Series comparison

-[PULL 00/11] aspeed queue
+[PULL 0/3] aspeed queue
-The following changes since commit a2b5f8b8ab7b2c947823088103a40f0ff11fe06b:
+The following changes since commit 527dede083d3e3e5a13ee996776926e0a0c4e258:
-  Merge tag 'pull-tcg-20230301' of https://gitlab.com/rth7680/qemu into staging (2023-03-01 19:19:20 +0000)
+  Merge tag 'pull-request-2025-03-19' of https://gitlab.com/thuth/qemu into staging (2025-03-20 08:41:25 -0400)
 are available in the Git repository at:
-  https://github.com/legoater/qemu/ tags/pull-aspeed-20230302
+  https://github.com/legoater/qemu/ tags/pull-aspeed-20250323
-for you to fetch changes up to b22a2d409b1acfdf0d63d1bb3595194ceb3d94da:
+for you to fetch changes up to 78877b2e06464f49f777e086845e094ea7bc82ef:
-  aspeed/smc: Replace SysBus IRQs with GPIO lines (2023-03-02 13:57:50 +0100)
+  hw/misc/aspeed_hace: Fix buffer overflow in has_padding function (2025-03-23 18:42:16 +0100)
 ----------------------------------------------------------------
 aspeed queue:
-* fix for the Aspeed I2C slave mode
+* Fix AST2700 SoC model
 * a new I2C echo device from Klaus and its associated test in avocado.
 * initial SoC cleanups to allow the use of block devices instead of
   drives on the command line.
 * new facebook machines and eeprom fixes for the Fuji
 * readline fix
 ----------------------------------------------------------------
-Cédric Le Goater (4):
+Jamin Lin (1):
-      tests/avocado/machine_aspeed.py: Add an I2C slave test
+      hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
       aspeed: Introduce a spi_boot region under the SoC
       aspeed: Add a boot_rom overlap region in the SoC spi_boot container
       aspeed/smc: Replace SysBus IRQs with GPIO lines
-Dongli Zhang (1):
+Steven Lee (1):
-      readline: fix hmp completion issue
+      hw/intc/aspeed: Fix IRQ handler mask check
-Karthikeyan Pasupathi (2):
+Troy Lee (1):
-      hw/arm/aspeed: Adding new machine Yosemitev2 in QEMU
+      aspeed: Fix maximum number of spi controller
       hw/arm/aspeed: Adding new machine Tiogapass in QEMU
-Klaus Jensen (2):
+ include/hw/arm/aspeed_soc.h | 2 +-
-      hw/i2c: only schedule pending master when bus is idle
+ hw/intc/aspeed_intc.c       | 2 +-
-      hw/misc: add a toy i2c echo device
+ hw/misc/aspeed_hace.c       | 5 +++++
+files changed, 7 insertions(+), 2 deletions(-)
 Sittisak Sinprem (2):
       hw/at24c : modify at24c to support 1 byte address mode
       aspeed/fuji : correct the eeprom size
  docs/system/arm/aspeed.rst      |   2 +
  hw/arm/aspeed_eeprom.h          |   6 ++
  include/hw/arm/aspeed_soc.h     |   5 ++
  include/hw/i2c/i2c.h            |   2 +
  hw/arm/aspeed.c                 | 159 ++++++++++++++++++++++++++++------------
  hw/arm/aspeed_ast2600.c         |  13 ++++
  hw/arm/aspeed_eeprom.c          |  45 ++++++++++++
  hw/arm/aspeed_soc.c             |  14 ++++
  hw/arm/fby35.c                  |   8 +-
  hw/i2c/aspeed_i2c.c             |   2 +
  hw/i2c/core.c                   |  37 ++++++----
  hw/misc/i2c-echo.c              | 156 +++++++++++++++++++++++++++++++++++++++
  hw/nvram/eeprom_at24c.c         |  30 +++++++-
  hw/ssi/aspeed_smc.c             |   5 +-
  monitor/hmp.c                   |   8 +-
  hw/misc/meson.build             |   2 +
  tests/avocado/machine_aspeed.py |  10 +++
 files changed, 421 insertions(+), 83 deletions(-)
  create mode 100644 hw/misc/i2c-echo.c

-[PULL 01/11] readline: fix hmp completion issue
+Deleted patch
-From: Dongli Zhang <dongli.zhang@oracle.com>
-The auto completion does not work in some cases.
-Case 1.
-. (qemu) info reg
-. Press 'Tab'.
-. It does not auto complete.
-Case 2.
-. (qemu) block_resize flo
-. Press 'Tab'.
-. It does not auto complete 'floppy0'.
-Since the readline_add_completion_of() may add any completion when
-strlen(pfx) is zero, we remove the check with (name[0] == '\0') because
-strlen() always returns zero in that case.
-Fixes: 52f50b1e9f8f ("readline: Extract readline_add_completion_of() from monitor")
-Cc: Joe Jin <joe.jin@oracle.com>
-Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
-Tested-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- monitor/hmp.c | 8 ++------
-file changed, 2 insertions(+), 6 deletions(-)
-diff --git a/monitor/hmp.c b/monitor/hmp.c
-index XXXXXXX..XXXXXXX 100644
---- a/monitor/hmp.c
-+++ b/monitor/hmp.c
-@@ -XXX,XX +XXX,XX @@ static void cmd_completion(MonitorHMP *mon, const char *name, const char *list)
-         }
-         memcpy(cmd, pstart, len);
-         cmd[len] = '\0';
--        if (name[0] == '\0') {
--            readline_add_completion_of(mon->rs, name, cmd);
--        }
-+        readline_add_completion_of(mon->rs, name, cmd);
-         if (*p == '\0') {
-             break;
-         }
-@@ -XXX,XX +XXX,XX @@ static void monitor_find_completion_by_table(MonitorHMP *mon,
-             /* block device name completion */
-             readline_set_completion_index(mon->rs, strlen(str));
-             while ((blk = blk_next(blk)) != NULL) {
--                if (str[0] == '\0') {
--                    readline_add_completion_of(mon->rs, str, blk_name(blk));
--                }
-+                readline_add_completion_of(mon->rs, str, blk_name(blk));
-             }
-             break;
-         case 's':
---
-.39.2

-[PULL 02/11] hw/i2c: only schedule pending master when bus is idle
+Deleted patch
-From: Klaus Jensen <k.jensen@samsung.com>
-It is not given that the current master will release the bus after a
-transfer ends. Only schedule a pending master if the bus is idle.
-Fixes: 37fa5ca42623 ("hw/i2c: support multiple masters")
-Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
-Acked-by: Corey Minyard <cminyard@mvista.com>
-Message-Id: <20221116084312.35808-2-its@irrelevant.dk>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- include/hw/i2c/i2c.h |  2 ++
- hw/i2c/aspeed_i2c.c  |  2 ++
- hw/i2c/core.c        | 37 ++++++++++++++++++++++---------------
-files changed, 26 insertions(+), 15 deletions(-)
-diff --git a/include/hw/i2c/i2c.h b/include/hw/i2c/i2c.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i2c/i2c.h
-+++ b/include/hw/i2c/i2c.h
-@@ -XXX,XX +XXX,XX @@ int i2c_start_send(I2CBus *bus, uint8_t address);
-  */
- int i2c_start_send_async(I2CBus *bus, uint8_t address);
-+void i2c_schedule_pending_master(I2CBus *bus);
-+
- void i2c_end_transfer(I2CBus *bus);
- void i2c_nack(I2CBus *bus);
- void i2c_ack(I2CBus *bus);
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
-+++ b/hw/i2c/aspeed_i2c.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
-         }
-         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_STOP_CMD, 0);
-         aspeed_i2c_set_state(bus, I2CD_IDLE);
-+
-+        i2c_schedule_pending_master(bus->bus);
-     }
-     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
-diff --git a/hw/i2c/core.c b/hw/i2c/core.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/core.c
-+++ b/hw/i2c/core.c
-@@ -XXX,XX +XXX,XX @@ int i2c_start_transfer(I2CBus *bus, uint8_t address, bool is_recv)
- void i2c_bus_master(I2CBus *bus, QEMUBH *bh)
- {
--    if (i2c_bus_busy(bus)) {
--        I2CPendingMaster *node = g_new(struct I2CPendingMaster, 1);
--        node->bh = bh;
-+    I2CPendingMaster *node = g_new(struct I2CPendingMaster, 1);
-+    node->bh = bh;
-+
-+    QSIMPLEQ_INSERT_TAIL(&bus->pending_masters, node, entry);
-+}
-+
-+void i2c_schedule_pending_master(I2CBus *bus)
-+{
-+    I2CPendingMaster *node;
--        QSIMPLEQ_INSERT_TAIL(&bus->pending_masters, node, entry);
-+    if (i2c_bus_busy(bus)) {
-+        /* someone is already controlling the bus; wait for it to release it */
-+        return;
-+    }
-+    if (QSIMPLEQ_EMPTY(&bus->pending_masters)) {
-         return;
-     }
--    bus->bh = bh;
-+    node = QSIMPLEQ_FIRST(&bus->pending_masters);
-+    bus->bh = node->bh;
-+
-+    QSIMPLEQ_REMOVE_HEAD(&bus->pending_masters, entry);
-+    g_free(node);
-+
-     qemu_bh_schedule(bus->bh);
- }
- void i2c_bus_release(I2CBus *bus)
- {
-     bus->bh = NULL;
-+
-+    i2c_schedule_pending_master(bus);
- }
- int i2c_start_recv(I2CBus *bus, uint8_t address)
-@@ -XXX,XX +XXX,XX @@ void i2c_end_transfer(I2CBus *bus)
-         g_free(node);
-     }
-     bus->broadcast = false;
--
--    if (!QSIMPLEQ_EMPTY(&bus->pending_masters)) {
--        I2CPendingMaster *node = QSIMPLEQ_FIRST(&bus->pending_masters);
--        bus->bh = node->bh;
--
--        QSIMPLEQ_REMOVE_HEAD(&bus->pending_masters, entry);
--        g_free(node);
--
--        qemu_bh_schedule(bus->bh);
--    }
- }
- int i2c_send(I2CBus *bus, uint8_t data)
---
-.39.2

