From nobody Sat May 30 17:44:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778606100; cv=none; d=zohomail.com; s=zohoarc; b=JvArNf2nOcxtz/px4V9eiFBHYATAsFbl7p+SiFHSyaujvKBBwN0Xc2I92Nkmx6GEtI3WKuBroptfRjvtkO3Z1JXZHCEofym+hosxREKZKqaVHmH8wjaeTHhmOeTtIKEm9eXvQb6DO4d17xfMACgZ8cGOV/FIzJVyfaBem4N7Lfw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778606100; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=4nnQ+167Es5iiTjdWMQe264cnGv+oMNfn1MihRhaMM0=; b=aLRhKG9t3VpAHG6MxUry7t1A12QAyuojWWBg3rP9MV+XFzWF0v5cYyIRtrf8QgxEGUpX9i3F23SDIin6gPq5ABU9GnVY3bGDe6uzJH9wAmBX9p+Rs25VJBGsLaEwgvPPgAFZA6dk2ch9ix2D3PZw2riw6kwgw3PqCkzRgRpaFks= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 177860610095915.315927127281043; Tue, 12 May 2026 10:15:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wMqgl-0006p6-U3; Tue, 12 May 2026 13:14:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgK-0006lw-8N for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:09 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgI-0000Wg-Lm for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:08 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-206--ugWvLIzOJCtJchfoYN8rg-1; Tue, 12 May 2026 13:14:02 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DB92F18002DC; Tue, 12 May 2026 17:14:00 +0000 (UTC) Received: from corto.redhat.com (unknown [10.44.49.156]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id C2BB01955D84; Tue, 12 May 2026 17:13:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778606046; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4nnQ+167Es5iiTjdWMQe264cnGv+oMNfn1MihRhaMM0=; b=IFjDKFSAliX8ImfQTdG0OjlnmGgga0Mm8v+Q3lwr0x7Mq+TH0vrZaIrb29K/ownz6kXWSS QG+fIJv1NfAs6VS3fmmtFB2NTWpOa/+Lrk5MKJe7UxMbKRplS5arpFScCgiVosN51L8nj/ YY/nvwCtAeVFkI/1mrwPDnkl0Bu/znE= X-MC-Unique: -ugWvLIzOJCtJchfoYN8rg-1 X-Mimecast-MFC-AGG-ID: -ugWvLIzOJCtJchfoYN8rg_1778606041 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Cc: Kane Chen , qemu-stable@nongnu.org, Peter Maydell , =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= Subject: [PULL 1/9] hw/misc/aspeed_sbc: Add bounds checking for OTP write operations Date: Tue, 12 May 2026 19:13:46 +0200 Message-ID: <20260512171354.4183887-2-clg@redhat.com> In-Reply-To: <20260512171354.4183887-1-clg@redhat.com> References: <20260512171354.4183887-1-clg@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=clg@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778606102391158501 From: Kane Chen There is a mismatch between the Aspeed OTP model and the Aspeed SBC model in how the guest-provided address is handled. aspeed_sbc_otp_prog() passes a word-indexed address directly to address_space_write() without converting it to a byte offset, whereas aspeed_otp_write() expects a byte offset and applies an additional shift (otp_addr << 2). This double-shift confusion means that an out-of-range word address can lead to a write beyond the allocated storage. Fix this by adding bounds checking on the word offset before converting to byte offset and passing to address_space_write(). This matches the existing bounds check in aspeed_sbc_otp_read(). Cc: Kane-Chen-AS Cc: qemu-stable@nongnu.org Fixes: 1a00754ccf15 ("hw/misc: Add Aspeed Secure Boot Controller model") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3436 Reported-by: Peter Maydell Signed-off-by: Kane-Chen-AS Reviewed-by: Peter Maydell Link: https://lore.kernel.org/qemu-devel/20260428055254.76581-2-kane_chen@a= speedtech.com [ clg: Kept otp_addr in event logged in aspeed_sbc_otp_prog() ] Signed-off-by: C=C3=A9dric Le Goater --- hw/misc/aspeed_sbc.c | 12 ++++++++++-- hw/nvram/aspeed_otp.c | 13 ++++++------- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c index 065e822e70d9..e5dab1c7bb7c 100644 --- a/hw/misc/aspeed_sbc.c +++ b/hw/misc/aspeed_sbc.c @@ -159,9 +159,17 @@ static bool aspeed_sbc_otp_prog(AspeedSBCState *s, MemTxResult ret; AspeedOTPState *otp =3D &s->otp; uint32_t value =3D s->regs[R_CAMP1]; + uint32_t otp_offset =3D otp_addr << 2; =20 - ret =3D address_space_write(&otp->as, otp_addr, MEMTXATTRS_UNSPECIFIED, - &value, sizeof(value)); + if (otp_addr >=3D OTP_TOTAL_DWORD_COUNT) { + qemu_log_mask(LOG_GUEST_ERROR, + "Invalid OTP addr 0x%x\n", + otp_addr); + return false; + } + + ret =3D address_space_write(&otp->as, otp_offset, MEMTXATTRS_UNSPECIFI= ED, + &value, sizeof(value)); if (ret !=3D MEMTX_OK) { qemu_log_mask(LOG_GUEST_ERROR, "Failed to write OTP memory, addr =3D %x\n", diff --git a/hw/nvram/aspeed_otp.c b/hw/nvram/aspeed_otp.c index a60289000c37..1a9d3841b8d6 100644 --- a/hw/nvram/aspeed_otp.c +++ b/hw/nvram/aspeed_otp.c @@ -57,12 +57,12 @@ static bool valid_program_data(uint32_t otp_addr, return has_programmable_bits !