         ee->cur <<= 8;
         ee->cur |= data;
         ee->haveaddr++;
-        if (ee->haveaddr == 2) {
+        if (ee->haveaddr == ee->asize) {
             ee->cur %= ee->rsize;
             DPRINTK("Set pointer %04x\n", ee->cur);
         }
@@ -XXX,XX +XXX,XX @@ static void at24c_eeprom_realize(DeviceState *dev, Error **errp)
         }
         DPRINTK("Reset read backing file\n");
     }
+
+    /*
+     * If address size didn't define with property set
+     *   value is 0 as default, setting it by Rom size detecting.
+     */
+    if (ee->asize == 0) {
+        if (ee->rsize <= 256) {
+            ee->asize = 1;
+        } else {
+            ee->asize = 2;
+        }
+    }
 }
 
 static
@@ -XXX,XX +XXX,XX @@ void at24c_eeprom_reset(DeviceState *state)
 
 static Property at24c_eeprom_props[] = {
     DEFINE_PROP_UINT32("rom-size", EEPROMState, rsize, 0),
+    DEFINE_PROP_UINT8("address-size", EEPROMState, asize, 0),
     DEFINE_PROP_BOOL("writable", EEPROMState, writable, true),
     DEFINE_PROP_DRIVE("drive", EEPROMState, blk),
     DEFINE_PROP_END_OF_LIST()
-- 
2.39.2

From: Sittisak Sinprem <ssinprem@celestica.com>

Device 24C64 the size is 64 kilobits = 8kilobyte
Device 24C02 the size is 2 kilobits = 256byte

Signed-off-by: Sittisak Sinprem <ssinprem@celestica.com>
Reviewed-by: Peter Delevoryas <peter@pjd.dev>
[ clg: checkpatch issues ]
Message-Id: <167660539263.10409.9736070122710923479-2@git.sr.ht>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c | 36 ++++++++++++++++++++----------------
 1 file changed, 20 insertions(+), 16 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void fuji_bmc_i2c_init(AspeedMachineState *bmc)
     i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4c);
     i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4d);
 
-    at24c_eeprom_init(i2c[19], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[20], 0x50, 2 * KiB);
-    at24c_eeprom_init(i2c[22], 0x52, 2 * KiB);
+    /*
+     * EEPROM 24c64 size is 64Kbits or 8 Kbytes
+     *        24c02 size is 2Kbits or 256 bytes
+     */
+    at24c_eeprom_init(i2c[19], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[20], 0x50, 256);
+    at24c_eeprom_init(i2c[22], 0x52, 256);
 
     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x48);
     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x49);
     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x4a);
     i2c_slave_create_simple(i2c[3], TYPE_TMP422, 0x4c);
 
-    at24c_eeprom_init(i2c[8], 0x51, 64 * KiB);
+    at24c_eeprom_init(i2c[8], 0x51, 8 * KiB);
     i2c_slave_create_simple(i2c[8], TYPE_LM75, 0x4a);
 
     i2c_slave_create_simple(i2c[50], TYPE_LM75, 0x4c);
-    at24c_eeprom_init(i2c[50], 0x52, 64 * KiB);
+    at24c_eeprom_init(i2c[50], 0x52, 8 * KiB);
     i2c_slave_create_simple(i2c[51], TYPE_TMP75, 0x48);
     i2c_slave_create_simple(i2c[52], TYPE_TMP75, 0x49);
 
     i2c_slave_create_simple(i2c[59], TYPE_TMP75, 0x48);
     i2c_slave_create_simple(i2c[60], TYPE_TMP75, 0x49);
 
-    at24c_eeprom_init(i2c[65], 0x53, 64 * KiB);
+    at24c_eeprom_init(i2c[65], 0x53, 8 * KiB);
     i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x49);
     i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x48);
-    at24c_eeprom_init(i2c[68], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[69], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[70], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[71], 0x52, 64 * KiB);
+    at24c_eeprom_init(i2c[68], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[69], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[70], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[71], 0x52, 8 * KiB);
 
-    at24c_eeprom_init(i2c[73], 0x53, 64 * KiB);
+    at24c_eeprom_init(i2c[73], 0x53, 8 * KiB);
     i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x49);
     i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x48);
-    at24c_eeprom_init(i2c[76], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[77], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[78], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[79], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[28], 0x50, 2 * KiB);
+    at24c_eeprom_init(i2c[76], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[77], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[78], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[79], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[28], 0x50, 256);
 
     for (int i = 0; i < 8; i++) {
         at24c_eeprom_init(i2c[81 + i * 8], 0x56, 64 * KiB);
-- 
2.39.2

The default boot address of the Aspeed SoCs is 0x0. For this reason,
the FMC flash device contents are remapped by HW on the first 256MB of
the address space. In QEMU, this is currently done in the machine init
with the setup of a region alias.

Move this code to the SoC and introduce an extra container to prepare
ground for the boot ROM region which will overlap the FMC flash
remapping.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  5 +++++
 hw/arm/aspeed.c             | 13 +------------
 hw/arm/aspeed_ast2600.c     | 13 +++++++++++++
 hw/arm/aspeed_soc.c         | 14 ++++++++++++++
 hw/arm/fby35.c              |  8 +-------
 5 files changed, 34 insertions(+), 19 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
     MemoryRegion *dram_mr;
     MemoryRegion dram_container;
     MemoryRegion sram;
+    MemoryRegion spi_boot_container;
+    MemoryRegion spi_boot;
     AspeedVICState vic;
     AspeedRtcState rtc;
     AspeedTimerCtrlState timerctrl;
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCClass {
 
 
 enum {
+    ASPEED_DEV_SPI_BOOT,
     ASPEED_DEV_IOMEM,
     ASPEED_DEV_UART1,
     ASPEED_DEV_UART2,
@@ -XXX,XX +XXX,XX @@ enum {
     ASPEED_DEV_JTAG1,
 };
 
+#define ASPEED_SOC_SPI_BOOT_ADDR 0x0
+
 qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
 bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp);
 void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr);
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
         MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
         uint64_t size = memory_region_size(&fl->mmio);
 
-        /*
-         * create a ROM region using the default mapping window size of
-         * the flash module. The window size is 64MB for the AST2400
-         * SoC and 128MB for the AST2500 SoC, which is twice as big as
-         * needed by the flash modules of the Aspeed machines.
-         */
-        if (ASPEED_MACHINE(machine)->mmio_exec) {
-            memory_region_init_alias(boot_rom, NULL, "aspeed.boot_rom",
-                                     &fl->mmio, 0, size);
-            memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
-                                        boot_rom);
-        } else {
+        if (!ASPEED_MACHINE(machine)->mmio_exec) {
             memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
                                    size, &error_abort);
             memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_SOC_DPMCU_SIZE       0x00040000
 
 static const hwaddr aspeed_soc_ast2600_memmap[] = {
+    [ASPEED_DEV_SPI_BOOT]  = ASPEED_SOC_SPI_BOOT_ADDR,
     [ASPEED_DEV_SRAM]      = 0x10000000,
     [ASPEED_DEV_DPMCU]     = 0x18000000,
     /* 0x16000000     0x17FFFFFF : AHB BUS do LPC Bus bridge */
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     qemu_irq irq;
     g_autofree char *sram_name = NULL;
 
+    /* Default boot region (SPI memory or ROMs) */
+    memory_region_init(&s->spi_boot_container, OBJECT(s),
+                       "aspeed.spi_boot_container", 0x10000000);
+    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SPI_BOOT],
+                                &s->spi_boot_container);
+
     /* IO space */
     aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
                                   sc->memmap[ASPEED_DEV_IOMEM],
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
 
+    /* Set up an alias on the FMC CE0 region (boot default) */
+    MemoryRegion *fmc0_mmio = &s->fmc.flashes[0].mmio;
+    memory_region_init_alias(&s->spi_boot, OBJECT(s), "aspeed.spi_boot",
+                             fmc0_mmio, 0, memory_region_size(fmc0_mmio));
+    memory_region_add_subregion(&s->spi_boot_container, 0x0, &s->spi_boot);
+
     /* SPI */
     for (i = 0; i < sc->spis_num; i++) {
         object_property_set_link(OBJECT(&s->spi[i]), "dram",
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_SOC_IOMEM_SIZE       0x00200000
 
 static const hwaddr aspeed_soc_ast2400_memmap[] = {
+    [ASPEED_DEV_SPI_BOOT]  =  ASPEED_SOC_SPI_BOOT_ADDR,
     [ASPEED_DEV_IOMEM]  = 0x1E600000,
     [ASPEED_DEV_FMC]    = 0x1E620000,
     [ASPEED_DEV_SPI1]   = 0x1E630000,
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2400_memmap[] = {
 };
 
 static const hwaddr aspeed_soc_ast2500_memmap[] = {
+    [ASPEED_DEV_SPI_BOOT]  = ASPEED_SOC_SPI_BOOT_ADDR,
     [ASPEED_DEV_IOMEM]  = 0x1E600000,
     [ASPEED_DEV_FMC]    = 0x1E620000,
     [ASPEED_DEV_SPI1]   = 0x1E630000,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     Error *err = NULL;
     g_autofree char *sram_name = NULL;
 
+    /* Default boot region (SPI memory or ROMs) */
+    memory_region_init(&s->spi_boot_container, OBJECT(s),
+                       "aspeed.spi_boot_container", 0x10000000);
+    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SPI_BOOT],
+                                &s->spi_boot_container);
+
     /* IO space */
     aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
                                   sc->memmap[ASPEED_DEV_IOMEM],
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
 
+    /* Set up an alias on the FMC CE0 region (boot default) */
+    MemoryRegion *fmc0_mmio = &s->fmc.flashes[0].mmio;
+    memory_region_init_alias(&s->spi_boot, OBJECT(s), "aspeed.spi_boot",
+                             fmc0_mmio, 0, memory_region_size(fmc0_mmio));
+    memory_region_add_subregion(&s->spi_boot_container, 0x0, &s->spi_boot);
+
     /* SPI */
     for (i = 0; i < sc->spis_num; i++) {
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
         MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
         uint64_t size = memory_region_size(&fl->mmio);
 
-        if (s->mmio_exec) {
-            memory_region_init_alias(boot_rom, NULL, "aspeed.boot_rom",
-                                     &fl->mmio, 0, size);
-            memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
-                                        boot_rom);
-        } else {
-
+        if (!s->mmio_exec) {
             memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
                                    size, &error_abort);
             memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
-- 
2.39.2

To avoid the SPI transactions fetching instructions from the FMC CE0
flash device and speed up boot, a ROM can be created if a drive is
available.