-[PULL 09/11] aspeed: Introduce a spi_boot region under the SoC
+[PULL 1/3] aspeed: Fix maximum number of spi controller
-The default boot address of the Aspeed SoCs is 0x0. For this reason,
+From: Troy Lee <troy_lee@aspeedtech.com>
 the FMC flash device contents are remapped by HW on the first 256MB of
 the address space. In QEMU, this is currently done in the machine init
 with the setup of a region alias.
-Move this code to the SoC and introduce an extra container to prepare
+Commit 6de4aa8dc544 ("hw/arm/aspeed_ast27x0: Add SoC Support for AST2700
-ground for the boot ROM region which will overlap the FMC flash
+A1") extends ast2700a1 spis_num to 3, but ASPEED_SPIS_NUM defines the
-remapping.
+maximum number of spi controller to 2, result in ehci[0] is being
 overwritten in runtime.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Troy Lee <troy_lee@aspeedtech.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Fixes: 6de4aa8dc544 ("hw/arm/aspeed_ast27x0: Add SoC Support for AST2700 A1")
 Reviewed-by: Cédric Le Goater <clg@redhat.com>
 Link: https://lore.kernel.org/qemu-devel/20250317065938.1902272-1-troy_lee@aspeedtech.com
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- include/hw/arm/aspeed_soc.h |  5 +++++
+ include/hw/arm/aspeed_soc.h | 2 +-
- hw/arm/aspeed.c             | 13 +------------
+file changed, 1 insertion(+), 1 deletion(-)
  hw/arm/aspeed_ast2600.c     | 13 +++++++++++++
  hw/arm/aspeed_soc.c         | 14 ++++++++++++++
  hw/arm/fby35.c              |  8 +-------
 files changed, 34 insertions(+), 19 deletions(-)
 diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/aspeed_soc.h
 +++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
-     MemoryRegion *dram_mr;
-     MemoryRegion dram_container;
-     MemoryRegion sram;
-+    MemoryRegion spi_boot_container;
-+    MemoryRegion spi_boot;
-     AspeedVICState vic;
-     AspeedRtcState rtc;
-     AspeedTimerCtrlState timerctrl;
-@@ -XXX,XX +XXX,XX @@ struct AspeedSoCClass {
- enum {
-+    ASPEED_DEV_SPI_BOOT,
-     ASPEED_DEV_IOMEM,
-     ASPEED_DEV_UART1,
-     ASPEED_DEV_UART2,
-@@ -XXX,XX +XXX,XX @@ enum {
-     ASPEED_DEV_JTAG1,
- };
-+#define ASPEED_SOC_SPI_BOOT_ADDR 0x0
-+
- qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
- bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp);
- void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr);
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-         MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
-         uint64_t size = memory_region_size(&fl->mmio);
--        /*
--         * create a ROM region using the default mapping window size of
--         * the flash module. The window size is 64MB for the AST2400
--         * SoC and 128MB for the AST2500 SoC, which is twice as big as
--         * needed by the flash modules of the Aspeed machines.
--         */
--        if (ASPEED_MACHINE(machine)->mmio_exec) {
--            memory_region_init_alias(boot_rom, NULL, "aspeed.boot_rom",
--                                     &fl->mmio, 0, size);
--            memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
--                                        boot_rom);
--        } else {
-+        if (!ASPEED_MACHINE(machine)->mmio_exec) {
-             memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
-                                    size, &error_abort);
-             memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
-diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast2600.c
-+++ b/hw/arm/aspeed_ast2600.c
 @@ -XXX,XX +XXX,XX @@
- #define ASPEED_SOC_DPMCU_SIZE       0x00040000
+ #include "hw/char/serial-mm.h"
+ #include "hw/intc/arm_gicv3.h"
- static const hwaddr aspeed_soc_ast2600_memmap[] = {
-+    [ASPEED_DEV_SPI_BOOT]  = ASPEED_SOC_SPI_BOOT_ADDR,
+-#define ASPEED_SPIS_NUM  2
-     [ASPEED_DEV_SRAM]      = 0x10000000,
++#define ASPEED_SPIS_NUM  3
-     [ASPEED_DEV_DPMCU]     = 0x18000000,
+ #define ASPEED_EHCIS_NUM 2
-     /* 0x16000000     0x17FFFFFF : AHB BUS do LPC Bus bridge */
+ #define ASPEED_WDTS_NUM  8
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
+ #define ASPEED_CPUS_NUM  4
      qemu_irq irq;
      g_autofree char *sram_name = NULL;
 +    /* Default boot region (SPI memory or ROMs) */
 +    memory_region_init(&s->spi_boot_container, OBJECT(s),
 +                       "aspeed.spi_boot_container", 0x10000000);
 +    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SPI_BOOT],
 +                                &s->spi_boot_container);
 +
      /* IO space */
      aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
                                    sc->memmap[ASPEED_DEV_IOMEM],
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                         aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
 +    /* Set up an alias on the FMC CE0 region (boot default) */
 +    MemoryRegion *fmc0_mmio = &s->fmc.flashes[0].mmio;
 +    memory_region_init_alias(&s->spi_boot, OBJECT(s), "aspeed.spi_boot",
 +                             fmc0_mmio, 0, memory_region_size(fmc0_mmio));
 +    memory_region_add_subregion(&s->spi_boot_container, 0x0, &s->spi_boot);
 +
      /* SPI */
      for (i = 0; i < sc->spis_num; i++) {
          object_property_set_link(OBJECT(&s->spi[i]), "dram",
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@
  #define ASPEED_SOC_IOMEM_SIZE       0x00200000
  static const hwaddr aspeed_soc_ast2400_memmap[] = {
 +    [ASPEED_DEV_SPI_BOOT]  =  ASPEED_SOC_SPI_BOOT_ADDR,
      [ASPEED_DEV_IOMEM]  = 0x1E600000,
      [ASPEED_DEV_FMC]    = 0x1E620000,
      [ASPEED_DEV_SPI1]   = 0x1E630000,
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2400_memmap[] = {
  };
  static const hwaddr aspeed_soc_ast2500_memmap[] = {
 +    [ASPEED_DEV_SPI_BOOT]  = ASPEED_SOC_SPI_BOOT_ADDR,
      [ASPEED_DEV_IOMEM]  = 0x1E600000,
      [ASPEED_DEV_FMC]    = 0x1E620000,
      [ASPEED_DEV_SPI1]   = 0x1E630000,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      Error *err = NULL;
      g_autofree char *sram_name = NULL;
 +    /* Default boot region (SPI memory or ROMs) */
 +    memory_region_init(&s->spi_boot_container, OBJECT(s),
 +                       "aspeed.spi_boot_container", 0x10000000);
 +    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SPI_BOOT],
 +                                &s->spi_boot_container);
 +
      /* IO space */
      aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
                                    sc->memmap[ASPEED_DEV_IOMEM],
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                         aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
 +    /* Set up an alias on the FMC CE0 region (boot default) */
 +    MemoryRegion *fmc0_mmio = &s->fmc.flashes[0].mmio;
 +    memory_region_init_alias(&s->spi_boot, OBJECT(s), "aspeed.spi_boot",
 +                             fmc0_mmio, 0, memory_region_size(fmc0_mmio));
 +    memory_region_add_subregion(&s->spi_boot_container, 0x0, &s->spi_boot);
 +
      /* SPI */
      for (i = 0; i < sc->spis_num; i++) {
          if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
 diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fby35.c
 +++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
          MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
          uint64_t size = memory_region_size(&fl->mmio);
 -        if (s->mmio_exec) {
 -            memory_region_init_alias(boot_rom, NULL, "aspeed.boot_rom",
 -                                     &fl->mmio, 0, size);
 -            memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
 -                                        boot_rom);
 -        } else {
 -
 +        if (!s->mmio_exec) {
              memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
                                     size, &error_abort);
              memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
 --
-.39.2
+.49.0

-[PULL 11/11] aspeed/smc: Replace SysBus IRQs with GPIO lines
+[PULL 2/3] hw/intc/aspeed: Fix IRQ handler mask check
-It's cleaner and removes the curious '+ 1' required to skip the DMA
+From: Steven Lee <steven_lee@aspeedtech.com>
 IRQ line of the controller.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Updated the IRQ handler mask check to AND with select variable.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+This ensures that the interrupt service routine is correctly triggered
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+for the interrupts within the same irq group.
 For example, both `eth0` and the debug UART are handled in `GICINT132`.
 Without this fix, the debug console may hang if the `eth0` ISR is not
 handled.
 Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
 Change-Id: Ic3609eb72218dfd68be6057d78b8953b18828709
 Reviewed-by: Cédric Le Goater <clg@redhat.com>
 Fixes: d831c5fd8682 ("aspeed/intc: Add AST2700 support")
 Link: https://lore.kernel.org/qemu-devel/20250320092543.4040672-2-steven_lee@aspeedtech.com
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- hw/arm/aspeed.c     | 2 +-
+ hw/intc/aspeed_intc.c | 2 +-
- hw/ssi/aspeed_smc.c | 5 +----
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 2 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/hw/intc/aspeed_intc.c
-+++ b/hw/arm/aspeed.c
++++ b/hw/intc/aspeed_intc.c
-@@ -XXX,XX +XXX,XX @@ void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
+@@ -XXX,XX +XXX,XX @@ static void aspeed_intc_set_irq_handler(AspeedINTCState *s,
-         qdev_realize_and_unref(dev, BUS(s->spi), &error_fatal);
+     outpin_idx = intc_irq->outpin_idx;
+     inpin_idx = intc_irq->inpin_idx;
-         cs_line = qdev_get_gpio_in_named(dev, SSI_GPIO_CS, 0);
--        sysbus_connect_irq(SYS_BUS_DEVICE(s), i + 1, cs_line);
+-    if (s->mask[inpin_idx] || s->regs[status_reg]) {
-+        qdev_connect_gpio_out_named(DEVICE(s), "cs", i, cs_line);
++    if ((s->mask[inpin_idx] & select) || (s->regs[status_reg] & select)) {
-     }
+         /*
- }
+          * a. mask is not 0 means in ISR mode
+          * sources interrupt routine are executing.
 diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/aspeed_smc.c
 +++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
      /* Setup cs_lines for peripherals */
      s->cs_lines = g_new0(qemu_irq, asc->cs_num_max);
 -
 -    for (i = 0; i < asc->cs_num_max; ++i) {
 -        sysbus_init_irq(sbd, &s->cs_lines[i]);
 -    }
 +    qdev_init_gpio_out_named(DEVICE(s), s->cs_lines, "cs", asc->cs_num_max);
      /* The memory region for the controller registers */
      memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
 --
-.39.2
+.49.0