=3D 0; } =20 -static bool program_otpmem_data(void *opaque, uint32_t otp_addr, +static bool program_otpmem_data(void *opaque, hwaddr otp_offset, uint32_t prog_bit, uint32_t *value) { AspeedOTPState *s =3D opaque; + uint32_t otp_addr =3D otp_offset >> 2; bool is_odd =3D otp_addr & 1; - uint32_t otp_offset =3D otp_addr << 2; =20 memcpy(value, s->storage + otp_offset, sizeof(uint32_t)); =20 @@ -79,26 +79,25 @@ static bool program_otpmem_data(void *opaque, uint32_t = otp_addr, return true; } =20 -static void aspeed_otp_write(void *opaque, hwaddr otp_addr, +static void aspeed_otp_write(void *opaque, hwaddr otp_offset, uint64_t val, unsigned size) { AspeedOTPState *s =3D opaque; - uint32_t otp_offset, value; + uint32_t value; =20 - if (!program_otpmem_data(s, otp_addr, val, &value)) { + if (!program_otpmem_data(s, otp_offset, val, &value)) { qemu_log_mask(LOG_GUEST_ERROR, "%s: Failed to program data, value =3D %x, bit =3D %= "PRIx64"\n", __func__, value, val); return; } =20 - otp_offset =3D otp_addr << 2; memcpy(s->storage + otp_offset, &value, size); =20 if (s->blk) { if (blk_pwrite(s->blk, otp_offset, size, &value, 0) < 0) { qemu_log_mask(LOG_GUEST_ERROR, - "%s: Failed to write %x to %x\n", + "%s: Failed to write %x to %"HWADDR_PRIx"\n", __func__, value, otp_offset); =20 return; --=20 2.54.0 From nobody Sat May 30 17:44:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778606139; cv=none; d=zohomail.com; s=zohoarc; b=RQNYxFCY0OxuurMwem9KWfit2yXEmgFR0RUHrR8DI5opd8+BlhvsgMH6rubQQKwWXqvscMXWwRusd7ZtBceu/NZlC/EP7ra7908eI5u6O9E3ZaKXXypSZRZD8TRtUmw+oH218lQA+dunA9XWvA8qKmnoBw26qsa8CsfeeKlWR74= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778606139; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=3FECxusx0MidqsN3aGBxWxbLHCe132kVJIBHB1EIJRo=; b=SiX0j5zDqGGrjibMzfLL6Xf+8X8uPMV8lnK0L9Z43b8JA8IdrN0LrYMCMEa5LhnCq04xkLhmNFtXL5seROaotHz1I873qOhywyaJqf6PuloJulGV7g3+3RDZw7q6Z51A4dUq9VqM1vwhARlKdYbQop9ONfhevycVlrya7ZM5sAQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17786061389921010.148688254853; Tue, 12 May 2026 10:15:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wMqhK-00074c-Al; Tue, 12 May 2026 13:15:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgV-0006n4-LX for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:22 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgO-0000iU-Q9 for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:18 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-380-U5y6EH8COVCzYpVljo2dUQ-1; Tue, 12 May 2026 13:14:04 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 4754118005BA; Tue, 12 May 2026 17:14:03 +0000 (UTC) Received: from corto.redhat.com (unknown [10.44.49.156]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 871681944B27; Tue, 12 May 2026 17:14:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778606050; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3FECxusx0MidqsN3aGBxWxbLHCe132kVJIBHB1EIJRo=; b=Sfc38mTZtd2ODpeYi4BIIh5N6uBAG9gOA49cF2fDVAHxM82B6acxnSqY9D31AHGtm1AhOL cWJkoXnD8U+Xve4TY4+xlxlZhj7ZKF3+dSQwAkQL3RxKzee4s/WWR8jowndcdkNog3jTxU c/g7nWfJRQq/LVxQLF5Kj8a2YK1F6cE= X-MC-Unique: U5y6EH8COVCzYpVljo2dUQ-1 X-Mimecast-MFC-AGG-ID: U5y6EH8COVCzYpVljo2dUQ_1778606043 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Cc: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= , Katherine Leaver , qemu-stable@nongnu.org Subject: [PULL 2/9] aspeed/hace: Fix out-of-bounds read in has_padding() Date: Tue, 12 May 2026 19:13:47 +0200 Message-ID: <20260512171354.4183887-3-clg@redhat.com> In-Reply-To: <20260512171354.4183887-1-clg@redhat.com> References: <20260512171354.4183887-1-clg@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=clg@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778606140936154100 The has_padding() function reads the last 8 bytes of a DMA buffer without validating req_len. req_len is guest-controlled (via R_HASH_SRC_LEN register or scatter-gather entries) and values less than 8 cause integer underflow. This can result in an out-of-bounds read of QEMU process memory. Add a check to ensure req_len >=3D 8 before accessing the buffer. Reported-by: Katherine Leaver Cc: qemu-stable@nongnu.org Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE") Link: https://lore.kernel.org/qemu-devel/20260504213421.710035-2-clg@redhat= .com Signed-off-by: C=C3=A9dric Le Goater --- hw/misc/aspeed_hace.