Reverse the logic to allow a machine to boot without a drive, using a
block device instead :

-blockdev node-name=fmc0,driver=file,filename=/path/to/flash.img \
    -device mx66u51235f,bus=ssi.0,drive=fmc0

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c | 47 +++++++++++++++++++++++++++--------------------
 1 file changed, 27 insertions(+), 20 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_reset_secondary(ARMCPU *cpu,
     cpu_set_pc(cs, info->smp_loader_start);
 }
 
-#define FIRMWARE_ADDR 0x0
-
-static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
+static void write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
                            Error **errp)
 {
-    BlockBackend *blk = blk_by_legacy_dinfo(dinfo);
     g_autofree void *storage = NULL;
     int64_t size;
 
@@ -XXX,XX +XXX,XX @@ static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
     rom_add_blob_fixed("aspeed.boot_rom", storage, rom_size, addr);
 }
 
+/*
+ * Create a ROM and copy the flash contents at the expected address
+ * (0x0). Boots faster than execute-in-place.
+ */
+static void aspeed_install_boot_rom(AspeedSoCState *soc, BlockBackend *blk,
+                                    uint64_t rom_size)
+{
+    MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
+
+    memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom", rom_size,
+                           &error_abort);
+    memory_region_add_subregion_overlap(&soc->spi_boot_container, 0,
+                                        boot_rom, 1);
+    write_boot_rom(blk, ASPEED_SOC_SPI_BOOT_ADDR, rom_size, &error_abort);
+}
+
 void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
                                       unsigned int count, int unit0)
 {
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
     AspeedMachineState *bmc = ASPEED_MACHINE(machine);
     AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(machine);
     AspeedSoCClass *sc;
-    DriveInfo *drive0 = drive_get(IF_MTD, 0, 0);
     int i;
     NICInfo *nd = &nd_table[0];
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
                               bmc->spi_model ? bmc->spi_model : amc->spi_model,
                               1, amc->num_cs);
 
-    /* Install first FMC flash content as a boot rom. */
-    if (drive0) {
-        AspeedSMCFlash *fl = &bmc->soc.fmc.flashes[0];
-        MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
-        uint64_t size = memory_region_size(&fl->mmio);
-
-        if (!ASPEED_MACHINE(machine)->mmio_exec) {
-            memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
-                                   size, &error_abort);
-            memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
-                                        boot_rom);
-            write_boot_rom(drive0, FIRMWARE_ADDR, size, &error_abort);
-        }
-    }
-
     if (machine->kernel_filename && sc->num_cpus > 1) {
         /* With no u-boot we must set up a boot stub for the secondary CPU */
         MemoryRegion *smpboot = g_new(MemoryRegion, 1);
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
                            drive_get(IF_SD, 0, bmc->soc.sdhci.num_slots));
     }
 
+    if (!bmc->mmio_exec) {
+        DriveInfo *mtd0 = drive_get(IF_MTD, 0, 0);
+
+        if (mtd0) {
+            uint64_t rom_size = memory_region_size(&bmc->soc.spi_boot);
+            aspeed_install_boot_rom(&bmc->soc, blk_by_legacy_dinfo(mtd0),
+                                    rom_size);
+        }
+    }
+
     arm_load_kernel(ARM_CPU(first_cpu), machine, &aspeed_board_binfo);
 }
 
-- 
2.39.2

It's cleaner and removes the curious '+ 1' required to skip the DMA
IRQ line of the controller.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c     | 2 +-
 hw/ssi/aspeed_smc.c | 5 +----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
         qdev_realize_and_unref(dev, BUS(s->spi), &error_fatal);
 
         cs_line = qdev_get_gpio_in_named(dev, SSI_GPIO_CS, 0);
-        sysbus_connect_irq(SYS_BUS_DEVICE(s), i + 1, cs_line);
+        qdev_connect_gpio_out_named(DEVICE(s), "cs", i, cs_line);
     }
 }
 
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
 
     /* Setup cs_lines for peripherals */
     s->cs_lines = g_new0(qemu_irq, asc->cs_num_max);
-
-    for (i = 0; i < asc->cs_num_max; ++i) {
-        sysbus_init_irq(sbd, &s->cs_lines[i]);
-    }
+    qdev_init_gpio_out_named(DEVICE(s), s->cs_lines, "cs", asc->cs_num_max);
 
     /* The memory region for the controller registers */
     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
-- 
2.39.2

The following changes since commit 08c9f7eec7002dac2da52c8265eb319aba381c86:

Merge tag 'darwin-20220712' of https://github.com/philmd/qemu into staging (2022-07-14 09:30:55 +0100)

are available in the Git repository at:

https://github.com/legoater/qemu/ tags/pull-aspeed-20220714

for you to fetch changes up to f0418558302ef9e140681e04250fc1ca265f3140:

aspeed: Add fby35-bmc slot GPIO's (2022-07-14 16:24:38 +0200)

----------------------------------------------------------------
aspeed queue:

* New ISL69259 device model
* New fby35 multi-SoC machine (AST1030 BIC + AST2600 BMC)
* Aspeed GPIO fixes
* Extension of m25p80 with write protect bits
* More avocado tests using the Aspeed SDK

----------------------------------------------------------------
Cédric Le Goater (3):
      aspeed: fby35: Add a bootrom for the BMC
      docs: aspeed: Minor updates
      test/avocado/machine_aspeed.py: Add SDK tests

Iris Chen (2):
      hw: m25p80: Add Block Protect and Top Bottom bits for write protect
      hw: m25p80: add tests for BP and TB bit write protect

Joel Stanley (1):
      aspeed: sbc: Allow per-machine settings

Peter Delevoryas (13):
      hw/i2c/pmbus: Add idle state to return 0xff's
      hw/sensor: Add IC_DEVICE_ID to ISL voltage regulators
      hw/sensor: Add Renesas ISL69259 device model
      aspeed: Create SRAM name from first CPU index
      aspeed: Refactor UART init for multi-SoC machines
      aspeed: Make aspeed_board_init_flashes public
      aspeed: Add fby35 skeleton
      aspeed: Add AST2600 (BMC) to fby35
      aspeed: Add AST1030 (BIC) to fby35
      docs: aspeed: Add fby35 multi-SoC machine section
      qtest/aspeed_gpio: Add input pin modification test
      hw/gpio/aspeed: Don't let guests modify input pins
      aspeed: Add fby35-bmc slot GPIO's

From: Joel Stanley <joel@jms.id.au>

In order to correctly report secure boot running firmware the values
of certain registers must be set.

We don't yet have documentation from ASPEED on what they mean. The
meaning is inferred from u-boot's use of them.

Introduce properties so the settings can be configured per-machine.

Reviewed-by: Peter Delevoryas <pdel@fb.com>
Tested-by: Peter Delevoryas <pdel@fb.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20220628154740.1117349-4-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/misc/aspeed_sbc.h | 13 +++++++++++
 hw/misc/aspeed_sbc.c         | 42 ++++++++++++++++++++++++++++++++++--
 2 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/aspeed_sbc.h
+++ b/include/hw/misc/aspeed_sbc.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(AspeedSBCState, AspeedSBCClass, ASPEED_SBC)
 
 #define ASPEED_SBC_NR_REGS (0x93c >> 2)
 
+#define QSR_AES                     BIT(27)
+#define QSR_RSA1024                 (0x0 << 12)
+#define QSR_RSA2048                 (0x1 << 12)
+#define QSR_RSA3072                 (0x2 << 12)
+#define QSR_RSA4096                 (0x3 << 12)
+#define QSR_SHA224                  (0x0 << 10)
+#define QSR_SHA256                  (0x1 << 10)
+#define QSR_SHA384                  (0x2 << 10)
+#define QSR_SHA512                  (0x3 << 10)
+
 struct AspeedSBCState {
     SysBusDevice parent;
 
+    bool emmc_abr;
+    uint32_t signing_settings;
+
     MemoryRegion iomem;
 
     uint32_t regs[ASPEED_SBC_NR_REGS];
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "qemu/error-report.h"
+#include "hw/qdev-properties.h"
 #include "hw/misc/aspeed_sbc.h"
 #include "qapi/error.h"
 #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@
 #define R_STATUS        (0x014 / 4)
 #define R_QSR           (0x040 / 4)
 
+/* R_STATUS */
+#define ABR_EN                  BIT(14) /* Mirrors SCU510[11] */
+#define ABR_IMAGE_SOURCE        BIT(13)
+#define SPI_ABR_IMAGE_SOURCE    BIT(12)
+#define SB_CRYPTO_KEY_EXP_DONE  BIT(11)
+#define SB_CRYPTO_BUSY          BIT(10)
+#define OTP_WP_EN               BIT(9)
+#define OTP_ADDR_WP_EN          BIT(8)
+#define LOW_SEC_KEY_EN          BIT(7)
+#define SECURE_BOOT_EN          BIT(6)
+#define UART_BOOT_EN            BIT(5)
+/* bit 4 reserved*/
+#define OTP_CHARGE_PUMP_READY   BIT(3)
+#define OTP_IDLE                BIT(2)
+#define OTP_MEM_IDLE            BIT(1)
+#define OTP_COMPARE_STATUS      BIT(0)
+
+/* QSR */
+#define QSR_RSA_MASK           (0x3 << 12)
+#define QSR_HASH_MASK          (0x3 << 10)
+
 static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
 {
     AspeedSBCState *s = ASPEED_SBC(opaque);
@@ -XXX,XX +XXX,XX @@ static void aspeed_sbc_reset(DeviceState *dev)
     memset(s->regs, 0, sizeof(s->regs));
 
     /* Set secure boot enabled with RSA4096_SHA256 and enable eMMC ABR */
-    s->regs[R_STATUS] = 0x000044C6;
-    s->regs[R_QSR] = 0x07C07C89;
+    s->regs[R_STATUS] = OTP_IDLE | OTP_MEM_IDLE;
+
+    if (s->emmc_abr) {
+        s->regs[R_STATUS] &= ABR_EN;
+    }
+
+    if (s->signing_settings) {
+        s->regs[R_STATUS] &= SECURE_BOOT_EN;
+    }
+
+    s->regs[R_QSR] = s->signing_settings;
 }
 
 static void aspeed_sbc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_sbc = {
     }
 };
 