-[PULL 03/11] hw/misc: add a toy i2c echo device
+[PULL 3/3] hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
-From: Klaus Jensen <k.jensen@samsung.com>
+From: Jamin Lin <jamin_lin@aspeedtech.com>
-Add an example I2C device to demonstrate how a slave may master the bus
+The maximum padding size is either 64 or 128 bytes and should always be smaller
-and send data asynchronously to another slave.
+than "req_len". If "padding_size" exceeds "req_len", then
 "req_len - padding_size" underflows due to "uint32_t" data type, leading to a
 large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory
 access, potentially leading to a buffer overflow.
-The device will echo whatever it is sent to the device identified by the
+Added a check to ensure "padding_size" does not exceed "req_len" before
-first byte received.
+computing "pad_offset". This prevents "req_len - padding_size" from underflowing
 and avoids accessing invalid memory.
-Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
+Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
-[ clg: integrated fixes :
+Reviewed-by: Cédric Le Goater <clg@redhat.com>
-  https://lore.kernel.org/qemu-devel/Y3yMKAhOkYGtnkOp@cormorant.local/ ]
+Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600 HACE ")
-Message-Id: <20220601210831.67259-7-its@irrelevant.dk>
+Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- hw/misc/i2c-echo.c  | 156 ++++++++++++++++++++++++++++++++++++++++++++
+ hw/misc/aspeed_hace.c | 5 +++++
- hw/misc/meson.build |   2 +
+file changed, 5 insertions(+)
 files changed, 158 insertions(+)
  create mode 100644 hw/misc/i2c-echo.c
-diff --git a/hw/misc/i2c-echo.c b/hw/misc/i2c-echo.c
+diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/hw/misc/aspeed_hace.c
---- /dev/null
++++ b/hw/misc/aspeed_hace.c
-+++ b/hw/misc/i2c-echo.c
+@@ -XXX,XX +XXX,XX @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
-@@ -XXX,XX +XXX,XX @@
+     if (*total_msg_len <= s->total_req_len) {
-+#include "qemu/osdep.h"
+         uint32_t padding_size = s->total_req_len - *total_msg_len;
-+#include "qemu/timer.h"
+         uint8_t *padding = iov->iov_base;
 +#include "qemu/main-loop.h"
 +#include "block/aio.h"
 +#include "hw/i2c/i2c.h"
 +
-+#define TYPE_I2C_ECHO "i2c-echo"
++        if (padding_size > req_len) {
-+OBJECT_DECLARE_SIMPLE_TYPE(I2CEchoState, I2C_ECHO)
++            return false;
 +
 +enum i2c_echo_state {
 +    I2C_ECHO_STATE_IDLE,
 +    I2C_ECHO_STATE_START_SEND,
 +    I2C_ECHO_STATE_ACK,
 +};
 +
 +typedef struct I2CEchoState {
 +    I2CSlave parent_obj;
 +
 +    I2CBus *bus;
 +
 +    enum i2c_echo_state state;
 +    QEMUBH *bh;
 +
 +    unsigned int pos;
 +    uint8_t data[3];
 +} I2CEchoState;
 +
 +static void i2c_echo_bh(void *opaque)
 +{
 +    I2CEchoState *state = opaque;
 +
 +    switch (state->state) {
 +    case I2C_ECHO_STATE_IDLE:
 +        return;
 +
 +    case I2C_ECHO_STATE_START_SEND:
 +        if (i2c_start_send_async(state->bus, state->data[0])) {
 +            goto release_bus;
 +        }
 +
-+        state->pos++;
+         *pad_offset = req_len - padding_size;
-+        state->state = I2C_ECHO_STATE_ACK;
+         if (padding[*pad_offset] == 0x80) {
-+        return;
+             return true;
 +
 +    case I2C_ECHO_STATE_ACK:
 +        if (state->pos > 2) {
 +            break;
 +        }
 +
 +        if (i2c_send_async(state->bus, state->data[state->pos++])) {
 +            break;
 +        }
 +
 +        return;
 +    }
 +
 +
 +    i2c_end_transfer(state->bus);
 +release_bus:
 +    i2c_bus_release(state->bus);
 +
 +    state->state = I2C_ECHO_STATE_IDLE;
 +}
 +
 +static int i2c_echo_event(I2CSlave *s, enum i2c_event event)
 +{
 +    I2CEchoState *state = I2C_ECHO(s);
 +
 +    switch (event) {
 +    case I2C_START_RECV:
 +        state->pos = 0;
 +
 +        break;
 +
 +    case I2C_START_SEND:
 +        state->pos = 0;
 +
 +        break;
 +
 +    case I2C_FINISH:
 +        state->pos = 0;
 +        state->state = I2C_ECHO_STATE_START_SEND;
 +        i2c_bus_master(state->bus, state->bh);
 +
 +        break;
 +
 +    case I2C_NACK:
 +        break;
 +
 +    default:
 +        return -1;
 +    }
 +
 +    return 0;
 +}
 +
 +static uint8_t i2c_echo_recv(I2CSlave *s)
 +{
 +    I2CEchoState *state = I2C_ECHO(s);
 +
 +    if (state->pos > 2) {
 +        return 0xff;
 +    }
 +
 +    return state->data[state->pos++];
 +}
 +
 +static int i2c_echo_send(I2CSlave *s, uint8_t data)
 +{
 +    I2CEchoState *state = I2C_ECHO(s);
 +
 +    if (state->pos > 2) {
 +        return -1;
 +    }
 +
 +    state->data[state->pos++] = data;
 +
 +    return 0;
 +}
 +
 +static void i2c_echo_realize(DeviceState *dev, Error **errp)
 +{
 +    I2CEchoState *state = I2C_ECHO(dev);
 +    BusState *bus = qdev_get_parent_bus(dev);
 +
 +    state->bus = I2C_BUS(bus);
 +    state->bh = qemu_bh_new(i2c_echo_bh, state);
 +
 +    return;
 +}
 +
 +static void i2c_echo_class_init(ObjectClass *oc, void *data)
 +{
 +    I2CSlaveClass *sc = I2C_SLAVE_CLASS(oc);
 +    DeviceClass *dc = DEVICE_CLASS(oc);
 +
 +    dc->realize = i2c_echo_realize;
 +
 +    sc->event = i2c_echo_event;
 +    sc->recv = i2c_echo_recv;
 +    sc->send = i2c_echo_send;
 +}
 +
 +static const TypeInfo i2c_echo = {
 +    .name = TYPE_I2C_ECHO,
 +    .parent = TYPE_I2C_SLAVE,
 +    .instance_size = sizeof(I2CEchoState),
 +    .class_init = i2c_echo_class_init,
 +};
 +
 +static void register_types(void)
 +{
 +    type_register_static(&i2c_echo);
 +}
 +
 +type_init(register_types);
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/meson.build
 +++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_rng.c'))
  softmmu_ss.add(when: 'CONFIG_GRLIB', if_true: files('grlib_ahb_apb_pnp.c'))
 +softmmu_ss.add(when: 'CONFIG_I2C', if_true: files('i2c-echo.c'))
 +
  specific_ss.add(when: 'CONFIG_AVR_POWER', if_true: files('avr_power.c'))
  specific_ss.add(when: 'CONFIG_MAC_VIA', if_true: files('mac_via.c'))
 --
-.39.2
+.49.0

-[PULL 04/11] tests/avocado/machine_aspeed.py: Add an I2C slave test
+Deleted patch
-The Aspeed 2600 I2C controller supports a slave mode which can be
-tested with the I2C echo device. Test extracted from :
-  https://lists.nongnu.org/archive/html/qemu-devel/2022-06/msg00183.html
-Suggested-by: Klaus Jensen <k.jensen@samsung.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- tests/avocado/machine_aspeed.py | 10 ++++++++++
-file changed, 10 insertions(+)
-diff --git a/tests/avocado/machine_aspeed.py b/tests/avocado/machine_aspeed.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/avocado/machine_aspeed.py
-+++ b/tests/avocado/machine_aspeed.py
-@@ -XXX,XX +XXX,XX @@ def test_arm_ast2600_evb_buildroot(self):
-                          'tmp105,bus=aspeed.i2c.bus.3,address=0x4d,id=tmp-test');
-         self.vm.add_args('-device',
-                          'ds1338,bus=aspeed.i2c.bus.3,address=0x32');
-+        self.vm.add_args('-device',
-+                         'i2c-echo,bus=aspeed.i2c.bus.3,address=0x42');
-         self.do_test_arm_aspeed_buildroot_start(image_path, '0xf00')
-         exec_command_and_wait_for_pattern(self,
-@@ -XXX,XX +XXX,XX @@ def test_arm_ast2600_evb_buildroot(self):
-         year = time.strftime("%Y")
-         exec_command_and_wait_for_pattern(self, 'hwclock -f /dev/rtc1', year);
-+        exec_command_and_wait_for_pattern(self,
-+             'echo slave-24c02 0x1064 > /sys/bus/i2c/devices/i2c-3/new_device',
-+             'i2c i2c-3: new_device: Instantiated device slave-24c02 at 0x64');
-+        exec_command(self, 'i2cset -y 3 0x42 0x64 0x00 0xaa i');
-+        time.sleep(0.1)
-+        exec_command_and_wait_for_pattern(self,
-+             'hexdump /sys/bus/i2c/devices/3-1064/slave-eeprom',
-+             '0000000 ffaa ffff ffff ffff ffff ffff ffff ffff');
-         self.do_test_arm_aspeed_buildroot_poweroff()
---
-.39.2

-[PULL 05/11] hw/arm/aspeed: Adding new machine Yosemitev2 in QEMU
+Deleted patch
-From: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
-This patch support Yosemitev2 in QEMU environment.
-and introduced EEPROM BMC FRU data support "add fbyv2_bmc_fruid data"
-along with the machine support.
-Signed-off-by: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-[ clg: - commit log topic update
-       - Documentation update ]
-Message-Id: <20230216133326.216017-1-pkarthikeyan1509@gmail.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- docs/system/arm/aspeed.rst |  1 +
- hw/arm/aspeed_eeprom.h     |  3 +++
- hw/arm/aspeed.c            | 31 +++++++++++++++++++++++++++++++
- hw/arm/aspeed_eeprom.c     | 23 +++++++++++++++++++++++
-files changed, 58 insertions(+)
-diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/aspeed.rst
-+++ b/docs/system/arm/aspeed.rst
-@@ -XXX,XX +XXX,XX @@ AST2500 SoC based machines :
- - ``sonorapass-bmc``       OCP SonoraPass BMC
- - ``fp5280g2-bmc``         Inspur FP5280G2 BMC
- - ``g220a-bmc``            Bytedance G220A BMC
-+- ``yosemitev2-bmc``       Facebook YosemiteV2 BMC
- AST2600 SoC based machines :
-diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_eeprom.h
-+++ b/hw/arm/aspeed_eeprom.h
-@@ -XXX,XX +XXX,XX @@ extern const size_t fby35_nic_fruid_len;
- extern const size_t fby35_bb_fruid_len;
- extern const size_t fby35_bmc_fruid_len;
-+extern const uint8_t yosemitev2_bmc_fruid[];
-+extern const size_t yosemitev2_bmc_fruid_len;
-+
- #endif
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
-                      TYPE_TMP105, 0x4d);
- }
-+static void yosemitev2_bmc_i2c_init(AspeedMachineState *bmc)
-+{
-+    AspeedSoCState *soc = &bmc->soc;
-+
-+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x51, 128 * KiB);
-+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x51, 128 * KiB,
-+                          yosemitev2_bmc_fruid, yosemitev2_bmc_fruid_len);
-+}
-+
- static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
- {
-     AspeedSoCState *soc = &bmc->soc;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc, void *data)
-         aspeed_soc_num_cpus(amc->soc_name);
- };
-+static void aspeed_machine_yosemitev2_class_init(ObjectClass *oc, void *data)
-+{
-+    MachineClass *mc = MACHINE_CLASS(oc);
-+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-+
-+    mc->desc       = "Facebook YosemiteV2 BMC (ARM1176)";
-+    amc->soc_name  = "ast2500-a1";
-+    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
-+    amc->hw_strap2 = 0;
-+    amc->fmc_model = "n25q256a";
-+    amc->spi_model = "mx25l25635e";
-+    amc->num_cs    = 2;
-+    amc->i2c_init  = yosemitev2_bmc_i2c_init;
-+    mc->default_ram_size       = 512 * MiB;
-+    mc->default_cpus = mc->min_cpus = mc->max_cpus =
-+        aspeed_soc_num_cpus(amc->soc_name);
-+};
-+
- static void aspeed_machine_romulus_class_init(ObjectClass *oc, void *data)
- {
-     MachineClass *mc = MACHINE_CLASS(oc);
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
-         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
-         .parent        = TYPE_ASPEED_MACHINE,
-         .class_init    = aspeed_machine_ast2600_evb_class_init,
-+    }, {
-+        .name          = MACHINE_TYPE_NAME("yosemitev2-bmc"),
-+        .parent        = TYPE_ASPEED_MACHINE,
-+        .class_init    = aspeed_machine_yosemitev2_class_init,
-     }, {
-         .name          = MACHINE_TYPE_NAME("tacoma-bmc"),
-         .parent        = TYPE_ASPEED_MACHINE,
-diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_eeprom.c
-+++ b/hw/arm/aspeed_eeprom.c
-@@ -XXX,XX +XXX,XX @@ const uint8_t fby35_bmc_fruid[] = {
-x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
- };
-+/* Yosemite V2 BMC FRU */
-+const uint8_t yosemitev2_bmc_fruid[] = {
-+    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
-+    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
-+    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
-+    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
-+    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x59, 0x6f, 0x73, 0x65, 0x6d,
-+    0x69, 0x74, 0x65, 0x20, 0x56, 0x32, 0x2e, 0x30, 0x20, 0x45, 0x56, 0x54,
-+    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-+    0x58, 0x58, 0x58, 0x58, 0xc4, 0x45, 0x56, 0x54, 0x32, 0xcd, 0x58, 0x58,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
-+    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
-+};
-+
- const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
- const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
- const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
-+
-+const size_t yosemitev2_bmc_fruid_len = sizeof(yosemitev2_bmc_fruid);
---
-.39.2