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index 23e8030cd966..ef698b3ecb72 100644 --- a/hw/misc/aspeed_hace.c +++ b/hw/misc/aspeed_hace.c @@ -154,6 +154,14 @@ static bool has_padding(AspeedHACEState *s, struct iov= ec *iov, hwaddr req_len, uint32_t *total_msg_len, uint32_t *pad_offset) { + /* Need at least 8 bytes to read the total message length field */ + if (req_len < 8) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: invalid request length=3D0x%" HWADDR_PRIx "\n", + __func__, req_len); + return false; + } + *total_msg_len =3D (uint32_t)(ldq_be_p(iov->iov_base + req_len - 8) / = 8); /* * SG_LIST_LEN_LAST asserted in the request length doesn't mean it is = the --=20 2.54.0 From nobody Sat May 30 17:44:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778606160; cv=none; d=zohomail.com; s=zohoarc; b=bAavRJhLXTBPb9t4mt9HTJKT8z8fyKq8KgnzYDHez+oeRpG9Eytx0L9iOzzlxwGui0XppYYnbYy3fixejA3KlrAGe5OBf9U8kjtM+NhsJ6hvECacimNI9LNpI2RjAXfJZ0ceHlpXp8ciRHClayzm+Og04kDttzkOCqn14fztAoE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778606160; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=U687+bHItKB6v7ipuiaJlcNS8f/FJaPS/VGSRgaHYXI=; b=goSCLbLKvTPlBGl7/CtrMxLVnYNVL+qvIg6hbVhWrUD6LRBuF4c7YzLkN8qquYi/RyJiR5G2znomHNlJXETdXFNA/lxbSn5B1OW/2IAHDBw9MpJ6IP4PvnoEDKmWL1p6JyHYb7EioNwOfLWXfwGpiE65J8PlQLLjjIjESuFF0m4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1778606160494332.6277434748673; Tue, 12 May 2026 10:16:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wMqhh-0007Q3-KM; Tue, 12 May 2026 13:15:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgb-0006nd-9Y for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:27 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgS-0000kY-41 for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:19 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-504-7Ogyz3SyO4-lX8vQmkcZzQ-1; Tue, 12 May 2026 13:14:07 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id ACAE81955D75; Tue, 12 May 2026 17:14:05 +0000 (UTC) Received: from corto.redhat.com (unknown [10.44.49.156]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id ED6051944B22; Tue, 12 May 2026 17:14:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778606051; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=U687+bHItKB6v7ipuiaJlcNS8f/FJaPS/VGSRgaHYXI=; b=O5bMevWsOS8FV4LCM8kizX2x8DKaamuEfq45mpu4hUzWDALUbOtMrIKV7U67IlNe6Rz2tQ xHujUXFvNWdetedP0Qdwx/rE8TK14NC76GHA48wkU2mUO52AEz6vT7qZgFXwpL91KeptNO WKjd4J9sHMT3NhbaEBd9VaTlckA2Y4w= X-MC-Unique: 7Ogyz3SyO4-lX8vQmkcZzQ-1 X-Mimecast-MFC-AGG-ID: 7Ogyz3SyO4-lX8vQmkcZzQ_1778606045 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Cc: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= , Katherine Leaver , qemu-stable@nongnu.org Subject: [PULL 3/9] aspeed/hace: Prevent total_req_len overflow Date: Tue, 12 May 2026 19:13:48 +0200 Message-ID: <20260512171354.4183887-4-clg@redhat.com> In-Reply-To: <20260512171354.4183887-1-clg@redhat.com> References: <20260512171354.4183887-1-clg@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=clg@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778606160831158500 In accumulate mode, total_req_len is incremented with plen (hwaddr) for each hash request. Repeated additions can overflow total_req_len (uint32_t) and potentially bypass validation checks in has_padding(). Add a helper function to detect overflow before incrementing total_req_len and reject the request if overflow would occur. Reported-by: Katherine Leaver Cc: qemu-stable@nongnu.org Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE") Link: https://lore.kernel.org/qemu-devel/20260504213421.710035-3-clg@redhat= .com Signed-off-by: C=C3=A9dric Le Goater --- hw/misc/aspeed_hace.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index ef698b3ecb72..0504d61cbf0a 100644 --- a/hw/misc/aspeed_hace.c +++ b/hw/misc/aspeed_hace.c @@ -205,6 +205,19 @@ static uint64_t hash_get_source_addr(AspeedHACEState *= s) return src_addr; } =20 +static bool hash_accumulate_len(AspeedHACEState *s, hwaddr plen) +{ + if (plen > UINT32_MAX - s->total_req_len) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: total_req_len overflow, current=3D0x%x, adding= =3D0x%" + HWADDR_PRIx "\n", __func__, s->total_req_len, plen); + return false; + } + + s->total_req_len +=3D plen; + return true; +} + static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov, bool acc_mode, bool *acc_final_request) { @@ -232,7 +245,9 @@ static int hash_prepare_direct_iov(AspeedHACEState *s, = struct iovec *iov, iov_idx =3D 1; =20 if (acc_mode) { - s->total_req_len +=3D plen; + if (!hash_accumulate_len(s, plen)) { + return -1; + } =20 if (has_padding(s, &iov[0], plen, &total_msg_len, &pad_offset)) { @@ -299,7 +314,9 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, stru= ct iovec *iov, =20 iov[iov_idx].iov_base =3D haddr; if (acc_mode) { - s->total_req_len +=3D plen; + if (!hash_accumulate_len(s, plen)) { + return -1; + } =20 if (has_padding(s, &iov[iov_idx], plen, &total_msg_len, &pad_offset)) { --=20 2.54.0 From nobody Sat May 30 17:44:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778606153; cv=none; d=zohomail.com; s=zohoarc; b=KpTImvaPqDOA0GhFjP/8lYZVIce7IrSwOVyOc2nD5sYeBrUoiYjvZ8z+EcwRTV91enWiCkSnETuxyNipAVlbME6MIb4ywlup7koh1jBPhdKyh/NieQRt8RDHq4ajThEK956wN0HcD4o/gamnkZnKTZQ/UU+SxSnEfxEm6DAl/tE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778606153; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=jmYeEfhR+gNeyUlbslHqcOhionCHuWh/odLQyvFxQhk=; b=POvT7xpLL8gQ2TMi2Gwk5GQDL+8cLNGsMY34tDlpVBBBIpbEPemaP2ePUx6yEu7sKIRsWY99IYoXtZm1sbZmfoASLjpATeQOW8VfWON+jL810svFvMRgDUtgD+3NX2LK6bdN+NFrSbB1e4732fDLcjb+IdgsETCpUuzfMAdz2yU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 177860615320785.90138108073211; Tue, 12 May 2026 10:15:53 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wMqhk-0007fc-SH; Tue, 12 May 2026 13:15:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgb-0006ne-9n for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:27 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgS-0000td-4n for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:20 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-241-KxzuKOpyO8-8h3tPkRtxWg-1; Tue, 12 May 2026 13:14:09 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 3E07B180061E; Tue, 12 May 2026 17:14:08 +0000 (UTC) Received: from corto.redhat.com (unknown [10.44.49.156]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 2B10B1953947; Tue, 12 May 2026 17:14:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778606052; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jmYeEfhR+gNeyUlbslHqcOhionCHuWh/odLQyvFxQhk=; b=ZR/ZEMrSvBOn+chnPeaydM1kiFOyNmlz2U4VmU9N5ErHybE35gSYCXnNnXE3sZl7VLccnR 8pQmMp2V7iICnzoLDH6qQjCIiN6PI8fKkWhM1d0Lv3wpAh62ZpyDLGGt5zn4pO9nwmFxM8 HBfRkrIBm5/ZANUKqgXyGy36BwUC7vM= X-MC-Unique: KxzuKOpyO8-8h3tPkRtxWg-1 X-Mimecast-MFC-AGG-ID: KxzuKOpyO8-8h3tPkRtxWg_1778606048 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Cc: Kane Chen , Jamin Lin , =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= Subject: [PULL 4/9] aspeed/hace: Fix mapped address may not be unmapped issue Date: Tue, 12 May 2026 19:13:49 +0200 Message-ID: <20260512171354.4183887-5-clg@redhat.com> In-Reply-To: <20260512171354.4183887-1-clg@redhat.com> References: <20260512171354.4183887-1-clg@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=clg@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778606155178154100 From: Kane Chen In the do_hash_operation, the code may be returned earlier because hash_prepare_sg_iov or hash_prepare_direct_iov may return a failure. When this condition is happened, current code flow doesn't go through later code segments. Finally, it causes the mapped address isn't unmapped properly. This change unmaps any mapped addresses when an error occurs, preventing a resource leak. Signed-off-by: Kane-Chen-AS Reviewed-by: Jamin Lin Link: https://lore.kernel.org/qemu-devel/20260512065002.1516704-2-kane_chen= @aspeedtech.com Signed-off-by: C=C3=A9dric Le Goater --- hw/misc/aspeed_hace.c | 63 ++++++++++++++++++++++++++++++------------- 1 file changed, 45 insertions(+), 18 deletions(-) diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index 0504d61cbf0a..a322905cb37b 100644 --- a/hw/misc/aspeed_hace.c +++ b/hw/misc/aspeed_hace.c @@ -218,8 +218,19 @@ static bool hash_accumulate_len(AspeedHACEState *s, hw= addr plen) return true; } =20 +static void hash_iov_unmap(AspeedHACEState *s, struct iovec *iov, + hwaddr *mapped_lens, int iov_count) +{ + for (; iov_count > 0; iov_count--) { + address_space_unmap(&s->dram_as, iov[iov_count - 1].iov_base, + mapped_lens[iov_count - 1], false, + mapped_lens[iov_count - 1]); + } +} + static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov, - bool acc_mode, bool *acc_final_request) + bool acc_mode, bool *acc_final_request, + hwaddr *mapped_lens) { uint32_t total_msg_len; uint32_t pad_offset; @@ -243,9 +254,11 @@ static int hash_prepare_direct_iov(AspeedHACEState *s,= struct iovec *iov, =20 iov[0].iov_base =3D haddr; iov_idx =3D 1; + mapped_lens[0] =3D plen; =20 if (acc_mode) { if (!hash_accumulate_len(s, plen)) { + hash_iov_unmap(s, iov, mapped_lens, 1); return -1; } =20 @@ -265,7 +278,8 @@ static int hash_prepare_direct_iov(AspeedHACEState *s, = struct iovec *iov, } =20 static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov, - bool acc_mode, bool *acc_final_request) + bool acc_mode, bool *acc_final_request, + hwaddr *mapped_lens) { uint32_t total_msg_len; uint32_t pad_offset; @@ -275,6 +289,7 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, stru= ct iovec *iov, int iov_idx; hwaddr plen; void *haddr; + int iov_mapped =3D 0; =20 src =3D hash_get_source_addr(s); for (iov_idx =3D 0; !