+static Property aspeed_sbc_properties[] = {
+    DEFINE_PROP_BOOL("emmc-abr", AspeedSBCState, emmc_abr, 0),
+    DEFINE_PROP_UINT32("signing-settings", AspeedSBCState, signing_settings, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
 static void aspeed_sbc_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void aspeed_sbc_class_init(ObjectClass *klass, void *data)
     dc->realize = aspeed_sbc_realize;
     dc->reset = aspeed_sbc_reset;
     dc->vmsd = &vmstate_aspeed_sbc;
+    device_class_set_props(dc, aspeed_sbc_properties);
 }
 
 static const TypeInfo aspeed_sbc_info = {
-- 
2.35.3

From: Peter Delevoryas <pdel@fb.com>

Signed-off-by: Peter Delevoryas <pdel@fb.com>
Reviewed-by: Titus Rwantare <titusr@google.com>
Message-Id: <20220701000626.77395-2-me@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/i2c/pmbus_device.h | 7 +++++++
 hw/i2c/pmbus_device.c         | 9 +++++++++
 2 files changed, 16 insertions(+)

diff --git a/include/hw/i2c/pmbus_device.h b/include/hw/i2c/pmbus_device.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/pmbus_device.h
+++ b/include/hw/i2c/pmbus_device.h
@@ -XXX,XX +XXX,XX @@ enum pmbus_registers {
     PMBUS_MFR_MAX_TEMP_1            = 0xC0, /* R/W word */
     PMBUS_MFR_MAX_TEMP_2            = 0xC1, /* R/W word */
     PMBUS_MFR_MAX_TEMP_3            = 0xC2, /* R/W word */
+    PMBUS_IDLE_STATE                = 0xFF,
 };
 
 /* STATUS_WORD */
@@ -XXX,XX +XXX,XX @@ int pmbus_page_config(PMBusDevice *pmdev, uint8_t page_index, uint64_t flags);
  */
 void pmbus_check_limits(PMBusDevice *pmdev);
 
+/**
+ * Enter an idle state where only the PMBUS_ERR_BYTE will be returned
+ * indefinitely until a new command is issued.
+ */
+void pmbus_idle(PMBusDevice *pmdev);
+
 extern const VMStateDescription vmstate_pmbus_device;
 
 #define VMSTATE_PMBUS_DEVICE(_field, _state) {                       \
diff --git a/hw/i2c/pmbus_device.c b/hw/i2c/pmbus_device.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/pmbus_device.c
+++ b/hw/i2c/pmbus_device.c
@@ -XXX,XX +XXX,XX @@ void pmbus_check_limits(PMBusDevice *pmdev)
     }
 }
 
+void pmbus_idle(PMBusDevice *pmdev)
+{
+    pmdev->code = PMBUS_IDLE_STATE;
+}
+
 /* assert the status_cml error upon receipt of malformed command */
 static void pmbus_cml_error(PMBusDevice *pmdev)
 {
@@ -XXX,XX +XXX,XX @@ static uint8_t pmbus_receive_byte(SMBusDevice *smd)
         }
         break;
 
+    case PMBUS_IDLE_STATE:
+        pmbus_send8(pmdev, PMBUS_ERR_BYTE);
+        break;
+
     case PMBUS_CLEAR_FAULTS:              /* Send Byte */
     case PMBUS_PAGE_PLUS_WRITE:           /* Block Write-only */
     case PMBUS_STORE_DEFAULT_ALL:         /* Send Byte */
-- 
2.35.3

From: Peter Delevoryas <pdel@fb.com>

This commit adds a passthrough for PMBUS_IC_DEVICE_ID to allow Renesas
voltage regulators to return the integrated circuit device ID if they
would like to.

The behavior is very device specific, so it hasn't been added to the
general PMBUS model. Additionally, if the device ID hasn't been set,
then the voltage regulator will respond with the error byte value.  The
guest error message will change slightly for IC_DEVICE_ID with this
commit.

Signed-off-by: Peter Delevoryas <pdel@fb.com>
Reviewed-by: Titus Rwantare <titusr@google.com>
Message-Id: <20220701000626.77395-3-me@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/sensor/isl_pmbus_vr.h |  5 +++++
 hw/sensor/isl_pmbus_vr.c         | 12 ++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/include/hw/sensor/isl_pmbus_vr.h b/include/hw/sensor/isl_pmbus_vr.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sensor/isl_pmbus_vr.h
+++ b/include/hw/sensor/isl_pmbus_vr.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/i2c/pmbus_device.h"
 #include "qom/object.h"
 
+#define TYPE_ISL69259   "isl69259"
 #define TYPE_ISL69260   "isl69260"
 #define TYPE_RAA228000  "raa228000"
 #define TYPE_RAA229004  "raa229004"
+#define ISL_MAX_IC_DEVICE_ID_LEN 16
 
 struct ISLState {
     PMBusDevice parent;
+
+    uint8_t ic_device_id[ISL_MAX_IC_DEVICE_ID_LEN];
+    uint8_t ic_device_id_len;
 };
 
 OBJECT_DECLARE_SIMPLE_TYPE(ISLState, ISL69260)
diff --git a/hw/sensor/isl_pmbus_vr.c b/hw/sensor/isl_pmbus_vr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sensor/isl_pmbus_vr.c
+++ b/hw/sensor/isl_pmbus_vr.c
@@ -XXX,XX +XXX,XX @@
 
 static uint8_t isl_pmbus_vr_read_byte(PMBusDevice *pmdev)
 {
+    ISLState *s = ISL69260(pmdev);
+
+    switch (pmdev->code) {
+    case PMBUS_IC_DEVICE_ID:
+        if (!s->ic_device_id_len) {
+            break;
+        }
+        pmbus_send(pmdev, s->ic_device_id, s->ic_device_id_len);
+        pmbus_idle(pmdev);
+        return 0;
+    }
+
     qemu_log_mask(LOG_GUEST_ERROR,
                   "%s: reading from unsupported register: 0x%02x\n",
                   __func__, pmdev->code);
-- 
2.35.3

From: Peter Delevoryas <pdel@fb.com>

This adds the ISL69259, using all the same functionality as the existing
ISL69260 but overriding the IC_DEVICE_ID.

Signed-off-by: Peter Delevoryas <pdel@fb.com>
Reviewed-by: Titus Rwantare <titusr@google.com>
Message-Id: <20220701000626.77395-4-me@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/sensor/isl_pmbus_vr.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/hw/sensor/isl_pmbus_vr.c b/hw/sensor/isl_pmbus_vr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sensor/isl_pmbus_vr.c
+++ b/hw/sensor/isl_pmbus_vr.c
@@ -XXX,XX +XXX,XX @@ static void raa228000_exit_reset(Object *obj)
     pmdev->pages[0].read_temperature_3 = 0;
 }
 
+static void isl69259_exit_reset(Object *obj)
+{
+    ISLState *s = ISL69260(obj);
+    static const uint8_t ic_device_id[] = {0x04, 0x00, 0x81, 0xD2, 0x49, 0x3c};
+    g_assert(sizeof(ic_device_id) <= sizeof(s->ic_device_id));
+
+    isl_pmbus_vr_exit_reset(obj);
+
+    s->ic_device_id_len = sizeof(ic_device_id);
+    memcpy(s->ic_device_id, ic_device_id, sizeof(ic_device_id));
+}
+
 static void isl_pmbus_vr_add_props(Object *obj, uint64_t *flags, uint8_t pages)
 {
     PMBusDevice *pmdev = PMBUS_DEVICE(obj);
@@ -XXX,XX +XXX,XX @@ static void raa229004_class_init(ObjectClass *klass, void *data)
     isl_pmbus_vr_class_init(klass, data, 2);
 }
 
+static void isl69259_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    dc->desc = "Renesas ISL69259 Digital Multiphase Voltage Regulator";
+    rc->phases.exit = isl69259_exit_reset;
+    isl_pmbus_vr_class_init(klass, data, 2);
+}
+
+static const TypeInfo isl69259_info = {
+    .name = TYPE_ISL69259,
+    .parent = TYPE_ISL69260,
+    .class_init = isl69259_class_init,
+};
+
 static const TypeInfo isl69260_info = {
     .name = TYPE_ISL69260,
     .parent = TYPE_PMBUS_DEVICE,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo raa228000_info = {
 
 static void isl_pmbus_vr_register_types(void)
 {
+    type_register_static(&isl69259_info);
     type_register_static(&isl69260_info);
     type_register_static(&raa228000_info);
     type_register_static(&raa229004_info);
-- 
2.35.3

From: Peter Delevoryas <peter@pjd.dev>

To support multiple SoC's running simultaneously, we need a unique name for
each RAM region. DRAM is created by the machine, but SRAM is created by the
SoC, since in hardware it is part of the SoC's internals.

We need a way to uniquely identify each SRAM region though, for VM
migration. Since each of the SoC's CPU's has an index which identifies it
uniquely from other CPU's in the machine, we can use the index of any of the
CPU's in the SoC to uniquely identify differentiate the SRAM name from other
SoC SRAM's. In this change, I just elected to use the index of the first CPU
in each SoC.

Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220705191400.41632-3-peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed_ast10x0.c | 5 ++++-
 hw/arm/aspeed_ast2600.c | 5 +++--
 hw/arm/aspeed_soc.c     | 5 +++--
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     DeviceState *armv7m;
     Error *err = NULL;
     int i;
+    g_autofree char *sram_name = NULL;
 
     if (!clock_has_source(s->sysclk)) {
         error_setg(errp, "sysclk clock must be wired up by the board code");
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), &error_abort);
 
     /* Internal SRAM */
-    memory_region_init_ram(&s->sram, NULL, "aspeed.sram", sc->sram_size, &err);
+    sram_name = g_strdup_printf("aspeed.sram.%d",
+                                CPU(s->armv7m.cpu)->cpu_index);
+    memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size, &err);
     if (err != NULL) {
         error_propagate(errp, err);
         return;
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     Error *err = NULL;
     qemu_irq irq;
+    g_autofree char *sram_name = NULL;
 
     /* IO space */
     aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     }
 
     /* SRAM */
-    memory_region_init_ram(&s->sram, OBJECT(dev), "aspeed.sram",
-                           sc->sram_size, &err);
+    sram_name = g_strdup_printf("aspeed.sram.%d", CPU(&s->cpu[0])->cpu_index);
+    memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size, &err);
     if (err) {
         error_propagate(errp, err);
         return;
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     AspeedSoCState *s = ASPEED_SOC(dev);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     Error *err = NULL;
+    g_autofree char *sram_name = NULL;
 
     /* IO space */
     aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     }
 
     /* SRAM */
-    memory_region_init_ram(&s->sram, OBJECT(dev), "aspeed.sram",
-                           sc->sram_size, &err);
+    sram_name = g_strdup_printf("aspeed.sram.%d", CPU(&s->cpu[0])->cpu_index);
+    memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size, &err);
     if (err) {
         error_propagate(errp, err);
         return;
-- 
2.35.3

From: Peter Delevoryas <peter@pjd.dev>

This change moves the code that connects the SoC UART's to serial_hd's
to the machine.