-[PULL 06/11] hw/arm/aspeed: Adding new machine Tiogapass in QEMU
+Deleted patch
-From: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
-This patch support Tiogapass in QEMU environment.
-and introduced EEPROM BMC FRU data support "add tiogapass_bmc_fruid data"
-along with the machine support.
-Signed-off-by: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-[ clg: - commit log topic update
-       - checkpatch issues
-       - Documentation update ]
-Message-Id: <20230216184342.253868-1-pkarthikeyan1509@gmail.com>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- docs/system/arm/aspeed.rst |  1 +
- hw/arm/aspeed_eeprom.h     |  3 +++
- hw/arm/aspeed.c            | 32 ++++++++++++++++++++++++++++++++
- hw/arm/aspeed_eeprom.c     | 22 ++++++++++++++++++++++
-files changed, 58 insertions(+)
-diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/aspeed.rst
-+++ b/docs/system/arm/aspeed.rst
-@@ -XXX,XX +XXX,XX @@ AST2500 SoC based machines :
- - ``fp5280g2-bmc``         Inspur FP5280G2 BMC
- - ``g220a-bmc``            Bytedance G220A BMC
- - ``yosemitev2-bmc``       Facebook YosemiteV2 BMC
-+- ``tiogapass-bmc``        Facebook Tiogapass BMC
- AST2600 SoC based machines :
-diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_eeprom.h
-+++ b/hw/arm/aspeed_eeprom.h
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
-+extern const uint8_t tiogapass_bmc_fruid[];
-+extern const size_t tiogapass_bmc_fruid_len;
-+
- extern const uint8_t fby35_nic_fruid[];
- extern const uint8_t fby35_bb_fruid[];
- extern const uint8_t fby35_bmc_fruid[];
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
-     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "ds1338", 0x32);
- }
-+static void tiogapass_bmc_i2c_init(AspeedMachineState *bmc)
-+{
-+    AspeedSoCState *soc = &bmc->soc;
-+
-+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54, 128 * KiB);
-+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 6), 0x54, 128 * KiB,
-+                          tiogapass_bmc_fruid, tiogapass_bmc_fruid_len);
-+}
-+
- static void create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
- {
-     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, bus_id),
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_romulus_class_init(ObjectClass *oc, void *data)
-         aspeed_soc_num_cpus(amc->soc_name);
- };
-+static void aspeed_machine_tiogapass_class_init(ObjectClass *oc, void *data)
-+{
-+    MachineClass *mc = MACHINE_CLASS(oc);
-+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-+
-+    mc->desc       = "Facebook Tiogapass BMC (ARM1176)";
-+    amc->soc_name  = "ast2500-a1";
-+    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
-+    amc->hw_strap2 = 0;
-+    amc->fmc_model = "n25q256a";
-+    amc->spi_model = "mx25l25635e";
-+    amc->num_cs    = 2;
-+    amc->i2c_init  = tiogapass_bmc_i2c_init;
-+    mc->default_ram_size       = 1 * GiB;
-+    mc->default_cpus = mc->min_cpus = mc->max_cpus =
-+        aspeed_soc_num_cpus(amc->soc_name);
-+        aspeed_soc_num_cpus(amc->soc_name);
-+};
-+
- static void aspeed_machine_sonorapass_class_init(ObjectClass *oc, void *data)
- {
-     MachineClass *mc = MACHINE_CLASS(oc);
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
-         .name          = MACHINE_TYPE_NAME("tacoma-bmc"),
-         .parent        = TYPE_ASPEED_MACHINE,
-         .class_init    = aspeed_machine_tacoma_class_init,
-+    }, {
-+        .name          = MACHINE_TYPE_NAME("tiogapass-bmc"),
-+        .parent        = TYPE_ASPEED_MACHINE,
-+        .class_init    = aspeed_machine_tiogapass_class_init,
-     }, {
-         .name          = MACHINE_TYPE_NAME("g220a-bmc"),
-         .parent        = TYPE_ASPEED_MACHINE,
-diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_eeprom.c
-+++ b/hw/arm/aspeed_eeprom.c
-@@ -XXX,XX +XXX,XX @@
- #include "aspeed_eeprom.h"
-+/* Tiogapass BMC FRU */
-+const uint8_t tiogapass_bmc_fruid[] = {
-+    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
-+    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
-+    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
-+    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
-+    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x54, 0x69, 0x6f, 0x67, 0x61,
-+    0x20, 0x50, 0x61, 0x73, 0x73, 0x20, 0x53, 0x69, 0x6e, 0x67, 0x6c, 0x65,
-+    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-+    0x58, 0x58, 0x58, 0x58, 0xc4, 0x58, 0x58, 0x58, 0x32, 0xcd, 0x58, 0x58,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
-+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
-+    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
-+};
-+
- const uint8_t fby35_nic_fruid[] = {
-x01, 0x00, 0x00, 0x01, 0x0f, 0x20, 0x00, 0xcf, 0x01, 0x0e, 0x19, 0xd7,
-x5e, 0xcf, 0xc8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xdd,
-@@ -XXX,XX +XXX,XX @@ const uint8_t yosemitev2_bmc_fruid[] = {
-x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
- };
-+const size_t tiogapass_bmc_fruid_len = sizeof(tiogapass_bmc_fruid);
- const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
- const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
- const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
---
-.39.2

-[PULL 07/11] hw/at24c : modify at24c to support 1 byte address mode
+Deleted patch
-From: Sittisak Sinprem <ssinprem@celestica.com>
-Signed-off-by: Sittisak Sinprem <ssinprem@celestica.com>
-Reviewed-by: Peter Delevoryas <peter@pjd.dev>
-[ clg: checkpatch issues ]
-Message-Id: <167660539263.10409.9736070122710923479-1@git.sr.ht>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/nvram/eeprom_at24c.c | 30 +++++++++++++++++++++++++++---
-file changed, 27 insertions(+), 3 deletions(-)
-diff --git a/hw/nvram/eeprom_at24c.c b/hw/nvram/eeprom_at24c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/nvram/eeprom_at24c.c
-+++ b/hw/nvram/eeprom_at24c.c
-@@ -XXX,XX +XXX,XX @@ struct EEPROMState {
-     uint16_t cur;
-     /* total size in bytes */
-     uint32_t rsize;
-+    /*
-+     * address byte number
-+     *  for  24c01, 24c02 size <= 256 byte, use only 1 byte
-+     *  otherwise size > 256, use 2 byte
-+     */
-+    uint8_t asize;
-+
-     bool writable;
-     /* cells changed since last START? */
-     bool changed;
-@@ -XXX,XX +XXX,XX @@ uint8_t at24c_eeprom_recv(I2CSlave *s)
-     EEPROMState *ee = AT24C_EE(s);
-     uint8_t ret;
--    if (ee->haveaddr == 1) {
-+    /*
-+     * If got the byte address but not completely with address size
-+     * will return the invalid value
-+     */
-+    if (ee->haveaddr > 0 && ee->haveaddr < ee->asize) {
-         return 0xff;
-     }
-@@ -XXX,XX +XXX,XX @@ int at24c_eeprom_send(I2CSlave *s, uint8_t data)
- {
-     EEPROMState *ee = AT24C_EE(s);
--    if (ee->haveaddr < 2) {
-+    if (ee->haveaddr < ee->asize) {
-         ee->cur <<= 8;
-         ee->cur |= data;
-         ee->haveaddr++;
--        if (ee->haveaddr == 2) {
-+        if (ee->haveaddr == ee->asize) {
-             ee->cur %= ee->rsize;
-             DPRINTK("Set pointer %04x\n", ee->cur);
-         }
-@@ -XXX,XX +XXX,XX @@ static void at24c_eeprom_realize(DeviceState *dev, Error **errp)
-         }
-         DPRINTK("Reset read backing file\n");
-     }
-+
-+    /*
-+     * If address size didn't define with property set
-+     *   value is 0 as default, setting it by Rom size detecting.
-+     */
-+    if (ee->asize == 0) {
-+        if (ee->rsize <= 256) {
-+            ee->asize = 1;
-+        } else {
-+            ee->asize = 2;
-+        }
-+    }
- }
- static
-@@ -XXX,XX +XXX,XX @@ void at24c_eeprom_reset(DeviceState *state)
- static Property at24c_eeprom_props[] = {
-     DEFINE_PROP_UINT32("rom-size", EEPROMState, rsize, 0),
-+    DEFINE_PROP_UINT8("address-size", EEPROMState, asize, 0),
-     DEFINE_PROP_BOOL("writable", EEPROMState, writable, true),
-     DEFINE_PROP_DRIVE("drive", EEPROMState, blk),
-     DEFINE_PROP_END_OF_LIST()
---
-.39.2

-[PULL 08/11] aspeed/fuji : correct the eeprom size
+Deleted patch
-From: Sittisak Sinprem <ssinprem@celestica.com>
-Device 24C64 the size is 64 kilobits = 8kilobyte
-Device 24C02 the size is 2 kilobits = 256byte
-Signed-off-by: Sittisak Sinprem <ssinprem@celestica.com>
-Reviewed-by: Peter Delevoryas <peter@pjd.dev>
-[ clg: checkpatch issues ]
-Message-Id: <167660539263.10409.9736070122710923479-2@git.sr.ht>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/arm/aspeed.c | 36 ++++++++++++++++++++----------------
-file changed, 20 insertions(+), 16 deletions(-)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void fuji_bmc_i2c_init(AspeedMachineState *bmc)
-     i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4c);
-     i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4d);
--    at24c_eeprom_init(i2c[19], 0x52, 64 * KiB);
--    at24c_eeprom_init(i2c[20], 0x50, 2 * KiB);
--    at24c_eeprom_init(i2c[22], 0x52, 2 * KiB);
-+    /*
-+     * EEPROM 24c64 size is 64Kbits or 8 Kbytes
-+     *        24c02 size is 2Kbits or 256 bytes
-+     */
-+    at24c_eeprom_init(i2c[19], 0x52, 8 * KiB);
-+    at24c_eeprom_init(i2c[20], 0x50, 256);
-+    at24c_eeprom_init(i2c[22], 0x52, 256);
-     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x48);
-     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x49);
-     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x4a);
-     i2c_slave_create_simple(i2c[3], TYPE_TMP422, 0x4c);
--    at24c_eeprom_init(i2c[8], 0x51, 64 * KiB);
-+    at24c_eeprom_init(i2c[8], 0x51, 8 * KiB);
-     i2c_slave_create_simple(i2c[8], TYPE_LM75, 0x4a);
-     i2c_slave_create_simple(i2c[50], TYPE_LM75, 0x4c);
--    at24c_eeprom_init(i2c[50], 0x52, 64 * KiB);
-+    at24c_eeprom_init(i2c[50], 0x52, 8 * KiB);
-     i2c_slave_create_simple(i2c[51], TYPE_TMP75, 0x48);
-     i2c_slave_create_simple(i2c[52], TYPE_TMP75, 0x49);
-     i2c_slave_create_simple(i2c[59], TYPE_TMP75, 0x48);
-     i2c_slave_create_simple(i2c[60], TYPE_TMP75, 0x49);
--    at24c_eeprom_init(i2c[65], 0x53, 64 * KiB);
-+    at24c_eeprom_init(i2c[65], 0x53, 8 * KiB);
-     i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x49);
-     i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x48);
--    at24c_eeprom_init(i2c[68], 0x52, 64 * KiB);
--    at24c_eeprom_init(i2c[69], 0x52, 64 * KiB);
--    at24c_eeprom_init(i2c[70], 0x52, 64 * KiB);
--    at24c_eeprom_init(i2c[71], 0x52, 64 * KiB);
-+    at24c_eeprom_init(i2c[68], 0x52, 8 * KiB);
-+    at24c_eeprom_init(i2c[69], 0x52, 8 * KiB);
-+    at24c_eeprom_init(i2c[70], 0x52, 8 * KiB);
-+    at24c_eeprom_init(i2c[71], 0x52, 8 * KiB);
--    at24c_eeprom_init(i2c[73], 0x53, 64 * KiB);
-+    at24c_eeprom_init(i2c[73], 0x53, 8 * KiB);
-     i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x49);
-     i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x48);
--    at24c_eeprom_init(i2c[76], 0x52, 64 * KiB);
--    at24c_eeprom_init(i2c[77], 0x52, 64 * KiB);
--    at24c_eeprom_init(i2c[78], 0x52, 64 * KiB);
--    at24c_eeprom_init(i2c[79], 0x52, 64 * KiB);
--    at24c_eeprom_init(i2c[28], 0x50, 2 * KiB);
-+    at24c_eeprom_init(i2c[76], 0x52, 8 * KiB);
-+    at24c_eeprom_init(i2c[77], 0x52, 8 * KiB);
-+    at24c_eeprom_init(i2c[78], 0x52, 8 * KiB);
-+    at24c_eeprom_init(i2c[79], 0x52, 8 * KiB);
-+    at24c_eeprom_init(i2c[28], 0x50, 256);
-     for (int i = 0; i < 8; i++) {
-         at24c_eeprom_init(i2c[81 + i * 8], 0x56, 64 * KiB);
---
-.39.2