(len & SG_LIST_LEN_LAST); iov_idx++) { @@ -282,7 +297,7 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, stru= ct iovec *iov, qemu_log_mask(LOG_GUEST_ERROR, "%s: Failed to set end of sg list marker\n", __func__); - return -1; + goto fail; } =20 len =3D address_space_ldl_le(&s->dram_as, src, @@ -307,15 +322,17 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, st= ruct iovec *iov, "%s: Unable to map address, sg_addr=3D0x%x, " "plen=3D0x%" HWADDR_PRIx "\n", __func__, sg_addr, plen); - return -1; + goto fail; } =20 src +=3D SG_LIST_ENTRY_SIZE; =20 iov[iov_idx].iov_base =3D haddr; + iov_mapped =3D iov_idx + 1; + mapped_lens[iov_idx] =3D plen; if (acc_mode) { if (!hash_accumulate_len(s, plen)) { - return -1; + goto fail; } =20 if (has_padding(s, &iov[iov_idx], plen, &total_msg_len, @@ -332,6 +349,10 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, str= uct iovec *iov, } =20 return iov_idx; + +fail: + hash_iov_unmap(s, iov, mapped_lens, iov_mapped); + return -1; } =20 static uint64_t hash_get_digest_addr(AspeedHACEState *s) @@ -350,6 +371,7 @@ static uint64_t hash_get_digest_addr(AspeedHACEState *s) static void hash_write_digest_and_unmap_iov(AspeedHACEState *s, struct iovec *iov, int iov_idx, + hwaddr *mapped_lens, uint8_t *digest_buf, size_t digest_len) { @@ -369,15 +391,12 @@ static void hash_write_digest_and_unmap_iov(AspeedHAC= EState *s, hace_hexdump("digest", (char *)digest_buf, digest_len); } =20 - for (; iov_idx > 0; iov_idx--) { - address_space_unmap(&s->dram_as, iov[iov_idx - 1].iov_base, - iov[iov_idx - 1].iov_len, false, - iov[iov_idx - 1].iov_len); - } + hash_iov_unmap(s, iov, mapped_lens, iov_idx); } =20 static void hash_execute_non_acc_mode(AspeedHACEState *s, int algo, - struct iovec *iov, int iov_idx) + struct iovec *iov, int iov_idx, + hwaddr *mapped_lens) { g_autofree uint8_t *digest_buf =3D NULL; Error *local_err =3D NULL; @@ -389,15 +408,17 @@ static void hash_execute_non_acc_mode(AspeedHACEState= *s, int algo, "%s: qcrypto hash bytesv failed : %s", __func__, error_get_pretty(local_err)); error_free(local_err); + hash_iov_unmap(s, iov, mapped_lens, iov_idx); return; } =20 - hash_write_digest_and_unmap_iov(s, iov, iov_idx, digest_buf, digest_le= n); + hash_write_digest_and_unmap_iov(s, iov, iov_idx, mapped_lens, + digest_buf, digest_len); } =20 static void hash_execute_acc_mode(AspeedHACEState *s, int algo, struct iovec *iov, int iov_idx, - bool final_request) + bool final_request, hwaddr *mapped_lens) { g_autofree uint8_t *digest_buf =3D NULL; Error *local_err =3D NULL; @@ -411,6 +432,7 @@ static void hash_execute_acc_mode(AspeedHACEState *s, i= nt algo, qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto hash new failed : = %s", __func__, error_get_pretty(local_err)); error_free(local_err); + hash_iov_unmap(s, iov, mapped_lens, iov_idx); return; } } @@ -419,6 +441,7 @@ static void hash_execute_acc_mode(AspeedHACEState *s, i= nt algo, qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto hash updatev failed : = %s", __func__, error_get_pretty(local_err)); error_free(local_err); + hash_iov_unmap(s, iov, mapped_lens, iov_idx); return; } =20 @@ -438,22 +461,25 @@ static void hash_execute_acc_mode(AspeedHACEState *s,= int algo, s->total_req_len =3D 0; } =20 - hash_write_digest_and_unmap_iov(s, iov, iov_idx, digest_buf, digest_le= n); + hash_write_digest_and_unmap_iov(s, iov, iov_idx, mapped_lens, + digest_buf, digest_len); } =20 static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode, bool acc_mode) { QEMU_UNINITIALIZED struct iovec iov[ASPEED_HACE_MAX_SG]; + hwaddr mapped_lens[ASPEED_HACE_MAX_SG] =3D { 0 }; bool acc_final_request =3D false; int iov_idx =3D -1; =20 /* Prepares the iov for hashing operations based on the selected mode = */ if (sg_mode) { - iov_idx =3D hash_prepare_sg_iov(s, iov, acc_mode, &acc_final_reque= st); + iov_idx =3D hash_prepare_sg_iov(s, iov, acc_mode, &acc_final_reque= st, + mapped_lens); } else { iov_idx =3D