It makes each UART a proper child member of the SoC, and then allows the
machine to selectively initialize the chardev for each UART with a
serial_hd.

This should preserve backwards compatibility, but also allow multi-SoC
boards to completely change the wiring of serial devices from the
command line to specific SoC UART's.

This also removes the uart-default property from the SoC, since the SoC
doesn't need to know what UART is the "default" on the machine anymore.

I tested this using the images and commands from the previous
refactoring, and another test image for the ast1030:

wget https://github.com/facebook/openbmc/releases/download/v2021.49.0/fuji.mtd
    wget https://github.com/facebook/openbmc/releases/download/v2021.49.0/wedge100.mtd
    wget https://github.com/peterdelevoryas/OpenBIC/releases/download/oby35-cl-2022.13.01/Y35BCL.elf

Fuji uses UART1:

qemu-system-arm -machine fuji-bmc \
        -drive file=fuji.mtd,format=raw,if=mtd \
        -nographic

ast2600-evb uses uart-default=UART5:

qemu-system-arm -machine ast2600-evb \
        -drive file=fuji.mtd,format=raw,if=mtd \
        -serial null -serial mon:stdio -display none

Wedge100 uses UART3:

qemu-system-arm -machine palmetto-bmc \
        -drive file=wedge100.mtd,format=raw,if=mtd \
        -serial null -serial null -serial null \
        -serial mon:stdio -display none

AST1030 EVB uses UART5:

qemu-system-arm -machine ast1030-evb \
        -kernel Y35BCL.elf -nographic

Fixes: 6827ff20b2975 ("hw: aspeed: Init all UART's with serial devices")
Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220705191400.41632-4-peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  7 ++++--
 hw/arm/aspeed.c             | 22 +++++++++++++---
 hw/arm/aspeed_ast10x0.c     |  8 +++++-
 hw/arm/aspeed_ast2600.c     |  8 +++++-
 hw/arm/aspeed_soc.c         | 50 +++++++++++++++++++++++++------------
 5 files changed, 71 insertions(+), 24 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/aspeed_lpc.h"
 #include "hw/misc/unimp.h"
 #include "hw/misc/aspeed_peci.h"
+#include "hw/char/serial.h"
 
 #define ASPEED_SPIS_NUM  2
 #define ASPEED_EHCIS_NUM 2
 #define ASPEED_WDTS_NUM  4
 #define ASPEED_CPUS_NUM  2
 #define ASPEED_MACS_NUM  4
+#define ASPEED_UARTS_NUM 13
 
 struct AspeedSoCState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
     AspeedSDHCIState emmc;
     AspeedLPCState lpc;
     AspeedPECIState peci;
-    uint32_t uart_default;
+    SerialMM uart[ASPEED_UARTS_NUM];
     Clock *sysclk;
     UnimplementedDeviceState iomem;
     UnimplementedDeviceState video;
@@ -XXX,XX +XXX,XX @@ enum {
 };
 
 qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
-void aspeed_soc_uart_init(AspeedSoCState *s);
+bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp);
+void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr);
 bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
 void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr);
 void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "qemu/units.h"
 #include "hw/qdev-clock.h"
+#include "sysemu/sysemu.h"
 
 static struct arm_boot_info aspeed_board_binfo = {
     .board_id = -1, /* device-tree-only board */
@@ -XXX,XX +XXX,XX @@ static void sdhci_attach_drive(SDHCIState *sdhci, DriveInfo *dinfo)
                                &error_fatal);
 }
 
+static void connect_serial_hds_to_uarts(AspeedMachineState *bmc)
+{
+    AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(bmc);
+    AspeedSoCState *s = &bmc->soc;
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+
+    aspeed_soc_uart_set_chr(s, amc->uart_default, serial_hd(0));
+    for (int i = 1, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
+        if (uart == amc->uart_default) {
+            continue;
+        }
+        aspeed_soc_uart_set_chr(s, uart, serial_hd(i));
+    }
+}
+
 static void aspeed_machine_init(MachineState *machine)
 {
     AspeedMachineState *bmc = ASPEED_MACHINE(machine);
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
         object_property_set_int(OBJECT(&bmc->soc), "hw-prot-key",
                                 ASPEED_SCU_PROT_KEY, &error_abort);
     }
-    qdev_prop_set_uint32(DEVICE(&bmc->soc), "uart-default",
-                         amc->uart_default);
+    connect_serial_hds_to_uarts(bmc);
     qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
 
     aspeed_board_init_flashes(&bmc->soc.fmc,
@@ -XXX,XX +XXX,XX @@ static void aspeed_minibmc_machine_init(MachineState *machine)
 
     object_property_set_link(OBJECT(&bmc->soc), "memory",
                              OBJECT(get_system_memory()), &error_abort);
-    qdev_prop_set_uint32(DEVICE(&bmc->soc), "uart-default",
-                         amc->uart_default);
+    connect_serial_hds_to_uarts(bmc);
     qdev_realize(DEVICE(&bmc->soc), NULL, &error_abort);
 
     aspeed_board_init_flashes(&bmc->soc.fmc,
diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_init(Object *obj)
         object_initialize_child(obj, "wdt[*]", &s->wdt[i], typename);
     }
 
+    for (i = 0; i < sc->uarts_num; i++) {
+        object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
+    }
+
     snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
     object_initialize_child(obj, "gpio", &s->gpio, typename);
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
                                 sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_4));
 
     /* UART */
-    aspeed_soc_uart_init(s);
+    if (!aspeed_soc_uart_realize(s, errp)) {
+        return;
+    }
 
     /* Timer */
     object_property_set_link(OBJECT(&s->timerctrl), "scu", OBJECT(&s->scu),
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_init(Object *obj)
         object_initialize_child(obj, "mii[*]", &s->mii[i], TYPE_ASPEED_MII);
     }
 
+    for (i = 0; i < sc->uarts_num; i++) {
+        object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
+    }
+
     snprintf(typename, sizeof(typename), TYPE_ASPEED_XDMA "-%s", socname);
     object_initialize_child(obj, "xdma", &s->xdma, typename);
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
 
     /* UART */
-    aspeed_soc_uart_init(s);
+    if (!aspeed_soc_uart_realize(s, errp)) {
+        return;
+    }
 
     /* I2C */
     object_property_set_link(OBJECT(&s->i2c), "dram", OBJECT(s->dram_mr),
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                                 TYPE_FTGMAC100);
     }
 
+    for (i = 0; i < sc->uarts_num; i++) {
+        object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
+    }
+
     snprintf(typename, sizeof(typename), TYPE_ASPEED_XDMA "-%s", socname);
     object_initialize_child(obj, "xdma", &s->xdma, typename);
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
 
     /* UART */
-    aspeed_soc_uart_init(s);
+    if (!aspeed_soc_uart_realize(s, errp)) {
+        return;
+    }
 
     /* I2C */
     object_property_set_link(OBJECT(&s->i2c), "dram", OBJECT(s->dram_mr),
@@ -XXX,XX +XXX,XX @@ static Property aspeed_soc_properties[] = {
                      MemoryRegion *),
     DEFINE_PROP_LINK("dram", AspeedSoCState, dram_mr, TYPE_MEMORY_REGION,
                      MemoryRegion *),
-    DEFINE_PROP_UINT32("uart-default", AspeedSoCState, uart_default,
-                       ASPEED_DEV_UART5),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -XXX,XX +XXX,XX @@ qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev)
     return ASPEED_SOC_GET_CLASS(s)->get_irq(s, dev);
 }
 
-void aspeed_soc_uart_init(AspeedSoCState *s)
+bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp)
 {
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-    int i, uart;
-
-    /* Attach an 8250 to the IO space as our UART */
-    serial_mm_init(s->memory, sc->memmap[s->uart_default], 2,
-                   aspeed_soc_get_irq(s, s->uart_default), 38400,
-                   serial_hd(0), DEVICE_LITTLE_ENDIAN);
-    for (i = 1, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
-        if (uart == s->uart_default) {
-            uart++;
+    SerialMM *smm;
+
+    for (int i = 0, uart = ASPEED_DEV_UART1; i < sc->uarts_num; i++, uart++) {
+        smm = &s->uart[i];
+
+        /* Chardev property is set by the machine. */
+        qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
+        qdev_prop_set_uint32(DEVICE(smm), "baudbase", 38400);
+        qdev_set_legacy_instance_id(DEVICE(smm), sc->memmap[uart], 2);
+        qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
+        if (!sysbus_realize(SYS_BUS_DEVICE(smm), errp)) {
+            return false;
         }
-        serial_mm_init(s->memory, sc->memmap[uart], 2,
-                       aspeed_soc_get_irq(s, uart), 38400,
-                       serial_hd(i), DEVICE_LITTLE_ENDIAN);
+
+        sysbus_connect_irq(SYS_BUS_DEVICE(smm), 0, aspeed_soc_get_irq(s, uart));
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(smm), 0, sc->memmap[uart]);
     }
+
+    return true;
+}
+
+void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr)
+{
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    int i = dev - ASPEED_DEV_UART1;
+
+    g_assert(0 <= i && i < ARRAY_SIZE(s->uart) && i < sc->uarts_num);
+    qdev_prop_set_chr(DEVICE(&s->uart[i]), "chardev", chr);
 }
 
 /*
-- 
2.35.3

From: Peter Delevoryas <peter@pjd.dev>

Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220705191400.41632-5-peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h | 2 ++
 hw/arm/aspeed.c             | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr);
 void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
                                    const char *name, hwaddr addr,
                                    uint64_t size);
+void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
+                               unsigned int count, int unit0);
 
 #endif /* ASPEED_SOC_H */
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
     rom_add_blob_fixed("aspeed.boot_rom", storage, rom_size, addr);
 }
 
-static void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
+void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
                                       unsigned int count, int unit0)
 {
     int i;
-- 
2.35.3

From: Peter Delevoryas <peter@pjd.dev>

Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220705191400.41632-6-peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/fby35.c     | 39 +++++++++++++++++++++++++++++++++++++++
 MAINTAINERS        |  1 +
 hw/arm/meson.build |  3 ++-
 3 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/fby35.c

diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates. (http://www.meta.com)
+ *
+ * This code is licensed under the GPL version 2 or later. See the COPYING
+ * file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/boards.h"
+
+#define TYPE_FBY35 MACHINE_TYPE_NAME("fby35")
+OBJECT_DECLARE_SIMPLE_TYPE(Fby35State, FBY35);
+
+struct Fby35State {
+    MachineState parent_obj;
+};
+
+static void fby35_init(MachineState *machine)
+{
+}
+
+static void fby35_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->desc = "Meta Platforms fby35";
+    mc->init = fby35_init;
+}
+
+static const TypeInfo fby35_types[] = {
+    {
+        .name = MACHINE_TYPE_NAME("fby35"),
+        .parent = TYPE_MACHINE,
+        .class_init = fby35_class_init,
+        .instance_size = sizeof(Fby35State),
+    },
+};
+
+DEFINE_TYPES(fby35_types);
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/net/ftgmac100.c
 F: include/hw/net/ftgmac100.h
 F: docs/system/arm/aspeed.rst
 F: tests/qtest/*aspeed*
+F: hw/arm/fby35.c
 