-[PULL 10/11] aspeed: Add a boot_rom overlap region in the SoC spi_boot container
+Deleted patch
-To avoid the SPI transactions fetching instructions from the FMC CE0
-flash device and speed up boot, a ROM can be created if a drive is
-available.
-Reverse the logic to allow a machine to boot without a drive, using a
-block device instead :
-    -blockdev node-name=fmc0,driver=file,filename=/path/to/flash.img \
-    -device mx66u51235f,bus=ssi.0,drive=fmc0
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
----
- hw/arm/aspeed.c | 47 +++++++++++++++++++++++++++--------------------
-file changed, 27 insertions(+), 20 deletions(-)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_reset_secondary(ARMCPU *cpu,
-     cpu_set_pc(cs, info->smp_loader_start);
- }
--#define FIRMWARE_ADDR 0x0
--
--static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
-+static void write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
-                            Error **errp)
- {
--    BlockBackend *blk = blk_by_legacy_dinfo(dinfo);
-     g_autofree void *storage = NULL;
-     int64_t size;
-@@ -XXX,XX +XXX,XX @@ static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
-     rom_add_blob_fixed("aspeed.boot_rom", storage, rom_size, addr);
- }
-+/*
-+ * Create a ROM and copy the flash contents at the expected address
-+ * (0x0). Boots faster than execute-in-place.
-+ */
-+static void aspeed_install_boot_rom(AspeedSoCState *soc, BlockBackend *blk,
-+                                    uint64_t rom_size)
-+{
-+    MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
-+
-+    memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom", rom_size,
-+                           &error_abort);
-+    memory_region_add_subregion_overlap(&soc->spi_boot_container, 0,
-+                                        boot_rom, 1);
-+    write_boot_rom(blk, ASPEED_SOC_SPI_BOOT_ADDR, rom_size, &error_abort);
-+}
-+
- void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
-                                       unsigned int count, int unit0)
- {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-     AspeedMachineState *bmc = ASPEED_MACHINE(machine);
-     AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(machine);
-     AspeedSoCClass *sc;
--    DriveInfo *drive0 = drive_get(IF_MTD, 0, 0);
-     int i;
-     NICInfo *nd = &nd_table[0];
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-                               bmc->spi_model ? bmc->spi_model : amc->spi_model,
-, amc->num_cs);
--    /* Install first FMC flash content as a boot rom. */
--    if (drive0) {
--        AspeedSMCFlash *fl = &bmc->soc.fmc.flashes[0];
--        MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
--        uint64_t size = memory_region_size(&fl->mmio);
--
--        if (!ASPEED_MACHINE(machine)->mmio_exec) {
--            memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
--                                   size, &error_abort);
--            memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
--                                        boot_rom);
--            write_boot_rom(drive0, FIRMWARE_ADDR, size, &error_abort);
--        }
--    }
--
-     if (machine->kernel_filename && sc->num_cpus > 1) {
-         /* With no u-boot we must set up a boot stub for the secondary CPU */
-         MemoryRegion *smpboot = g_new(MemoryRegion, 1);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
-                            drive_get(IF_SD, 0, bmc->soc.sdhci.num_slots));
-     }
-+    if (!bmc->mmio_exec) {
-+        DriveInfo *mtd0 = drive_get(IF_MTD, 0, 0);
-+
-+        if (mtd0) {
-+            uint64_t rom_size = memory_region_size(&bmc->soc.spi_boot);
-+            aspeed_install_boot_rom(&bmc->soc, blk_by_legacy_dinfo(mtd0),
-+                                    rom_size);
-+        }
-+    }
-+
-     arm_load_kernel(ARM_CPU(first_cpu), machine, &aspeed_board_binfo);
- }
---
-.39.2

The following changes since commit a2b5f8b8ab7b2c947823088103a40f0ff11fe06b:

Merge tag 'pull-tcg-20230301' of https://gitlab.com/rth7680/qemu into staging (2023-03-01 19:19:20 +0000)

are available in the Git repository at:

https://github.com/legoater/qemu/ tags/pull-aspeed-20230302

for you to fetch changes up to b22a2d409b1acfdf0d63d1bb3595194ceb3d94da:

aspeed/smc: Replace SysBus IRQs with GPIO lines (2023-03-02 13:57:50 +0100)

----------------------------------------------------------------
aspeed queue:

* fix for the Aspeed I2C slave mode
* a new I2C echo device from Klaus and its associated test in avocado.
* initial SoC cleanups to allow the use of block devices instead of
  drives on the command line.
* new facebook machines and eeprom fixes for the Fuji
* readline fix

----------------------------------------------------------------
Cédric Le Goater (4):
      tests/avocado/machine_aspeed.py: Add an I2C slave test
      aspeed: Introduce a spi_boot region under the SoC
      aspeed: Add a boot_rom overlap region in the SoC spi_boot container
      aspeed/smc: Replace SysBus IRQs with GPIO lines

Dongli Zhang (1):
      readline: fix hmp completion issue

Karthikeyan Pasupathi (2):
      hw/arm/aspeed: Adding new machine Yosemitev2 in QEMU
      hw/arm/aspeed: Adding new machine Tiogapass in QEMU

Klaus Jensen (2):
      hw/i2c: only schedule pending master when bus is idle
      hw/misc: add a toy i2c echo device

Sittisak Sinprem (2):
      hw/at24c : modify at24c to support 1 byte address mode
      aspeed/fuji : correct the eeprom size

From: Dongli Zhang <dongli.zhang@oracle.com>

The auto completion does not work in some cases.

Case 1.

1. (qemu) info reg
2. Press 'Tab'.
3. It does not auto complete.

Case 2.

1. (qemu) block_resize flo
2. Press 'Tab'.
3. It does not auto complete 'floppy0'.

Since the readline_add_completion_of() may add any completion when
strlen(pfx) is zero, we remove the check with (name[0] == '\0') because
strlen() always returns zero in that case.

Fixes: 52f50b1e9f8f ("readline: Extract readline_add_completion_of() from monitor")
Cc: Joe Jin <joe.jin@oracle.com>
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 monitor/hmp.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/monitor/hmp.c b/monitor/hmp.c
index XXXXXXX..XXXXXXX 100644
--- a/monitor/hmp.c
+++ b/monitor/hmp.c
@@ -XXX,XX +XXX,XX @@ static void cmd_completion(MonitorHMP *mon, const char *name, const char *list)
         }
         memcpy(cmd, pstart, len);
         cmd[len] = '\0';
-        if (name[0] == '\0') {
-            readline_add_completion_of(mon->rs, name, cmd);
-        }
+        readline_add_completion_of(mon->rs, name, cmd);
         if (*p == '\0') {
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void monitor_find_completion_by_table(MonitorHMP *mon,
             /* block device name completion */
             readline_set_completion_index(mon->rs, strlen(str));
             while ((blk = blk_next(blk)) != NULL) {
-                if (str[0] == '\0') {
-                    readline_add_completion_of(mon->rs, str, blk_name(blk));
-                }
+                readline_add_completion_of(mon->rs, str, blk_name(blk));
             }
             break;
         case 's':
-- 
2.39.2

From: Klaus Jensen <k.jensen@samsung.com>

It is not given that the current master will release the bus after a
transfer ends. Only schedule a pending master if the bus is idle.

Fixes: 37fa5ca42623 ("hw/i2c: support multiple masters")
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Acked-by: Corey Minyard <cminyard@mvista.com>
Message-Id: <20221116084312.35808-2-its@irrelevant.dk>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/i2c/i2c.h |  2 ++
 hw/i2c/aspeed_i2c.c  |  2 ++
 hw/i2c/core.c        | 37 ++++++++++++++++++++++---------------
 3 files changed, 26 insertions(+), 15 deletions(-)

diff --git a/include/hw/i2c/i2c.h b/include/hw/i2c/i2c.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/i2c.h
+++ b/include/hw/i2c/i2c.h
@@ -XXX,XX +XXX,XX @@ int i2c_start_send(I2CBus *bus, uint8_t address);
  */
 int i2c_start_send_async(I2CBus *bus, uint8_t address);
 
+void i2c_schedule_pending_master(I2CBus *bus);
+
 void i2c_end_transfer(I2CBus *bus);
 void i2c_nack(I2CBus *bus);
 void i2c_ack(I2CBus *bus);
diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
         }
         SHARED_ARRAY_FIELD_DP32(bus->regs, reg_cmd, M_STOP_CMD, 0);
         aspeed_i2c_set_state(bus, I2CD_IDLE);
+
+        i2c_schedule_pending_master(bus->bus);
     }
 
     if (aspeed_i2c_bus_pkt_mode_en(bus)) {
diff --git a/hw/i2c/core.c b/hw/i2c/core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/core.c
+++ b/hw/i2c/core.c
@@ -XXX,XX +XXX,XX @@ int i2c_start_transfer(I2CBus *bus, uint8_t address, bool is_recv)
 
 void i2c_bus_master(I2CBus *bus, QEMUBH *bh)
 {
-    if (i2c_bus_busy(bus)) {
-        I2CPendingMaster *node = g_new(struct I2CPendingMaster, 1);
-        node->bh = bh;
+    I2CPendingMaster *node = g_new(struct I2CPendingMaster, 1);
+    node->bh = bh;
+
+    QSIMPLEQ_INSERT_TAIL(&bus->pending_masters, node, entry);
+}
+
+void i2c_schedule_pending_master(I2CBus *bus)
+{
+    I2CPendingMaster *node;
 
-        QSIMPLEQ_INSERT_TAIL(&bus->pending_masters, node, entry);
+    if (i2c_bus_busy(bus)) {
+        /* someone is already controlling the bus; wait for it to release it */
+        return;
+    }
 
+    if (QSIMPLEQ_EMPTY(&bus->pending_masters)) {
         return;
     }
 
-    bus->bh = bh;
+    node = QSIMPLEQ_FIRST(&bus->pending_masters);
+    bus->bh = node->bh;
+
+    QSIMPLEQ_REMOVE_HEAD(&bus->pending_masters, entry);
+    g_free(node);
+
     qemu_bh_schedule(bus->bh);
 }
 
 void i2c_bus_release(I2CBus *bus)
 {
     bus->bh = NULL;
+
+    i2c_schedule_pending_master(bus);
 }
 
 int i2c_start_recv(I2CBus *bus, uint8_t address)
@@ -XXX,XX +XXX,XX @@ void i2c_end_transfer(I2CBus *bus)
         g_free(node);
     }
     bus->broadcast = false;
-
-    if (!QSIMPLEQ_EMPTY(&bus->pending_masters)) {
-        I2CPendingMaster *node = QSIMPLEQ_FIRST(&bus->pending_masters);
-        bus->bh = node->bh;
-
-        QSIMPLEQ_REMOVE_HEAD(&bus->pending_masters, entry);
-        g_free(node);
-
-        qemu_bh_schedule(bus->bh);
-    }
 }
 
 int i2c_send(I2CBus *bus, uint8_t data)
-- 
2.39.2

From: Klaus Jensen <k.jensen@samsung.com>

Add an example I2C device to demonstrate how a slave may master the bus
and send data asynchronously to another slave.

The device will echo whatever it is sent to the device identified by the
first byte received.

Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
[ clg: integrated fixes :
  https://lore.kernel.org/qemu-devel/Y3yMKAhOkYGtnkOp@cormorant.local/ ]
Message-Id: <20220601210831.67259-7-its@irrelevant.dk>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/misc/i2c-echo.c  | 156 ++++++++++++++++++++++++++++++++++++++++++++
 hw/misc/meson.build |   2 +
 2 files changed, 158 insertions(+)
 create mode 100644 hw/misc/i2c-echo.c

diff --git a/hw/misc/i2c-echo.c b/hw/misc/i2c-echo.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/i2c-echo.c
@@ -XXX,XX +XXX,XX @@
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "qemu/main-loop.h"
+#include "block/aio.h"
+#include "hw/i2c/i2c.h"
+
+#define TYPE_I2C_ECHO "i2c-echo"
+OBJECT_DECLARE_SIMPLE_TYPE(I2CEchoState, I2C_ECHO)
+
+enum i2c_echo_state {
+    I2C_ECHO_STATE_IDLE,
+    I2C_ECHO_STATE_START_SEND,
+    I2C_ECHO_STATE_ACK,
+};
+
+typedef struct I2CEchoState {
+    I2CSlave parent_obj;
+
+    I2CBus *bus;
+
+    enum i2c_echo_state state;
+    QEMUBH *bh;
+
+    unsigned int pos;
+    uint8_t data[3];
+} I2CEchoState;
+
+static void i2c_echo_bh(void *opaque)
+{
+    I2CEchoState *state = opaque;
+
+    switch (state->state) {
+    case I2C_ECHO_STATE_IDLE:
+        return;
+
+    case I2C_ECHO_STATE_START_SEND:
+        if (i2c_start_send_async(state->bus, state->data[0])) {
+            goto release_bus;
+        }
+
+        state->pos++;
+        state->state = I2C_ECHO_STATE_ACK;
+        return;
+
+    case I2C_ECHO_STATE_ACK:
+        if (state->pos > 2) {
+            break;
+        }
+
+        if (i2c_send_async(state->bus, state->data[state->pos++])) {
+            break;
+        }
+
+        return;
+    }
+
+
+    i2c_end_transfer(state->bus);
+release_bus:
+    i2c_bus_release(state->bus);
+
+    state->state = I2C_ECHO_STATE_IDLE;
+}
+
+static int i2c_echo_event(I2CSlave *s, enum i2c_event event)
+{
+    I2CEchoState *state = I2C_ECHO(s);
+
+    switch (event) {
+    case I2C_START_RECV:
+        state->pos = 0;
+
+        break;
+
+    case I2C_START_SEND:
+        state->pos = 0;
+
+        break;
+
+    case I2C_FINISH:
+        state->pos = 0;
+        state->state = I2C_ECHO_STATE_START_SEND;
+        i2c_bus_master(state->bus, state->bh);
+
+        break;
+
+    case I2C_NACK:
+        break;
+
+    default:
+        return -1;
+    }
+
+    return 0;
+}
+
+static uint8_t i2c_echo_recv(I2CSlave *s)
+{
+    I2CEchoState *state = I2C_ECHO(s);
+
+    if (state->pos > 2) {
+        return 0xff;
+    }
+
+    return state->data[state->pos++];
+}
+
+static int i2c_echo_send(I2CSlave *s, uint8_t data)
+{
+    I2CEchoState *state = I2C_ECHO(s);
+
+    if (state->pos > 2) {
+        return -1;
+    }
+
+    state->data[state->pos++] = data;
+
+    return 0;
+}
+
+static void i2c_echo_realize(DeviceState *dev, Error **errp)
+{
+    I2CEchoState *state = I2C_ECHO(dev);
+    BusState *bus = qdev_get_parent_bus(dev);
+
+    state->bus = I2C_BUS(bus);
+    state->bh = qemu_bh_new(i2c_echo_bh, state);
+
+    return;
+}
+
+static void i2c_echo_class_init(ObjectClass *oc, void *data)
+{
+    I2CSlaveClass *sc = I2C_SLAVE_CLASS(oc);
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = i2c_echo_realize;
+
+    sc->event = i2c_echo_event;
+    sc->recv = i2c_echo_recv;
+    sc->send = i2c_echo_send;
+}
+
+static const TypeInfo i2c_echo = {
+    .name = TYPE_I2C_ECHO,
+    .parent = TYPE_I2C_SLAVE,
+    .instance_size = sizeof(I2CEchoState),
+    .class_init = i2c_echo_class_init,
+};
+
+static void register_types(void)
+{
+    type_register_static(&i2c_echo);
+}
+
+type_init(register_types);
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_rng.c'))
 
 softmmu_ss.add(when: 'CONFIG_GRLIB', if_true: files('grlib_ahb_apb_pnp.c'))
 
+softmmu_ss.add(when: 'CONFIG_I2C', if_true: files('i2c-echo.c'))
+
 specific_ss.add(when: 'CONFIG_AVR_POWER', if_true: files('avr_power.c'))
 
 specific_ss.add(when: 'CONFIG_MAC_VIA', if_true: files('mac_via.c'))
-- 
2.39.2

The Aspeed 2600 I2C controller supports a slave mode which can be
tested with the I2C echo device. Test extracted from :

https://lists.nongnu.org/archive/html/qemu-devel/2022-06/msg00183.html

Suggested-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 tests/avocado/machine_aspeed.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tests/avocado/machine_aspeed.py b/tests/avocado/machine_aspeed.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/avocado/machine_aspeed.py
+++ b/tests/avocado/machine_aspeed.py
@@ -XXX,XX +XXX,XX @@ def test_arm_ast2600_evb_buildroot(self):
                          'tmp105,bus=aspeed.i2c.bus.3,address=0x4d,id=tmp-test');
         self.vm.add_args('-device',
                          'ds1338,bus=aspeed.i2c.bus.3,address=0x32');
+        self.vm.add_args('-device',
+                         'i2c-echo,bus=aspeed.i2c.bus.3,address=0x42');
         self.do_test_arm_aspeed_buildroot_start(image_path, '0xf00')
 
         exec_command_and_wait_for_pattern(self,
@@ -XXX,XX +XXX,XX @@ def test_arm_ast2600_evb_buildroot(self):
         year = time.strftime("%Y")
         exec_command_and_wait_for_pattern(self, 'hwclock -f /dev/rtc1', year);
 
+        exec_command_and_wait_for_pattern(self,
+             'echo slave-24c02 0x1064 > /sys/bus/i2c/devices/i2c-3/new_device',
+             'i2c i2c-3: new_device: Instantiated device slave-24c02 at 0x64');
+        exec_command(self, 'i2cset -y 3 0x42 0x64 0x00 0xaa i');
+        time.sleep(0.1)
+        exec_command_and_wait_for_pattern(self,
+             'hexdump /sys/bus/i2c/devices/3-1064/slave-eeprom',
+             '0000000 ffaa ffff ffff ffff ffff ffff ffff ffff');
         self.do_test_arm_aspeed_buildroot_poweroff()
 
 
-- 
2.39.2

From: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>

This patch support Yosemitev2 in QEMU environment.
and introduced EEPROM BMC FRU data support "add fbyv2_bmc_fruid data"
along with the machine support.

Signed-off-by: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
[ clg: - commit log topic update
       - Documentation update ]
Message-Id: <20230216133326.216017-1-pkarthikeyan1509@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 docs/system/arm/aspeed.rst |  1 +
 hw/arm/aspeed_eeprom.h     |  3 +++
 hw/arm/aspeed.c            | 31 +++++++++++++++++++++++++++++++
 hw/arm/aspeed_eeprom.c     | 23 +++++++++++++++++++++++
 4 files changed, 58 insertions(+)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -XXX,XX +XXX,XX @@ AST2500 SoC based machines :
 - ``sonorapass-bmc``       OCP SonoraPass BMC
 - ``fp5280g2-bmc``         Inspur FP5280G2 BMC
 - ``g220a-bmc``            Bytedance G220A BMC
+- ``yosemitev2-bmc``       Facebook YosemiteV2 BMC
 
 AST2600 SoC based machines :
 
diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_eeprom.h
+++ b/hw/arm/aspeed_eeprom.h
@@ -XXX,XX +XXX,XX @@ extern const size_t fby35_nic_fruid_len;
 extern const size_t fby35_bb_fruid_len;
 extern const size_t fby35_bmc_fruid_len;
 
+extern const uint8_t yosemitev2_bmc_fruid[];
+extern const size_t yosemitev2_bmc_fruid_len;
+
 #endif
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
                      TYPE_TMP105, 0x4d);
 }
 
+static void yosemitev2_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x51, 128 * KiB);
+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x51, 128 * KiB,
+                          yosemitev2_bmc_fruid, yosemitev2_bmc_fruid_len);
+}
+
 static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc, void *data)
         aspeed_soc_num_cpus(amc->soc_name);
 };
 
+static void aspeed_machine_yosemitev2_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Facebook YosemiteV2 BMC (ARM1176)";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
+    amc->hw_strap2 = 0;
+    amc->fmc_model = "n25q256a";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 2;
+    amc->i2c_init  = yosemitev2_bmc_i2c_init;
+    mc->default_ram_size       = 512 * MiB;
+    mc->default_cpus = mc->min_cpus = mc->max_cpus =
+        aspeed_soc_num_cpus(amc->soc_name);
+};
+
 static void aspeed_machine_romulus_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2600_evb_class_init,
+    }, {
+        .name          = MACHINE_TYPE_NAME("yosemitev2-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_yosemitev2_class_init,
     }, {
         .name          = MACHINE_TYPE_NAME("tacoma-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_eeprom.c
+++ b/hw/arm/aspeed_eeprom.c
@@ -XXX,XX +XXX,XX @@ const uint8_t fby35_bmc_fruid[] = {
     0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
 };
 
+/* Yosemite V2 BMC FRU */
+const uint8_t yosemitev2_bmc_fruid[] = {
+    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
+    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
+    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
+    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
+    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x59, 0x6f, 0x73, 0x65, 0x6d,
+    0x69, 0x74, 0x65, 0x20, 0x56, 0x32, 0x2e, 0x30, 0x20, 0x45, 0x56, 0x54,
+    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0xc4, 0x45, 0x56, 0x54, 0x32, 0xcd, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
+    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
+};
+
 const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
 const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
 const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
+
+const size_t yosemitev2_bmc_fruid_len = sizeof(yosemitev2_bmc_fruid);
-- 
2.39.2

From: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>

This patch support Tiogapass in QEMU environment.
and introduced EEPROM BMC FRU data support "add tiogapass_bmc_fruid data"
along with the machine support.