hash_prepare_direct_iov(s, iov, acc_mode, - &acc_final_request); + &acc_final_request, mapped_lens); } =20 if (iov_idx <=3D 0) { @@ -468,9 +494,10 @@ static void do_hash_operation(AspeedHACEState *s, int = algo, bool sg_mode, =20 /* Executes the hash operation */ if (acc_mode) { - hash_execute_acc_mode(s, algo, iov, iov_idx, acc_final_request); + hash_execute_acc_mode(s, algo, iov, iov_idx, acc_final_request, + mapped_lens); } else { - hash_execute_non_acc_mode(s, algo, iov, iov_idx); + hash_execute_non_acc_mode(s, algo, iov, iov_idx, mapped_lens); } } =20 --=20 2.54.0 From nobody Sat May 30 17:44:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778606166; cv=none; d=zohomail.com; s=zohoarc; b=KAjbgtg0aPHHsVP06ElSpjUvwun8dNkkxU56emw+fKW3YzUz/ZOLz2EM6DOYdieh8NPpuVvfrExE/OcuUmjDwUEgwVuDOW8K5PEueZ51Q28tdkyEXiMY77Z2juFPB6YKCYDxUjJB6sSMEpdGYWu30wVlJ7LIHBXJ9eHMRhFhIJk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778606166; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=qIWlUGQItg/GXf15TcEdgeYx061cCYRWPjXLhRieIw0=; b=aHSfg62Kssqg3dUrFmEQMTu6tBUTVJGI9aMljUyAGkyIwiIGiyYEe6deHMTzIg0SItblH/X0n4xi8pGoffOQ24cFBjkVQwunjBFtezXkFYN/R8EtQie7zg6JBcbEaSrYPZS/4qwsnN1DrFw3ZgNwtrcyL9EreMlKLz6JwNAUcaw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1778606166570925.2932463095597; Tue, 12 May 2026 10:16:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wMqhl-0007oz-KX; Tue, 12 May 2026 13:15:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgb-0006nf-9q for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:27 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgS-0000vC-4t for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:20 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-413-BvQoL9OYMcqVV3CmVKWaTg-1; Tue, 12 May 2026 13:14:11 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 38ECF180062E; Tue, 12 May 2026 17:14:10 +0000 (UTC) Received: from corto.redhat.com (unknown [10.44.49.156]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id AF93A1953947; Tue, 12 May 2026 17:14:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778606053; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=qIWlUGQItg/GXf15TcEdgeYx061cCYRWPjXLhRieIw0=; b=LOpR+U1g1MdTOtpxEBVie++nUuWnzzUeaq2O3n4/E0tosDjLfTz7D6k9YlBoyPQ6+oSbiN lnHdSYk1/qMi4kueF6d/+v4LVcPxVVV7JZZf2fGqJP8FedCmeAOJ2RHvN12uN2Agjsi5Bs DzlLakF5m9lUUSHkZi9RgpsRa1la4SU= X-MC-Unique: BvQoL9OYMcqVV3CmVKWaTg-1 X-Mimecast-MFC-AGG-ID: BvQoL9OYMcqVV3CmVKWaTg_1778606050 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Cc: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [PULL 5/9] hw/arm: Remove sonorapass-bmc machine Date: Tue, 12 May 2026 19:13:50 +0200 Message-ID: <20260512171354.4183887-6-clg@redhat.com> In-Reply-To: <20260512171354.4183887-1-clg@redhat.com> References: <20260512171354.4183887-1-clg@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=clg@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778606167002158500 The sonorapass-bmc machine was deprecated in QEMU 10.2 and is now removed in QEMU 11.1. This OCP SonoraPass BMC lab server never entered production and can be replaced by the ast2500-evb machine with appropriate fmc-model and I2C device configuration via command line. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Link: https://lore.kernel.org/qemu-devel/20260510165704.2935316-2-clg@redha= t.com Signed-off-by: C=C3=A9dric Le Goater --- docs/about/deprecated.rst | 9 --- docs/about/removed-features.rst | 10 ++- docs/system/arm/aspeed.rst | 5 +- hw/arm/aspeed_ast2500_sonorapass.c | 102 ----------------------------- hw/arm/meson.build | 1 - 5 files changed, 11 insertions(+), 116 deletions(-) delete mode 100644 hw/arm/aspeed_ast2500_sonorapass.c diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 5551bd12ad83..cc75afe55d95 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -250,15 +250,6 @@ deprecated; use the new name ``dtb-randomness`` instea= d. The new name better reflects the way this property affects all random data within the device tree blob, not just the ``kaslr-seed`` node. =20 -Arm ``sonorapass-bmc`` machine (since 10.2) -''''''''''''''''''''''''''''''''''''''''''' - -The ``sonorapass-bmc`` machine represents a lab server that never -entered production. Since it does not rely on any specific device -models, it can be replaced by the ``ast2500-evb`` machine using the -``fmc-model`` option to specify the flash type. The I2C devices -connected to the board can be defined via the QEMU command line. - Arm ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` machine (since 10.2) ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' =20 diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.