 NRF51
 M: Joel Stanley <joel@jms.id.au>
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_soc.c',
   'aspeed.c',
   'aspeed_ast2600.c',
-  'aspeed_ast10x0.c'))
+  'aspeed_ast10x0.c',
+  'fby35.c'))
 arm_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2.c'))
 arm_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2-tz.c'))
 arm_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-soc.c'))
-- 
2.35.3

From: Peter Delevoryas <peter@pjd.dev>

You can test booting the BMC with both '-device loader' and '-drive
file'. This is necessary because of how the fb-openbmc boot sequence
works (jump to 0x20000000 after U-Boot SPL).

wget https://github.com/facebook/openbmc/releases/download/openbmc-e2294ff5d31d/fby35.mtd
    qemu-system-arm -machine fby35 -nographic \
        -device loader,file=fby35.mtd,addr=0,cpu-num=0 -drive file=fby35.mtd,format=raw,if=mtd

Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220705191400.41632-7-peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/fby35.c | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "sysemu/sysemu.h"
 #include "hw/boards.h"
+#include "hw/arm/aspeed_soc.h"
 
 #define TYPE_FBY35 MACHINE_TYPE_NAME("fby35")
 OBJECT_DECLARE_SIMPLE_TYPE(Fby35State, FBY35);
 
 struct Fby35State {
     MachineState parent_obj;
+
+    MemoryRegion bmc_memory;
+    MemoryRegion bmc_dram;
+    MemoryRegion bmc_boot_rom;
+
+    AspeedSoCState bmc;
 };
 
+#define FBY35_BMC_RAM_SIZE (2 * GiB)
+
+static void fby35_bmc_init(Fby35State *s)
+{
+    memory_region_init(&s->bmc_memory, OBJECT(s), "bmc-memory", UINT64_MAX);
+    memory_region_init_ram(&s->bmc_dram, OBJECT(s), "bmc-dram",
+                           FBY35_BMC_RAM_SIZE, &error_abort);
+
+    object_initialize_child(OBJECT(s), "bmc", &s->bmc, "ast2600-a3");
+    object_property_set_int(OBJECT(&s->bmc), "ram-size", FBY35_BMC_RAM_SIZE,
+                            &error_abort);
+    object_property_set_link(OBJECT(&s->bmc), "memory", OBJECT(&s->bmc_memory),
+                             &error_abort);
+    object_property_set_link(OBJECT(&s->bmc), "dram", OBJECT(&s->bmc_dram),
+                             &error_abort);
+    object_property_set_int(OBJECT(&s->bmc), "hw-strap1", 0x000000C0,
+                            &error_abort);
+    object_property_set_int(OBJECT(&s->bmc), "hw-strap2", 0x00000003,
+                            &error_abort);
+    aspeed_soc_uart_set_chr(&s->bmc, ASPEED_DEV_UART5, serial_hd(0));
+    qdev_realize(DEVICE(&s->bmc), NULL, &error_abort);
+
+    aspeed_board_init_flashes(&s->bmc.fmc, "n25q00", 2, 0);
+}
+
 static void fby35_init(MachineState *machine)
 {
+    Fby35State *s = FBY35(machine);
+
+    fby35_bmc_init(s);
 }
 
 static void fby35_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void fby35_class_init(ObjectClass *oc, void *data)
 
     mc->desc = "Meta Platforms fby35";
     mc->init = fby35_init;
+    mc->no_floppy = 1;
+    mc->no_cdrom = 1;
+    mc->min_cpus = mc->max_cpus = mc->default_cpus = 2;
 }
 
 static const TypeInfo fby35_types[] = {
-- 
2.35.3

The BMC boots from the first flash device by fetching instructions
from the flash contents. Add an alias region on 0x0 for this
purpose. There are currently performance issues with this method (TBs
being flushed too often), so as a faster alternative, install the
flash contents as a ROM in the BMC memory space.

See commit 1a15311a12fa ("hw/arm/aspeed: add a 'execute-in-place'
property to boot directly from CE0")

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Delevoryas <peter@pjd.dev>
[ clg: blk_pread() fixes ]
Message-Id: <20220705191400.41632-8-peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/fby35.c | 83 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 83 insertions(+)

diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/units.h"
 #include "qapi/error.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/block-backend.h"
 #include "hw/boards.h"
 #include "hw/arm/aspeed_soc.h"
 
@@ -XXX,XX +XXX,XX @@ struct Fby35State {
     MemoryRegion bmc_boot_rom;
 
     AspeedSoCState bmc;
+
+    bool mmio_exec;
 };
 
 #define FBY35_BMC_RAM_SIZE (2 * GiB)
+#define FBY35_BMC_FIRMWARE_ADDR 0x0
+
+static void fby35_bmc_write_boot_rom(DriveInfo *dinfo, MemoryRegion *mr,
+                                     hwaddr offset, size_t rom_size,
+                                     Error **errp)
+{
+    BlockBackend *blk = blk_by_legacy_dinfo(dinfo);
+    g_autofree void *storage = NULL;
+    int64_t size;
+
+    /*
+     * The block backend size should have already been 'validated' by
+     * the creation of the m25p80 object.
+     */
+    size = blk_getlength(blk);
+    if (size <= 0) {
+        error_setg(errp, "failed to get flash size");
+        return;
+    }
+
+    if (rom_size > size) {
+        rom_size = size;
+    }
+
+    storage = g_malloc0(rom_size);
+    if (blk_pread(blk, 0, rom_size, storage, 0) < 0) {
+        error_setg(errp, "failed to read the initial flash content");
+        return;
+    }
+
+    /* TODO: find a better way to install the ROM */
+    memcpy(memory_region_get_ram_ptr(mr) + offset, storage, rom_size);
+}
 
 static void fby35_bmc_init(Fby35State *s)
 {
+    DriveInfo *drive0 = drive_get(IF_MTD, 0, 0);
+
     memory_region_init(&s->bmc_memory, OBJECT(s), "bmc-memory", UINT64_MAX);
     memory_region_init_ram(&s->bmc_dram, OBJECT(s), "bmc-dram",
                            FBY35_BMC_RAM_SIZE, &error_abort);
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
     qdev_realize(DEVICE(&s->bmc), NULL, &error_abort);
 
     aspeed_board_init_flashes(&s->bmc.fmc, "n25q00", 2, 0);
+
+    /* Install first FMC flash content as a boot rom. */
+    if (drive0) {
+        AspeedSMCFlash *fl = &s->bmc.fmc.flashes[0];
+        MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
+        uint64_t size = memory_region_size(&fl->mmio);
+
+        if (s->mmio_exec) {
+            memory_region_init_alias(boot_rom, NULL, "aspeed.boot_rom",
+                                     &fl->mmio, 0, size);
+            memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
+                                        boot_rom);
+        } else {
+
+            memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
+                                   size, &error_abort);
+            memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
+                                        boot_rom);
+            fby35_bmc_write_boot_rom(drive0, boot_rom, FBY35_BMC_FIRMWARE_ADDR,
+                                     size, &error_abort);
+        }
+    }
 }
 
 static void fby35_init(MachineState *machine)
@@ -XXX,XX +XXX,XX @@ static void fby35_init(MachineState *machine)
     fby35_bmc_init(s);
 }
 
+
+static bool fby35_get_mmio_exec(Object *obj, Error **errp)
+{
+    return FBY35(obj)->mmio_exec;
+}
+
+static void fby35_set_mmio_exec(Object *obj, bool value, Error **errp)
+{
+    FBY35(obj)->mmio_exec = value;
+}
+
+static void fby35_instance_init(Object *obj)
+{
+    FBY35(obj)->mmio_exec = false;
+}
+
 static void fby35_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void fby35_class_init(ObjectClass *oc, void *data)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->min_cpus = mc->max_cpus = mc->default_cpus = 2;
+
+    object_class_property_add_bool(oc, "execute-in-place",
+                                   fby35_get_mmio_exec,
+                                   fby35_set_mmio_exec);
+    object_class_property_set_description(oc, "execute-in-place",
+                           "boot directly from CE0 flash device");
 }
 
 static const TypeInfo fby35_types[] = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo fby35_types[] = {
         .parent = TYPE_MACHINE,
         .class_init = fby35_class_init,
         .instance_size = sizeof(Fby35State),
+        .instance_init = fby35_instance_init,
     },
 };
 
-- 
2.35.3

From: Peter Delevoryas <peter@pjd.dev>

With the BIC, the easiest way to run everything is to create two pty's
for each SoC and reserve stdin/stdout for the monitor:

wget https://github.com/facebook/openbmc/releases/download/openbmc-e2294ff5d31d/fby35.mtd
    wget https://github.com/peterdelevoryas/OpenBIC/releases/download/oby35-cl-2022.13.01/Y35BCL.elf
    qemu-system-arm -machine fby35 \
        -drive file=fby35.mtd,format=raw,if=mtd \
        -device loader,file=fby35.mtd,addr=0,cpu-num=0 \
        -serial pty -serial pty -serial mon:stdio -display none -S

screen /dev/ttys0
    screen /dev/ttys1
    (qemu) c

This commit only adds the the first server board's Bridge IC, but in the
future we'll try to include the other three server board Bridge IC's
too.

Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220705191400.41632-9-peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/fby35.c | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "sysemu/block-backend.h"
 #include "hw/boards.h"
+#include "hw/qdev-clock.h"
 #include "hw/arm/aspeed_soc.h"
+#include "hw/arm/boot.h"
 
 #define TYPE_FBY35 MACHINE_TYPE_NAME("fby35")
 OBJECT_DECLARE_SIMPLE_TYPE(Fby35State, FBY35);
@@ -XXX,XX +XXX,XX @@ struct Fby35State {
     MemoryRegion bmc_memory;
     MemoryRegion bmc_dram;
     MemoryRegion bmc_boot_rom;
+    MemoryRegion bic_memory;
+    Clock *bic_sysclk;
 
     AspeedSoCState bmc;
+    AspeedSoCState bic;
 
     bool mmio_exec;
 };
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
     }
 }
 
+static void fby35_bic_init(Fby35State *s)
+{
+    s->bic_sysclk = clock_new(OBJECT(s), "SYSCLK");
+    clock_set_hz(s->bic_sysclk, 200000000ULL);
+
+    memory_region_init(&s->bic_memory, OBJECT(s), "bic-memory", UINT64_MAX);
+
+    object_initialize_child(OBJECT(s), "bic", &s->bic, "ast1030-a1");
+    qdev_connect_clock_in(DEVICE(&s->bic), "sysclk", s->bic_sysclk);
+    object_property_set_link(OBJECT(&s->bic), "memory", OBJECT(&s->bic_memory),
+                             &error_abort);
+    aspeed_soc_uart_set_chr(&s->bic, ASPEED_DEV_UART5, serial_hd(1));
+    qdev_realize(DEVICE(&s->bic), NULL, &error_abort);
+
+    aspeed_board_init_flashes(&s->bic.fmc, "sst25vf032b", 2, 2);
+    aspeed_board_init_flashes(&s->bic.spi[0], "sst25vf032b", 2, 4);
+    aspeed_board_init_flashes(&s->bic.spi[1], "sst25vf032b", 2, 6);
+}
+
 static void fby35_init(MachineState *machine)
 {
     Fby35State *s = FBY35(machine);
 
     fby35_bmc_init(s);
+    fby35_bic_init(s);
 }
 
 
@@ -XXX,XX +XXX,XX @@ static void fby35_class_init(ObjectClass *oc, void *data)
     mc->init = fby35_init;
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
-    mc->min_cpus = mc->max_cpus = mc->default_cpus = 2;
+    mc->min_cpus = mc->max_cpus = mc->default_cpus = 3;
 
     object_class_property_add_bool(oc, "execute-in-place",
                                    fby35_get_mmio_exec,
-- 
2.35.3

From: Peter Delevoryas <peter@pjd.dev>

Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
[ clg: - fixed URL links
       - Moved Facebook Yosemite section at the end of the file ]
Message-Id: <20220705191400.41632-10-peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 docs/system/arm/aspeed.rst | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -XXX,XX +XXX,XX @@ To boot a kernel directly from a Zephyr build tree:
 
   $ qemu-system-arm -M ast1030-evb -nographic \
         -kernel zephyr.elf
+
+Facebook Yosemite v3.5 Platform and CraterLake Server (``fby35``)
+==================================================================
+
+Facebook has a series of multi-node compute server designs named
+Yosemite. The most recent version released was
+`Yosemite v3 <https://www.opencompute.org/documents/ocp-yosemite-v3-platform-design-specification-1v16-pdf>`__.
+
+Yosemite v3.5 is an iteration on this design, and is very similar: there's a
+baseboard with a BMC, and 4 server slots. The new server board design termed
+"CraterLake" includes a Bridge IC (BIC), with room for expansion boards to
+include various compute accelerators (video, inferencing, etc). At the moment,
+only the first server slot's BIC is included.
+
+Yosemite v3.5 is itself a sled which fits into a 40U chassis, and 3 sleds
+can be fit into a chassis. See `here <https://www.opencompute.org/products/423/wiwynn-yosemite-v3-server>`__
+for an example.
+
+In this generation, the BMC is an AST2600 and each BIC is an AST1030. The BMC
+runs `OpenBMC <https://github.com/facebook/openbmc>`__, and the BIC runs
+`OpenBIC <https://github.com/facebook/openbic>`__.
+
+Firmware images can be retrieved from the Github releases or built from the
+source code, see the README's for instructions on that. This image uses the
+"fby35" machine recipe from OpenBMC, and the "yv35-cl" target from OpenBIC.
+Some reference images can also be found here:
+
+.. code-block:: bash
+
+    $ wget https://github.com/facebook/openbmc/releases/download/openbmc-e2294ff5d31d/fby35.mtd
+    $ wget https://github.com/peterdelevoryas/OpenBIC/releases/download/oby35-cl-2022.13.01/Y35BCL.elf
+
+Since this machine has multiple SoC's, each with their own serial console, the
+recommended way to run it is to allocate a pseudoterminal for each serial
+console and let the monitor use stdio. Also, starting in a paused state is
+useful because it allows you to attach to the pseudoterminals before the boot
+process starts.
+
+.. code-block:: bash
+
+    $ qemu-system-arm -machine fby35 \
+        -drive file=fby35.mtd,format=raw,if=mtd \
+        -device loader,file=Y35BCL.elf,addr=0,cpu-num=2 \
+        -serial pty -serial pty -serial mon:stdio \
+        -display none -S
+    $ screen /dev/tty0 # In a separate TMUX pane, terminal window, etc.
+    $ screen /dev/tty1
+    $ (qemu) c		   # Start the boot process once screen is setup.
-- 
2.35.3

Some more controllers have been modeled recently. Reflect that in the
list of supported devices. New machines were also added.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Peter Delevoryas <peter@pjd.dev>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-Id: <20220706172131.809255-1-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 docs/system/arm/aspeed.rst | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -XXX,XX +XXX,XX @@ AST2600 SoC based machines :
 - ``tacoma-bmc``           OpenPOWER Witherspoon POWER9 AST2600 BMC
 - ``rainier-bmc``          IBM Rainier POWER10 BMC
 - ``fuji-bmc``             Facebook Fuji BMC
+- ``bletchley-bmc``        Facebook Bletchley BMC
 - ``fby35-bmc``            Facebook fby35 BMC
+- ``qcom-dc-scm-v1-bmc``   Qualcomm DC-SCM V1 BMC
+- ``qcom-firework-bmc``    Qualcomm Firework BMC
 
 Supported devices
 -----------------
@@ -XXX,XX +XXX,XX @@ Supported devices
  * Interrupt Controller (VIC)
  * Timer Controller
  * RTC Controller
- * I2C Controller
+ * I2C Controller, including the new register interface of the AST2600
  * System Control Unit (SCU)
  * SRAM mapping
  * X-DMA Controller (basic interface)
@@ -XXX,XX +XXX,XX @@ Supported devices
  * LPC Peripheral Controller (a subset of subdevices are supported)
  * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA
  * ADC
+ * Secure Boot Controller (AST2600)
+ * eMMC Boot Controller (dummy)
+ * PECI Controller (minimal)
+ * I3C Controller
 
 
 Missing devices
@@ -XXX,XX +XXX,XX @@ Missing devices
  * Super I/O Controller
  * PCI-Express 1 Controller
  * Graphic Display Controller
- * PECI Controller
  * MCTP Controller
  * Mailbox Controller
  * Virtual UART
  * eSPI Controller
- * I3C Controller
 
 Boot options
 ------------
@@ -XXX,XX +XXX,XX @@ Supported devices
  * LPC Peripheral Controller (a subset of subdevices are supported)
  * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA
  * ADC
+ * Secure Boot Controller
+ * PECI Controller (minimal)
 
 
 Missing devices
@@ -XXX,XX +XXX,XX @@ Missing devices
 
  * PWM and Fan Controller
  * Slave GPIO Controller
- * PECI Controller
  * Mailbox Controller
  * Virtual UART
  * eSPI Controller
-- 
2.35.3

The Aspeed SDK kernel usually includes support for the lastest HW
features. This is interesting to exercise QEMU and discover the gaps
in the models.

Add extra I2C tests for the AST2600 EVB machine to check the new
register interface.

Message-Id: <20220707091239.1029561-1-clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 tests/avocado/machine_aspeed.py | 68 +++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/tests/avocado/machine_aspeed.py b/tests/avocado/machine_aspeed.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/avocado/machine_aspeed.py
+++ b/tests/avocado/machine_aspeed.py
@@ -XXX,XX +XXX,XX @@ def test_arm_ast2600_evb_builroot(self):
         exec_command_and_wait_for_pattern(self, 'hwclock -f /dev/rtc1', year);
 
         self.do_test_arm_aspeed_buidroot_poweroff()
+
+
+    def do_test_arm_aspeed_sdk_start(self, image, cpu_id):
+        self.vm.set_console()
+        self.vm.add_args('-drive', 'file=' + image + ',if=mtd,format=raw',
+                         '-net', 'nic', '-net', 'user')
+        self.vm.launch()
+
+        self.wait_for_console_pattern('U-Boot 2019.04')
+        self.wait_for_console_pattern('## Loading kernel from FIT Image')
+        self.wait_for_console_pattern('Starting kernel ...')
+        self.wait_for_console_pattern('Booting Linux on physical CPU ' + cpu_id)
+
+    def test_arm_ast2500_evb_sdk(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:ast2500-evb
+        """
+
+        image_url = ('https://github.com/AspeedTech-BMC/openbmc/releases/'
+                     'download/v08.01/ast2500-default-obmc.tar.gz')
+        image_hash = ('5375f82b4c43a79427909342a1e18b4e48bd663e38466862145d27bb358796fd')
+        image_path = self.fetch_asset(image_url, asset_hash=image_hash,
+                                      algorithm='sha256')
+        archive.extract(image_path, self.workdir)
+
+        self.do_test_arm_aspeed_sdk_start(
+            self.workdir + '/ast2500-default/image-bmc', '0x0')
+        self.wait_for_console_pattern('ast2500-default login:')
+
+    def test_arm_ast2600_evb_sdk(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:ast2600-evb
+        """
+
+        image_url = ('https://github.com/AspeedTech-BMC/openbmc/releases/'
+                     'download/v08.01/ast2600-default-obmc.tar.gz')
+        image_hash = ('f12ef15e8c1f03a214df3b91c814515c5e2b2f56119021398c1dbdd626817d15')
+        image_path = self.fetch_asset(image_url, asset_hash=image_hash,
+                                      algorithm='sha256')
+        archive.extract(image_path, self.workdir)
+
+        self.vm.add_args('-device',
+                         'tmp105,bus=aspeed.i2c.bus.5,address=0x4d,id=tmp-test');
+        self.vm.add_args('-device',
+                         'ds1338,bus=aspeed.i2c.bus.5,address=0x32');
+        self.do_test_arm_aspeed_sdk_start(
+            self.workdir + '/ast2600-default/image-bmc', '0xf00')
+        self.wait_for_console_pattern('ast2600-default login:')
+        exec_command_and_wait_for_pattern(self, 'root', 'Password:')
+        exec_command_and_wait_for_pattern(self, '0penBmc', 'root@ast2600-default:~#')
+
+        exec_command_and_wait_for_pattern(self,
+             'echo lm75 0x4d > /sys/class/i2c-dev/i2c-5/device/new_device',
+             'i2c i2c-5: new_device: Instantiated device lm75 at 0x4d');
+        exec_command_and_wait_for_pattern(self,
+                             'cat /sys/class/hwmon/hwmon19/temp1_input', '0')
+        self.vm.command('qom-set', path='/machine/peripheral/tmp-test',
+                        property='temperature', value=18000);
+        exec_command_and_wait_for_pattern(self,
+                             'cat /sys/class/hwmon/hwmon19/temp1_input', '18000')
+
+        exec_command_and_wait_for_pattern(self,
+             'echo ds1307 0x32 > /sys/class/i2c-dev/i2c-5/device/new_device',
+             'i2c i2c-5: new_device: Instantiated device ds1307 at 0x32');
+        year = time.strftime("%Y")
+        exec_command_and_wait_for_pattern(self, 'hwclock -f /dev/rtc1', year);
-- 
2.35.3