Signed-off-by: Karthikeyan Pasupathi <pkarthikeyan1509@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
[ clg: - commit log topic update
       - checkpatch issues
       - Documentation update ]
Message-Id: <20230216184342.253868-1-pkarthikeyan1509@gmail.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 docs/system/arm/aspeed.rst |  1 +
 hw/arm/aspeed_eeprom.h     |  3 +++
 hw/arm/aspeed.c            | 32 ++++++++++++++++++++++++++++++++
 hw/arm/aspeed_eeprom.c     | 22 ++++++++++++++++++++++
 4 files changed, 58 insertions(+)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -XXX,XX +XXX,XX @@ AST2500 SoC based machines :
 - ``fp5280g2-bmc``         Inspur FP5280G2 BMC
 - ``g220a-bmc``            Bytedance G220A BMC
 - ``yosemitev2-bmc``       Facebook YosemiteV2 BMC
+- ``tiogapass-bmc``        Facebook Tiogapass BMC
 
 AST2600 SoC based machines :
 
diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_eeprom.h
+++ b/hw/arm/aspeed_eeprom.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 
+extern const uint8_t tiogapass_bmc_fruid[];
+extern const size_t tiogapass_bmc_fruid_len;
+
 extern const uint8_t fby35_nic_fruid[];
 extern const uint8_t fby35_bb_fruid[];
 extern const uint8_t fby35_bmc_fruid[];
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "ds1338", 0x32);
 }
 
+static void tiogapass_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54, 128 * KiB);
+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 6), 0x54, 128 * KiB,
+                          tiogapass_bmc_fruid, tiogapass_bmc_fruid_len);
+}
+
 static void create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
 {
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, bus_id),
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_romulus_class_init(ObjectClass *oc, void *data)
         aspeed_soc_num_cpus(amc->soc_name);
 };
 
+static void aspeed_machine_tiogapass_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Facebook Tiogapass BMC (ARM1176)";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
+    amc->hw_strap2 = 0;
+    amc->fmc_model = "n25q256a";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 2;
+    amc->i2c_init  = tiogapass_bmc_i2c_init;
+    mc->default_ram_size       = 1 * GiB;
+    mc->default_cpus = mc->min_cpus = mc->max_cpus =
+        aspeed_soc_num_cpus(amc->soc_name);
+        aspeed_soc_num_cpus(amc->soc_name);
+};
+
 static void aspeed_machine_sonorapass_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_machine_types[] = {
         .name          = MACHINE_TYPE_NAME("tacoma-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_tacoma_class_init,
+    }, {
+        .name          = MACHINE_TYPE_NAME("tiogapass-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_tiogapass_class_init,
     }, {
         .name          = MACHINE_TYPE_NAME("g220a-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_eeprom.c
+++ b/hw/arm/aspeed_eeprom.c
@@ -XXX,XX +XXX,XX @@
 
 #include "aspeed_eeprom.h"
 
+/* Tiogapass BMC FRU */
+const uint8_t tiogapass_bmc_fruid[] = {
+    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
+    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
+    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
+    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
+    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x54, 0x69, 0x6f, 0x67, 0x61,
+    0x20, 0x50, 0x61, 0x73, 0x73, 0x20, 0x53, 0x69, 0x6e, 0x67, 0x6c, 0x65,
+    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0xc4, 0x58, 0x58, 0x58, 0x32, 0xcd, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
+    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
+};
+
 const uint8_t fby35_nic_fruid[] = {
     0x01, 0x00, 0x00, 0x01, 0x0f, 0x20, 0x00, 0xcf, 0x01, 0x0e, 0x19, 0xd7,
     0x5e, 0xcf, 0xc8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xdd,
@@ -XXX,XX +XXX,XX @@ const uint8_t yosemitev2_bmc_fruid[] = {
     0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
 };
 
+const size_t tiogapass_bmc_fruid_len = sizeof(tiogapass_bmc_fruid);
 const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
 const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
 const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
-- 
2.39.2

From: Sittisak Sinprem <ssinprem@celestica.com>

Signed-off-by: Sittisak Sinprem <ssinprem@celestica.com>
Reviewed-by: Peter Delevoryas <peter@pjd.dev>
[ clg: checkpatch issues ]
Message-Id: <167660539263.10409.9736070122710923479-1@git.sr.ht>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/nvram/eeprom_at24c.c | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/hw/nvram/eeprom_at24c.c b/hw/nvram/eeprom_at24c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/eeprom_at24c.c
+++ b/hw/nvram/eeprom_at24c.c
@@ -XXX,XX +XXX,XX @@ struct EEPROMState {
     uint16_t cur;
     /* total size in bytes */
     uint32_t rsize;
+    /*
+     * address byte number
+     *  for  24c01, 24c02 size <= 256 byte, use only 1 byte
+     *  otherwise size > 256, use 2 byte
+     */
+    uint8_t asize;
+
     bool writable;
     /* cells changed since last START? */
     bool changed;
@@ -XXX,XX +XXX,XX @@ uint8_t at24c_eeprom_recv(I2CSlave *s)
     EEPROMState *ee = AT24C_EE(s);
     uint8_t ret;
 
-    if (ee->haveaddr == 1) {
+    /*
+     * If got the byte address but not completely with address size
+     * will return the invalid value
+     */
+    if (ee->haveaddr > 0 && ee->haveaddr < ee->asize) {
         return 0xff;
     }
 
@@ -XXX,XX +XXX,XX @@ int at24c_eeprom_send(I2CSlave *s, uint8_t data)
 {
     EEPROMState *ee = AT24C_EE(s);
 
-    if (ee->haveaddr < 2) {
+    if (ee->haveaddr < ee->asize) {
         ee->cur <<= 8;
         ee->cur |= data;
         ee->haveaddr++;
-        if (ee->haveaddr == 2) {
+        if (ee->haveaddr == ee->asize) {
             ee->cur %= ee->rsize;
             DPRINTK("Set pointer %04x\n", ee->cur);
         }
@@ -XXX,XX +XXX,XX @@ static void at24c_eeprom_realize(DeviceState *dev, Error **errp)
         }
         DPRINTK("Reset read backing file\n");
     }
+
+    /*
+     * If address size didn't define with property set
+     *   value is 0 as default, setting it by Rom size detecting.
+     */
+    if (ee->asize == 0) {
+        if (ee->rsize <= 256) {
+            ee->asize = 1;
+        } else {
+            ee->asize = 2;
+        }
+    }
 }
 
 static
@@ -XXX,XX +XXX,XX @@ void at24c_eeprom_reset(DeviceState *state)
 
 static Property at24c_eeprom_props[] = {
     DEFINE_PROP_UINT32("rom-size", EEPROMState, rsize, 0),
+    DEFINE_PROP_UINT8("address-size", EEPROMState, asize, 0),
     DEFINE_PROP_BOOL("writable", EEPROMState, writable, true),
     DEFINE_PROP_DRIVE("drive", EEPROMState, blk),
     DEFINE_PROP_END_OF_LIST()
-- 
2.39.2

From: Sittisak Sinprem <ssinprem@celestica.com>

Device 24C64 the size is 64 kilobits = 8kilobyte
Device 24C02 the size is 2 kilobits = 256byte

Signed-off-by: Sittisak Sinprem <ssinprem@celestica.com>
Reviewed-by: Peter Delevoryas <peter@pjd.dev>
[ clg: checkpatch issues ]
Message-Id: <167660539263.10409.9736070122710923479-2@git.sr.ht>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c | 36 ++++++++++++++++++++----------------
 1 file changed, 20 insertions(+), 16 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void fuji_bmc_i2c_init(AspeedMachineState *bmc)
     i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4c);
     i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4d);
 
-    at24c_eeprom_init(i2c[19], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[20], 0x50, 2 * KiB);
-    at24c_eeprom_init(i2c[22], 0x52, 2 * KiB);
+    /*
+     * EEPROM 24c64 size is 64Kbits or 8 Kbytes
+     *        24c02 size is 2Kbits or 256 bytes
+     */
+    at24c_eeprom_init(i2c[19], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[20], 0x50, 256);
+    at24c_eeprom_init(i2c[22], 0x52, 256);
 
     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x48);
     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x49);
     i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x4a);
     i2c_slave_create_simple(i2c[3], TYPE_TMP422, 0x4c);
 
-    at24c_eeprom_init(i2c[8], 0x51, 64 * KiB);
+    at24c_eeprom_init(i2c[8], 0x51, 8 * KiB);
     i2c_slave_create_simple(i2c[8], TYPE_LM75, 0x4a);
 
     i2c_slave_create_simple(i2c[50], TYPE_LM75, 0x4c);
-    at24c_eeprom_init(i2c[50], 0x52, 64 * KiB);
+    at24c_eeprom_init(i2c[50], 0x52, 8 * KiB);
     i2c_slave_create_simple(i2c[51], TYPE_TMP75, 0x48);
     i2c_slave_create_simple(i2c[52], TYPE_TMP75, 0x49);
 
     i2c_slave_create_simple(i2c[59], TYPE_TMP75, 0x48);
     i2c_slave_create_simple(i2c[60], TYPE_TMP75, 0x49);
 
-    at24c_eeprom_init(i2c[65], 0x53, 64 * KiB);
+    at24c_eeprom_init(i2c[65], 0x53, 8 * KiB);
     i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x49);
     i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x48);
-    at24c_eeprom_init(i2c[68], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[69], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[70], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[71], 0x52, 64 * KiB);
+    at24c_eeprom_init(i2c[68], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[69], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[70], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[71], 0x52, 8 * KiB);
 
-    at24c_eeprom_init(i2c[73], 0x53, 64 * KiB);
+    at24c_eeprom_init(i2c[73], 0x53, 8 * KiB);
     i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x49);
     i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x48);
-    at24c_eeprom_init(i2c[76], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[77], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[78], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[79], 0x52, 64 * KiB);
-    at24c_eeprom_init(i2c[28], 0x50, 2 * KiB);
+    at24c_eeprom_init(i2c[76], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[77], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[78], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[79], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[28], 0x50, 256);
 
     for (int i = 0; i < 8; i++) {
         at24c_eeprom_init(i2c[81 + i * 8], 0x56, 64 * KiB);
-- 
2.39.2

The default boot address of the Aspeed SoCs is 0x0. For this reason,
the FMC flash device contents are remapped by HW on the first 256MB of
the address space. In QEMU, this is currently done in the machine init
with the setup of a region alias.

Move this code to the SoC and introduce an extra container to prepare
ground for the boot ROM region which will overlap the FMC flash
remapping.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 include/hw/arm/aspeed_soc.h |  5 +++++
 hw/arm/aspeed.c             | 13 +------------
 hw/arm/aspeed_ast2600.c     | 13 +++++++++++++
 hw/arm/aspeed_soc.c         | 14 ++++++++++++++
 hw/arm/fby35.c              |  8 +-------
 5 files changed, 34 insertions(+), 19 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCState {
     MemoryRegion *dram_mr;
     MemoryRegion dram_container;
     MemoryRegion sram;
+    MemoryRegion spi_boot_container;
+    MemoryRegion spi_boot;
     AspeedVICState vic;
     AspeedRtcState rtc;
     AspeedTimerCtrlState timerctrl;
@@ -XXX,XX +XXX,XX @@ struct AspeedSoCClass {
 
 
 enum {
+    ASPEED_DEV_SPI_BOOT,
     ASPEED_DEV_IOMEM,
     ASPEED_DEV_UART1,
     ASPEED_DEV_UART2,
@@ -XXX,XX +XXX,XX @@ enum {
     ASPEED_DEV_JTAG1,
 };
 
+#define ASPEED_SOC_SPI_BOOT_ADDR 0x0
+
 qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
 bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp);
 void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr);
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
         MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
         uint64_t size = memory_region_size(&fl->mmio);
 
-        /*
-         * create a ROM region using the default mapping window size of
-         * the flash module. The window size is 64MB for the AST2400
-         * SoC and 128MB for the AST2500 SoC, which is twice as big as
-         * needed by the flash modules of the Aspeed machines.
-         */
-        if (ASPEED_MACHINE(machine)->mmio_exec) {
-            memory_region_init_alias(boot_rom, NULL, "aspeed.boot_rom",
-                                     &fl->mmio, 0, size);
-            memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
-                                        boot_rom);
-        } else {
+        if (!ASPEED_MACHINE(machine)->mmio_exec) {
             memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
                                    size, &error_abort);
             memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_SOC_DPMCU_SIZE       0x00040000
 
 static const hwaddr aspeed_soc_ast2600_memmap[] = {
+    [ASPEED_DEV_SPI_BOOT]  = ASPEED_SOC_SPI_BOOT_ADDR,
     [ASPEED_DEV_SRAM]      = 0x10000000,
     [ASPEED_DEV_DPMCU]     = 0x18000000,
     /* 0x16000000     0x17FFFFFF : AHB BUS do LPC Bus bridge */
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     qemu_irq irq;
     g_autofree char *sram_name = NULL;
 
+    /* Default boot region (SPI memory or ROMs) */
+    memory_region_init(&s->spi_boot_container, OBJECT(s),
+                       "aspeed.spi_boot_container", 0x10000000);
+    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SPI_BOOT],
+                                &s->spi_boot_container);
+
     /* IO space */
     aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
                                   sc->memmap[ASPEED_DEV_IOMEM],
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
 