From: Iris Chen <irischenlj@fb.com>

Signed-off-by: Iris Chen <irischenlj@fb.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-Id: <20220708164552.3462620-1-irischenlj@fb.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/block/m25p80.c | 102 ++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 90 insertions(+), 12 deletions(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@
 #include "trace.h"
 #include "qom/object.h"
 
-/* Fields for FlashPartInfo->flags */
-
-/* erase capabilities */
-#define ER_4K 1
-#define ER_32K 2
-/* set to allow the page program command to write 0s back to 1. Useful for
- * modelling EEPROM with SPI flash command set
- */
-#define EEPROM 0x100
-
 /* 16 MiB max in 3 byte address mode */
 #define MAX_3BYTES_SIZE 0x1000000
-
 #define SPI_NOR_MAX_ID_LEN 6
 
+/* Fields for FlashPartInfo->flags */
+enum spi_flash_option_flags {
+    ER_4K                  = BIT(0),
+    ER_32K                 = BIT(1),
+    EEPROM                 = BIT(2),
+    HAS_SR_TB              = BIT(3),
+    HAS_SR_BP3_BIT6        = BIT(4),
+};
+
 typedef struct FlashPartInfo {
     const char *part_name;
     /*
@@ -XXX,XX +XXX,XX @@ static const FlashPartInfo known_devices[] = {
     { INFO("n25q512a11",  0x20bb20,      0,  64 << 10, 1024, ER_4K) },
     { INFO("n25q512a13",  0x20ba20,      0,  64 << 10, 1024, ER_4K) },
     { INFO("n25q128",     0x20ba18,      0,  64 << 10, 256, 0) },
-    { INFO("n25q256a",    0x20ba19,      0,  64 << 10, 512, ER_4K) },
+    { INFO("n25q256a",    0x20ba19,      0,  64 << 10, 512,
+           ER_4K | HAS_SR_BP3_BIT6 | HAS_SR_TB) },
     { INFO("n25q512a",    0x20ba20,      0,  64 << 10, 1024, ER_4K) },
     { INFO("n25q512ax3",  0x20ba20,  0x1000,  64 << 10, 1024, ER_4K) },
     { INFO("mt25ql512ab", 0x20ba20, 0x1044, 64 << 10, 1024, ER_4K | ER_32K) },
@@ -XXX,XX +XXX,XX @@ struct Flash {
     bool reset_enable;
     bool quad_enable;
     bool aai_enable;
+    bool block_protect0;
+    bool block_protect1;
+    bool block_protect2;
+    bool block_protect3;
+    bool top_bottom_bit;
     bool status_register_write_disabled;
     uint8_t ear;
 
@@ -XXX,XX +XXX,XX @@ void flash_write8(Flash *s, uint32_t addr, uint8_t data)
 {
     uint32_t page = addr / s->pi->page_size;
     uint8_t prev = s->storage[s->cur_addr];
+    uint32_t block_protect_value = (s->block_protect3 << 3) |
+                                   (s->block_protect2 << 2) |
+                                   (s->block_protect1 << 1) |
+                                   (s->block_protect0 << 0);
 
     if (!s->write_enable) {
         qemu_log_mask(LOG_GUEST_ERROR, "M25P80: write with write protect!\n");
         return;
     }
 
+    if (block_protect_value > 0) {
+        uint32_t num_protected_sectors = 1 << (block_protect_value - 1);
+        uint32_t sector = addr / s->pi->sector_size;
+
+        /* top_bottom_bit == 0 means TOP */
+        if (!s->top_bottom_bit) {
+            if (s->pi->n_sectors <= sector + num_protected_sectors) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "M25P80: write with write protect!\n");
+                return;
+            }
+        } else {
+            if (sector < num_protected_sectors) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "M25P80: write with write protect!\n");
+                return;
+            }
+        }
+    }
+
     if ((prev ^ data) & data) {
         trace_m25p80_programming_zero_to_one(s, addr, prev, data);
     }
@@ -XXX,XX +XXX,XX @@ static void complete_collecting_data(Flash *s)
         break;
     case WRSR:
         s->status_register_write_disabled = extract32(s->data[0], 7, 1);
+        s->block_protect0 = extract32(s->data[0], 2, 1);
+        s->block_protect1 = extract32(s->data[0], 3, 1);
+        s->block_protect2 = extract32(s->data[0], 4, 1);
+        if (s->pi->flags & HAS_SR_TB) {
+            s->top_bottom_bit = extract32(s->data[0], 5, 1);
+        }
+        if (s->pi->flags & HAS_SR_BP3_BIT6) {
+            s->block_protect3 = extract32(s->data[0], 6, 1);
+        }
 
         switch (get_man(s)) {
         case MAN_SPANSION:
@@ -XXX,XX +XXX,XX @@ static void decode_new_cmd(Flash *s, uint32_t value)
     case RDSR:
         s->data[0] = (!!s->write_enable) << 1;
         s->data[0] |= (!!s->status_register_write_disabled) << 7;
+        s->data[0] |= (!!s->block_protect0) << 2;
+        s->data[0] |= (!!s->block_protect1) << 3;
+        s->data[0] |= (!!s->block_protect2) << 4;
+        if (s->pi->flags & HAS_SR_TB) {
+            s->data[0] |= (!!s->top_bottom_bit) << 5;
+        }
+        if (s->pi->flags & HAS_SR_BP3_BIT6) {
+            s->data[0] |= (!!s->block_protect3) << 6;
+        }
 
         if (get_man(s) == MAN_MACRONIX || get_man(s) == MAN_ISSI) {
             s->data[0] |= (!!s->quad_enable) << 6;
@@ -XXX,XX +XXX,XX @@ static void m25p80_reset(DeviceState *d)
 
     s->wp_level = true;
     s->status_register_write_disabled = false;
+    s->block_protect0 = false;
+    s->block_protect1 = false;
+    s->block_protect2 = false;
+    s->block_protect3 = false;
+    s->top_bottom_bit = false;
 
     reset_memory(s);
 }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m25p80_write_protect = {
     }
 };
 
+static bool m25p80_block_protect_needed(void *opaque)
+{
+    Flash *s = (Flash *)opaque;
+
+    return s->block_protect0 ||
+           s->block_protect1 ||
+           s->block_protect2 ||
+           s->block_protect3 ||
+           s->top_bottom_bit;
+}
+
+static const VMStateDescription vmstate_m25p80_block_protect = {
+    .name = "m25p80/block_protect",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = m25p80_block_protect_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(block_protect0, Flash),
+        VMSTATE_BOOL(block_protect1, Flash),
+        VMSTATE_BOOL(block_protect2, Flash),
+        VMSTATE_BOOL(block_protect3, Flash),
+        VMSTATE_BOOL(top_bottom_bit, Flash),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_m25p80 = {
     .name = "m25p80",
     .version_id = 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m25p80 = {
         &vmstate_m25p80_data_read_loop,
         &vmstate_m25p80_aai_enable,
         &vmstate_m25p80_write_protect,
+        &vmstate_m25p80_block_protect,
         NULL
     }
 };
-- 
2.35.3

From: Iris Chen <irischenlj@fb.com>

Signed-off-by: Iris Chen <irischenlj@fb.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220627185234.1911337-3-irischenlj@fb.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 tests/qtest/aspeed_smc-test.c | 111 ++++++++++++++++++++++++++++++++++
 1 file changed, 111 insertions(+)

diff --git a/tests/qtest/aspeed_smc-test.c b/tests/qtest/aspeed_smc-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/aspeed_smc-test.c
+++ b/tests/qtest/aspeed_smc-test.c
@@ -XXX,XX +XXX,XX @@ static void read_page_mem(uint32_t addr, uint32_t *page)
     }
 }
 
+static void write_page_mem(uint32_t addr, uint32_t write_value)
+{
+    spi_ctrl_setmode(CTRL_WRITEMODE, PP);
+
+    for (int i = 0; i < FLASH_PAGE_SIZE / 4; i++) {
+        writel(ASPEED_FLASH_BASE + addr + i * 4, write_value);
+    }
+}
+
+static void assert_page_mem(uint32_t addr, uint32_t expected_value)
+{
+    uint32_t page[FLASH_PAGE_SIZE / 4];
+    read_page_mem(addr, page);
+    for (int i = 0; i < FLASH_PAGE_SIZE / 4; i++) {
+        g_assert_cmphex(page[i], ==, expected_value);
+    }
+}
+
 static void test_erase_sector(void)
 {
     uint32_t some_page_addr = 0x600 * FLASH_PAGE_SIZE;
@@ -XXX,XX +XXX,XX @@ static void test_status_reg_write_protection(void)
     flash_reset();
 }
 
+static void test_write_block_protect(void)
+{
+    uint32_t sector_size = 65536;
+    uint32_t n_sectors = 512;
+
+    spi_ce_ctrl(1 << CRTL_EXTENDED0);
+    spi_conf(CONF_ENABLE_W0);
+
+    uint32_t bp_bits = 0b0;
+
+    for (int i = 0; i < 16; i++) {
+        bp_bits = ((i & 0b1000) << 3) | ((i & 0b0111) << 2);
+
+        spi_ctrl_start_user();
+        writeb(ASPEED_FLASH_BASE, WREN);
+        writeb(ASPEED_FLASH_BASE, BULK_ERASE);
+        writeb(ASPEED_FLASH_BASE, WREN);
+        writeb(ASPEED_FLASH_BASE, WRSR);
+        writeb(ASPEED_FLASH_BASE, bp_bits);
+        writeb(ASPEED_FLASH_BASE, EN_4BYTE_ADDR);
+        writeb(ASPEED_FLASH_BASE, WREN);
+        spi_ctrl_stop_user();
+
+        uint32_t num_protected_sectors = i ? MIN(1 << (i - 1), n_sectors) : 0;
+        uint32_t protection_start = n_sectors - num_protected_sectors;
+        uint32_t protection_end = n_sectors;
+
+        for (int sector = 0; sector < n_sectors; sector++) {
+            uint32_t addr = sector * sector_size;
+
+            assert_page_mem(addr, 0xffffffff);
+            write_page_mem(addr, make_be32(0xabcdef12));
+
+            uint32_t expected_value = protection_start <= sector
+                                      && sector < protection_end
+                                      ? 0xffffffff : 0xabcdef12;
+
+            assert_page_mem(addr, expected_value);
+        }
+    }
+
+    flash_reset();
+}
+
+static void test_write_block_protect_bottom_bit(void)
+{
+    uint32_t sector_size = 65536;
+    uint32_t n_sectors = 512;
+
+    spi_ce_ctrl(1 << CRTL_EXTENDED0);
+    spi_conf(CONF_ENABLE_W0);
+
+    /* top bottom bit is enabled */
+    uint32_t bp_bits = 0b00100 << 3;
+
+    for (int i = 0; i < 16; i++) {
+        bp_bits = (((i & 0b1000) | 0b0100) << 3) | ((i & 0b0111) << 2);
+
+        spi_ctrl_start_user();
+        writeb(ASPEED_FLASH_BASE, WREN);
+        writeb(ASPEED_FLASH_BASE, BULK_ERASE);
+        writeb(ASPEED_FLASH_BASE, WREN);
+        writeb(ASPEED_FLASH_BASE, WRSR);
+        writeb(ASPEED_FLASH_BASE, bp_bits);
+        writeb(ASPEED_FLASH_BASE, EN_4BYTE_ADDR);
+        writeb(ASPEED_FLASH_BASE, WREN);
+        spi_ctrl_stop_user();
+
+        uint32_t num_protected_sectors = i ? MIN(1 << (i - 1), n_sectors) : 0;
+        uint32_t protection_start = 0;
+        uint32_t protection_end = num_protected_sectors;
+
+        for (int sector = 0; sector < n_sectors; sector++) {
+            uint32_t addr = sector * sector_size;
+
+            assert_page_mem(addr, 0xffffffff);
+            write_page_mem(addr, make_be32(0xabcdef12));
+
+            uint32_t expected_value = protection_start <= sector
+                                      && sector < protection_end
+                                      ? 0xffffffff : 0xabcdef12;
+
+            assert_page_mem(addr, expected_value);
+        }
+    }
+
+    flash_reset();
+}
+
 static char tmp_path[] = "/tmp/qtest.m25p80.XXXXXX";
 
 int main(int argc, char **argv)
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     qtest_add_func("/ast2400/smc/read_status_reg", test_read_status_reg);
     qtest_add_func("/ast2400/smc/status_reg_write_protection",
                    test_status_reg_write_protection);
+    qtest_add_func("/ast2400/smc/write_block_protect",
+                   test_write_block_protect);
+    qtest_add_func("/ast2400/smc/write_block_protect_bottom_bit",
+                   test_write_block_protect_bottom_bit);
 
     flash_reset();
     ret = g_test_run();
-- 
2.35.3

From: Peter Delevoryas <peter@pjd.dev>

Verify the current behavior, which is that input pins can be modified by
guest OS register writes.

Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220712023219.41065-2-peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 tests/qtest/aspeed_gpio-test.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/tests/qtest/aspeed_gpio-test.c b/tests/qtest/aspeed_gpio-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/aspeed_gpio-test.c
+++ b/tests/qtest/aspeed_gpio-test.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/qmp/qdict.h"
 #include "libqtest-single.h"
 
+#define AST2600_GPIO_BASE 0x1E780000
+
+#define GPIO_ABCD_DATA_VALUE 0x000
+#define GPIO_ABCD_DIRECTION  0x004
+
 static void test_set_colocated_pins(const void *data)
 {
     QTestState *s = (QTestState *)data;
@@ -XXX,XX +XXX,XX @@ static void test_set_colocated_pins(const void *data)
     g_assert(!qtest_qom_get_bool(s, "/machine/soc/gpio", "gpioV7"));
 }
 
+static void test_set_input_pins(const void *data)
+{
+    QTestState *s = (QTestState *)data;
+    char name[16];
+    uint32_t value;
+
+    qtest_writel(s, AST2600_GPIO_BASE + GPIO_ABCD_DIRECTION, 0x00000000);
+    for (char c = 'A'; c <= 'D'; c++) {
+        for (int i = 0; i < 8; i++) {
+            sprintf(name, "gpio%c%d", c, i);
+            qtest_qom_set_bool(s, "/machine/soc/gpio", name, true);
+        }
+    }
+    value = qtest_readl(s, AST2600_GPIO_BASE + GPIO_ABCD_DATA_VALUE);
+    g_assert_cmphex(value, ==, 0xffffffff);
+
+    qtest_writel(s, AST2600_GPIO_BASE + GPIO_ABCD_DATA_VALUE, 0x00000000);
+    value = qtest_readl(s, AST2600_GPIO_BASE + GPIO_ABCD_DATA_VALUE);
+    g_assert_cmphex(value, ==, 0x00000000);
+}
+
 int main(int argc, char **argv)
 {
     QTestState *s;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     s = qtest_init("-machine ast2600-evb");
     qtest_add_data_func("/ast2600/gpio/set_colocated_pins", s,
                         test_set_colocated_pins);
+    qtest_add_data_func("/ast2600/gpio/set_input_pins", s, test_set_input_pins);
     r = g_test_run();
     qtest_quit(s);
 
-- 
2.35.3

From: Peter Delevoryas <peter@pjd.dev>

Up until now, guests could modify input pins by overwriting the data
value register. The guest OS should only be allowed to modify output pin
values, and the QOM property setter should only be permitted to modify
input pins.

This change also updates the gpio input pin test to match this
expectation.

Andrew suggested this particularly refactoring here:

https://lore.kernel.org/qemu-devel/23523aa1-ba81-412b-92cc-8174faba3612@www.fastmail.com/

Suggested-by: Andrew Jeffery <andrew@aj.id.au>
Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Fixes: 4b7f956862dc ("hw/gpio: Add basic Aspeed GPIO model for AST2400 and AST2500")
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220712023219.41065-3-peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/gpio/aspeed_gpio.c          | 15 ++++++++-------
 tests/qtest/aspeed_gpio-test.c |  2 +-
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/aspeed_gpio.c
+++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@ static ptrdiff_t aspeed_gpio_set_idx(AspeedGPIOState *s, GPIOSets *regs)
 }
 
 static void aspeed_gpio_update(AspeedGPIOState *s, GPIOSets *regs,
-                               uint32_t value)
+                               uint32_t value, uint32_t mode_mask)
 {
     uint32_t input_mask = regs->input_mask;
     uint32_t direction = regs->direction;
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_update(AspeedGPIOState *s, GPIOSets *regs,
     uint32_t diff;
     int gpio;
 
-    diff = old ^ new;
+    diff = (old ^ new);
+    diff &= mode_mask;
     if (diff) {
         for (gpio = 0; gpio < ASPEED_GPIOS_PER_SET; gpio++) {
             uint32_t mask = 1 << gpio;
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_set_pin_level(AspeedGPIOState *s, uint32_t set_idx,
         value &= ~pin_mask;
     }
 
-    aspeed_gpio_update(s, &s->sets[set_idx], value);
+    aspeed_gpio_update(s, &s->sets[set_idx], value, ~s->sets[set_idx].direction);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_write_index_mode(void *opaque, hwaddr offset,
         reg_value = update_value_control_source(set, set->data_value,
                                                 reg_value);
         set->data_read = reg_value;
-        aspeed_gpio_update(s, set, reg_value);
+        aspeed_gpio_update(s, set, reg_value, set->direction);
         return;
     case gpio_reg_idx_direction:
         reg_value = set->direction;
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_write_index_mode(void *opaque, hwaddr offset,
             __func__, offset, data, reg_idx_type);
         return;
     }
-    aspeed_gpio_update(s, set, set->data_value);
+    aspeed_gpio_update(s, set, set->data_value, UINT32_MAX);
     return;
 }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_write(void *opaque, hwaddr offset, uint64_t data,
         data &= props->output;
         data = update_value_control_source(set, set->data_value, data);
         set->data_read = data;
-        aspeed_gpio_update(s, set, data);
+        aspeed_gpio_update(s, set, data, set->direction);
         return;
     case gpio_reg_direction:
         /*
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_write(void *opaque, hwaddr offset, uint64_t data,
                       PRIx64"\n", __func__, offset);
         return;
     }
-    aspeed_gpio_update(s, set, set->data_value);
+    aspeed_gpio_update(s, set, set->data_value, UINT32_MAX);
     return;
 }
 
diff --git a/tests/qtest/aspeed_gpio-test.c b/tests/qtest/aspeed_gpio-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/aspeed_gpio-test.c
+++ b/tests/qtest/aspeed_gpio-test.c
@@ -XXX,XX +XXX,XX @@ static void test_set_input_pins(const void *data)
 
     qtest_writel(s, AST2600_GPIO_BASE + GPIO_ABCD_DATA_VALUE, 0x00000000);
     value = qtest_readl(s, AST2600_GPIO_BASE + GPIO_ABCD_DATA_VALUE);
-    g_assert_cmphex(value, ==, 0x00000000);
+    g_assert_cmphex(value, ==, 0xffffffff);
 }
 
 int main(int argc, char **argv)
-- 
2.35.3

From: Peter Delevoryas <peter@pjd.dev>

Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-Id: <20220712023219.41065-4-peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void fby35_reset(MachineState *state)
 
     qemu_devices_reset();
 
-    /* Board ID */
+    /* Board ID: 7 (Class-1, 4 slots) */
     object_property_set_bool(OBJECT(gpio), "gpioV4", true, &error_fatal);
     object_property_set_bool(OBJECT(gpio), "gpioV5", true, &error_fatal);
     object_property_set_bool(OBJECT(gpio), "gpioV6", true, &error_fatal);
     object_property_set_bool(OBJECT(gpio), "gpioV7", false, &error_fatal);
+
+    /* Slot presence pins, inverse polarity. (False means present) */
+    object_property_set_bool(OBJECT(gpio), "gpioH4", false, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioH5", true, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioH6", true, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioH7", true, &error_fatal);
+
+    /* Slot 12v power pins, normal polarity. (True means powered-on) */
+    object_property_set_bool(OBJECT(gpio), "gpioB2", true, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioB3", false, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioB4", false, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioB5", false, &error_fatal);
 }
 
 static void aspeed_machine_fby35_class_init(ObjectClass *oc, void *data)
-- 
2.35.3