+    /* Set up an alias on the FMC CE0 region (boot default) */
+    MemoryRegion *fmc0_mmio = &s->fmc.flashes[0].mmio;
+    memory_region_init_alias(&s->spi_boot, OBJECT(s), "aspeed.spi_boot",
+                             fmc0_mmio, 0, memory_region_size(fmc0_mmio));
+    memory_region_add_subregion(&s->spi_boot_container, 0x0, &s->spi_boot);
+
     /* SPI */
     for (i = 0; i < sc->spis_num; i++) {
         object_property_set_link(OBJECT(&s->spi[i]), "dram",
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_SOC_IOMEM_SIZE       0x00200000
 
 static const hwaddr aspeed_soc_ast2400_memmap[] = {
+    [ASPEED_DEV_SPI_BOOT]  =  ASPEED_SOC_SPI_BOOT_ADDR,
     [ASPEED_DEV_IOMEM]  = 0x1E600000,
     [ASPEED_DEV_FMC]    = 0x1E620000,
     [ASPEED_DEV_SPI1]   = 0x1E630000,
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2400_memmap[] = {
 };
 
 static const hwaddr aspeed_soc_ast2500_memmap[] = {
+    [ASPEED_DEV_SPI_BOOT]  = ASPEED_SOC_SPI_BOOT_ADDR,
     [ASPEED_DEV_IOMEM]  = 0x1E600000,
     [ASPEED_DEV_FMC]    = 0x1E620000,
     [ASPEED_DEV_SPI1]   = 0x1E630000,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     Error *err = NULL;
     g_autofree char *sram_name = NULL;
 
+    /* Default boot region (SPI memory or ROMs) */
+    memory_region_init(&s->spi_boot_container, OBJECT(s),
+                       "aspeed.spi_boot_container", 0x10000000);
+    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SPI_BOOT],
+                                &s->spi_boot_container);
+
     /* IO space */
     aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
                                   sc->memmap[ASPEED_DEV_IOMEM],
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
 
+    /* Set up an alias on the FMC CE0 region (boot default) */
+    MemoryRegion *fmc0_mmio = &s->fmc.flashes[0].mmio;
+    memory_region_init_alias(&s->spi_boot, OBJECT(s), "aspeed.spi_boot",
+                             fmc0_mmio, 0, memory_region_size(fmc0_mmio));
+    memory_region_add_subregion(&s->spi_boot_container, 0x0, &s->spi_boot);
+
     /* SPI */
     for (i = 0; i < sc->spis_num; i++) {
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -XXX,XX +XXX,XX @@ static void fby35_bmc_init(Fby35State *s)
         MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
         uint64_t size = memory_region_size(&fl->mmio);
 
-        if (s->mmio_exec) {
-            memory_region_init_alias(boot_rom, NULL, "aspeed.boot_rom",
-                                     &fl->mmio, 0, size);
-            memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
-                                        boot_rom);
-        } else {
-
+        if (!s->mmio_exec) {
             memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
                                    size, &error_abort);
             memory_region_add_subregion(&s->bmc_memory, FBY35_BMC_FIRMWARE_ADDR,
-- 
2.39.2

To avoid the SPI transactions fetching instructions from the FMC CE0
flash device and speed up boot, a ROM can be created if a drive is
available.

Reverse the logic to allow a machine to boot without a drive, using a
block device instead :

-blockdev node-name=fmc0,driver=file,filename=/path/to/flash.img \
    -device mx66u51235f,bus=ssi.0,drive=fmc0

Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c | 47 +++++++++++++++++++++++++++--------------------
 1 file changed, 27 insertions(+), 20 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_reset_secondary(ARMCPU *cpu,
     cpu_set_pc(cs, info->smp_loader_start);
 }
 
-#define FIRMWARE_ADDR 0x0
-
-static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
+static void write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
                            Error **errp)
 {
-    BlockBackend *blk = blk_by_legacy_dinfo(dinfo);
     g_autofree void *storage = NULL;
     int64_t size;
 
@@ -XXX,XX +XXX,XX @@ static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
     rom_add_blob_fixed("aspeed.boot_rom", storage, rom_size, addr);
 }
 
+/*
+ * Create a ROM and copy the flash contents at the expected address
+ * (0x0). Boots faster than execute-in-place.
+ */
+static void aspeed_install_boot_rom(AspeedSoCState *soc, BlockBackend *blk,
+                                    uint64_t rom_size)
+{
+    MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
+
+    memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom", rom_size,
+                           &error_abort);
+    memory_region_add_subregion_overlap(&soc->spi_boot_container, 0,
+                                        boot_rom, 1);
+    write_boot_rom(blk, ASPEED_SOC_SPI_BOOT_ADDR, rom_size, &error_abort);
+}
+
 void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
                                       unsigned int count, int unit0)
 {
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
     AspeedMachineState *bmc = ASPEED_MACHINE(machine);
     AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(machine);
     AspeedSoCClass *sc;
-    DriveInfo *drive0 = drive_get(IF_MTD, 0, 0);
     int i;
     NICInfo *nd = &nd_table[0];
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
                               bmc->spi_model ? bmc->spi_model : amc->spi_model,
                               1, amc->num_cs);
 
-    /* Install first FMC flash content as a boot rom. */
-    if (drive0) {
-        AspeedSMCFlash *fl = &bmc->soc.fmc.flashes[0];
-        MemoryRegion *boot_rom = g_new(MemoryRegion, 1);
-        uint64_t size = memory_region_size(&fl->mmio);
-
-        if (!ASPEED_MACHINE(machine)->mmio_exec) {
-            memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom",
-                                   size, &error_abort);
-            memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
-                                        boot_rom);
-            write_boot_rom(drive0, FIRMWARE_ADDR, size, &error_abort);
-        }
-    }
-
     if (machine->kernel_filename && sc->num_cpus > 1) {
         /* With no u-boot we must set up a boot stub for the secondary CPU */
         MemoryRegion *smpboot = g_new(MemoryRegion, 1);
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)
                            drive_get(IF_SD, 0, bmc->soc.sdhci.num_slots));
     }
 
+    if (!bmc->mmio_exec) {
+        DriveInfo *mtd0 = drive_get(IF_MTD, 0, 0);
+
+        if (mtd0) {
+            uint64_t rom_size = memory_region_size(&bmc->soc.spi_boot);
+            aspeed_install_boot_rom(&bmc->soc, blk_by_legacy_dinfo(mtd0),
+                                    rom_size);
+        }
+    }
+
     arm_load_kernel(ARM_CPU(first_cpu), machine, &aspeed_board_binfo);
 }
 
-- 
2.39.2

It's cleaner and removes the curious '+ 1' required to skip the DMA
IRQ line of the controller.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
 hw/arm/aspeed.c     | 2 +-
 hw/ssi/aspeed_smc.c | 5 +----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
         qdev_realize_and_unref(dev, BUS(s->spi), &error_fatal);
 
         cs_line = qdev_get_gpio_in_named(dev, SSI_GPIO_CS, 0);
-        sysbus_connect_irq(SYS_BUS_DEVICE(s), i + 1, cs_line);
+        qdev_connect_gpio_out_named(DEVICE(s), "cs", i, cs_line);
     }
 }
 
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
 
     /* Setup cs_lines for peripherals */
     s->cs_lines = g_new0(qemu_irq, asc->cs_num_max);
-
-    for (i = 0; i < asc->cs_num_max; ++i) {
-        sysbus_init_irq(sbd, &s->cs_lines[i]);
-    }
+    qdev_init_gpio_out_named(DEVICE(s), s->cs_lines, "cs", asc->cs_num_max);
 
     /* The memory region for the controller registers */
     memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_smc_ops, s,
-- 
2.39.2

The following changes since commit 527dede083d3e3e5a13ee996776926e0a0c4e258:

Merge tag 'pull-request-2025-03-19' of https://gitlab.com/thuth/qemu into staging (2025-03-20 08:41:25 -0400)

are available in the Git repository at:

https://github.com/legoater/qemu/ tags/pull-aspeed-20250323

for you to fetch changes up to 78877b2e06464f49f777e086845e094ea7bc82ef:

hw/misc/aspeed_hace: Fix buffer overflow in has_padding function (2025-03-23 18:42:16 +0100)

----------------------------------------------------------------
aspeed queue:

* Fix AST2700 SoC model

----------------------------------------------------------------
Jamin Lin (1):
      hw/misc/aspeed_hace: Fix buffer overflow in has_padding function

Steven Lee (1):
      hw/intc/aspeed: Fix IRQ handler mask check

Troy Lee (1):
      aspeed: Fix maximum number of spi controller

include/hw/arm/aspeed_soc.h | 2 +-
 hw/intc/aspeed_intc.c       | 2 +-
 hw/misc/aspeed_hace.c       | 5 +++++
 3 files changed, 7 insertions(+), 2 deletions(-)

From: Troy Lee <troy_lee@aspeedtech.com>

Commit 6de4aa8dc544 ("hw/arm/aspeed_ast27x0: Add SoC Support for AST2700
A1") extends ast2700a1 spis_num to 3, but ASPEED_SPIS_NUM defines the
maximum number of spi controller to 2, result in ehci[0] is being
overwritten in runtime.

Signed-off-by: Troy Lee <troy_lee@aspeedtech.com>
Fixes: 6de4aa8dc544 ("hw/arm/aspeed_ast27x0: Add SoC Support for AST2700 A1")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250317065938.1902272-1-troy_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/arm/aspeed_soc.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/char/serial-mm.h"
 #include "hw/intc/arm_gicv3.h"
 
-#define ASPEED_SPIS_NUM  2
+#define ASPEED_SPIS_NUM  3
 #define ASPEED_EHCIS_NUM 2
 #define ASPEED_WDTS_NUM  8
 #define ASPEED_CPUS_NUM  4
-- 
2.49.0

From: Steven Lee <steven_lee@aspeedtech.com>

Updated the IRQ handler mask check to AND with select variable.
This ensures that the interrupt service routine is correctly triggered
for the interrupts within the same irq group.

For example, both `eth0` and the debug UART are handled in `GICINT132`.
Without this fix, the debug console may hang if the `eth0` ISR is not
handled.

Signed-off-by: Steven Lee <steven_lee@aspeedtech.com>
Change-Id: Ic3609eb72218dfd68be6057d78b8953b18828709
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Fixes: d831c5fd8682 ("aspeed/intc: Add AST2700 support")
Link: https://lore.kernel.org/qemu-devel/20250320092543.4040672-2-steven_lee@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/intc/aspeed_intc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/aspeed_intc.c b/hw/intc/aspeed_intc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/aspeed_intc.c
+++ b/hw/intc/aspeed_intc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_intc_set_irq_handler(AspeedINTCState *s,
     outpin_idx = intc_irq->outpin_idx;
     inpin_idx = intc_irq->inpin_idx;
 
-    if (s->mask[inpin_idx] || s->regs[status_reg]) {
+    if ((s->mask[inpin_idx] & select) || (s->regs[status_reg] & select)) {
         /*
          * a. mask is not 0 means in ISR mode
          * sources interrupt routine are executing.
-- 
2.49.0

From: Jamin Lin <jamin_lin@aspeedtech.com>

The maximum padding size is either 64 or 128 bytes and should always be smaller
than "req_len". If "padding_size" exceeds "req_len", then
"req_len - padding_size" underflows due to "uint32_t" data type, leading to a
large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory
access, potentially leading to a buffer overflow.

Added a check to ensure "padding_size" does not exceed "req_len" before
computing "pad_offset". This prevents "req_len - padding_size" from underflowing
and avoids accessing invalid memory.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600 HACE ")
Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -XXX,XX +XXX,XX @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
     if (*total_msg_len <= s->total_req_len) {
         uint32_t padding_size = s->total_req_len - *total_msg_len;
         uint8_t *padding = iov->iov_base;
+
+        if (padding_size > req_len) {
+            return false;
+        }
+
         *pad_offset = req_len - padding_size;
         if (padding[*pad_offset] == 0x80) {
             return true;
-- 
2.49.0