= rst index 626162022a8c..02e3c06b2988 100644 --- a/docs/about/removed-features.rst +++ b/docs/about/removed-features.rst @@ -1112,7 +1112,7 @@ This machine was removed because it was unused. Alter= native AST2500 based OpenPOWER machines are ``witherspoon-bmc`` and ``romulus-bmc``. =20 ppc ``taihu`` machine (removed in 7.2) -''''''''''''''''''''''''''''''''''''''''''''' +'''''''''''''''''''''''''''''''''''''' =20 This machine was removed because it was partially emulated and 405 machines are very similar. Use the ``ref405ep`` machine instead. @@ -1186,6 +1186,14 @@ Arm ``highbank`` and ``midway`` machines (removed in= 11.0) There were no known users left for these machines. If you just want to boot a Cortex-A15 or Cortex-A9 Linux, use the ``virt`` machine instead. =20 +Arm ``sonorapass-bmc`` machine (removed in 11.1) +'''''''''''''''''''''''''''''''''''''''''''''''' + +The ``sonorapass-bmc`` machine represents a lab server that never +entered production. It can be replaced by the ``ast2500-evb`` machine +using the ``fmc-model`` option to specify the flash type. The I2C +devices connected to the board can be defined via the QEMU command +line. =20 linux-user mode CPUs -------------------- diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst index d0054a7dbb88..1871f31713d4 100644 --- a/docs/system/arm/aspeed.rst +++ b/docs/system/arm/aspeed.rst @@ -1,5 +1,5 @@ -Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``,= ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-b= mc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``qu= anta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``su= permicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspo= on-bmc``, ``yosemitev2-bmc``) -=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D +Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``,= ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-b= mc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``qu= anta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``supermicrox11-bmc``, `= `supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemite= v2-bmc``) +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D =20 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and Aspeed evaluation boards. They are based on different releases of the @@ -22,7 +22,6 @@ AST2500 SoC based machines : - ``ast2500-evb`` Aspeed AST2500 Evaluation board - ``romulus-bmc`` OpenPOWER Romulus POWER9 BMC - ``witherspoon-bmc`` OpenPOWER Witherspoon POWER9 BMC -- ``sonorapass-bmc`` OCP SonoraPass BMC - ``fp5280g2-bmc`` Inspur FP5280G2 BMC - ``g220a-bmc`` Bytedance G220A BMC - ``yosemitev2-bmc`` Facebook YosemiteV2 BMC diff --git a/hw/arm/aspeed_ast2500_sonorapass.c b/hw/arm/aspeed_ast2500_son= orapass.c deleted file mode 100644 index 84de4f56b376..000000000000 --- a/hw/arm/aspeed_ast2500_sonorapass.c +++ /dev/null @@ -1,102 +0,0 @@ -/* - * OCP SonoraPass - * - * Copyright 2016 IBM Corp. - * - * SPDX-License-Identifier: GPL-2.0-or-later - */ - -#include "qemu/osdep.h" -#include "qapi/error.h" -#include "hw/arm/machines-qom.h" -#include "hw/arm/aspeed.h" -#include "hw/arm/aspeed_soc.h" -#include "hw/i2c/smbus_eeprom.h" - -/* Sonorapass hardware value: 0xF100D216 */ -#define SONORAPASS_BMC_HW_STRAP1 ( \ - SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE | \ - SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE | \ - SCU_AST2500_HW_STRAP_UART_DEBUG | \ - SCU_AST2500_HW_STRAP_RESERVED28 | \ - SCU_AST2500_HW_STRAP_DDR4_ENABLE | \ - SCU_HW_STRAP_VGA_CLASS_CODE | \ - SCU_HW_STRAP_LPC_RESET_PIN | \ - SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER) | \ - SCU_AST2500_HW_STRAP_SET_AXI_AHB_RATIO(AXI_AHB_RATIO_2_1) | \ - SCU_HW_STRAP_VGA_BIOS_ROM | \ - SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) | \ - SCU_AST2500_HW_STRAP_RESERVED1) - -static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc) -{ - AspeedSoCState *soc =3D bmc->soc; - - /* bus 2 : */ - i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "tmp105", 0x= 48); - i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "tmp105", 0x= 49); - /* bus 2 : pca9546 @ 0x73 */ - - /* bus 3 : pca9548 @ 0x70 */ - - /* bus 4 : */ - uint8_t *eeprom4_54 =3D g_malloc0(8 * 1024); - smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54, - eeprom4_54); - /* PCA9539 @ 0x76, but PCA9552 is compatible */ - aspeed_create_pca9552(soc, 4, 0x76); - /* PCA9539 @ 0x77, but PCA9552 is compatible */ - aspeed_create_pca9552(soc, 4, 0x77); - - /* bus 6 : */ - i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp105", 0x= 48); - i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp105", 0x= 49); - /* bus 6 : pca9546 @ 0x73 */ - - /* bus 8 : */ - uint8_t *eeprom8_56 =3D g_malloc0(8 * 1024); - smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 8), 0x56, - eeprom8_56); - aspeed_create_pca9552(soc, 8, 0x60); - aspeed_create_pca9552(soc, 8, 0x61); - /* bus 8 : adc128d818 @ 0x1d */ - /* bus 8 : adc128d818 @ 0x1f */ - - /* - * bus 13 : pca9548 @ 0x71 - * - channel 3: - * - tmm421 @ 0x4c - * - tmp421 @ 0x4e - * - tmp421 @ 0x4f - */ - -} - -static void aspeed_machine_sonorapass_class_init(ObjectClass *oc, - const void *data) -{ - MachineClass *mc =3D MACHINE_CLASS(oc); - AspeedMachineClass *amc =3D ASPEED_MACHINE_CLASS(oc); - - mc->desc =3D "OCP SonoraPass BMC (ARM1176)"; - mc->deprecation_reason =3D "use 'ast2500-evb' instead"; - amc->soc_name =3D "ast2500-a1"; - amc->hw_strap1 =3D SONORAPASS_BMC_HW_STRAP1; - amc->fmc_model =3D "mx66l1g45g"; - amc->spi_model =3D "mx66l1g45g"; - amc->num_cs =3D 2; - amc->i2c_init =3D sonorapass_bmc_i2c_init; - mc->default_ram_size =3D 512 * MiB; - aspeed_machine_class_init_cpus_defaults(mc); -}; - -static const TypeInfo aspeed_ast2500_sonorapass_types[] =3D { - { - .name =3D MACHINE_TYPE_NAME("sonorapass-bmc"), - .parent =3D TYPE_ASPEED_MACHINE, - .class_init =3D aspeed_machine_sonorapass_class_init, - .interfaces =3D arm_machine_interfaces, - } -}; - -DEFINE_TYPES(aspeed_ast2500_sonorapass_types) diff --git a/hw/arm/meson.build b/hw/arm/meson.build index 84b8ec5fb5ab..098015357ddc 100644 --- a/hw/arm/meson.build +++ b/hw/arm/meson.build @@ -50,7 +50,6 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files( 'aspeed_ast2500_fp5280g2.c', 'aspeed_ast2500_g220a.c', 'aspeed_ast2500_romulus.c', - 'aspeed_ast2500_sonorapass.c', 'aspeed_ast2500_supermicro-x11spi.c', 'aspeed_ast2500_tiogapass.c', 'aspeed_ast2500_witherspoon.c', --=20 2.54.0 From nobody Sat May 30 17:44:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778606160; cv=none; d=zohomail.com; s=zohoarc; b=bXwcCEvJ09IJOrCzUc8ADxt1PQzFWKARCob+3iV96E/FYC7oCZj2Ju5yTNqvfAyZDABjeTsXADbSMVxltQFPyduMe4nEGh1h93DMr8z2aW5myYdNqQBPKYXzmN0+coX6eQDYt1HvMD+5SP4qZlZ5wT8QMgvHazzh5eYRJefixeo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778606160; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ZRIyYw94xvrketksuvpIVwvaTf49S9Y9tH0tGaG3ZVM=; b=TQI3cJGzxAOTrQBd9H2+J4UP9lAwkJws4FhAiQ4u/fSRmGniOmUj0HxFRENMDuSyvYnJk8sNN/i4DxqbABG+doLsotCF4RyQwWf/YG5DttlTJ5keOqrrv+PEa8IogGBi0Ct9Y7XtBJUY/eMhnjZz33K0vgNZAJR1+f4cZlIwG1A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1778606160616161.0088468458515; Tue, 12 May 2026 10:16:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wMqhk-0007ff-QZ; Tue, 12 May 2026 13:15:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgb-0006nj-BY for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:27 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgT-00010T-V7 for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:21 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-203-FnpOpyaZMxWp7ti3NLZ5rQ-1; Tue, 12 May 2026 13:14:13 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 52BAC18005BE; Tue, 12 May 2026 17:14:12 +0000 (UTC) Received: from corto.redhat.com (unknown [10.44.49.156]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id ACD0A1955D84; Tue, 12 May 2026 17:14:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778606057; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZRIyYw94xvrketksuvpIVwvaTf49S9Y9tH0tGaG3ZVM=; b=HpIsVLufDk2BaujaxobHA+K2NmFFSiGseY30eZpPeIw/oI2yHwtUfwNHvalQqbQ0C6uJB2 wjIClSdw3FMed62PqXlyHWYlaPqT57Vx0aZSnao951LO8SzOKIfGk9ZXUMzrDnqFmxAreT w1ZCt/VjQ5tZm26WU9Tnf/wnGZGdvGU= X-MC-Unique: FnpOpyaZMxWp7ti3NLZ5rQ-1 X-Mimecast-MFC-AGG-ID: FnpOpyaZMxWp7ti3NLZ5rQ_1778606052 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Cc: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [PULL 6/9] hw/arm: Remove qcom-dc-scm-v1-bmc and qcom-firework-bmc machines Date: Tue, 12 May 2026 19:13:51 +0200 Message-ID: <20260512171354.4183887-7-clg@redhat.com> In-Reply-To: <20260512171354.4183887-1-clg@redhat.com> References: <20260512171354.4183887-1-clg@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=clg@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778606162978158501 The qcom-dc-scm-v1-bmc and qcom-firework-bmc machines were deprecated in QEMU 10.2 and are now removed in QEMU 11.1. These Qualcomm lab servers never entered production and do not rely on specific device models. They can be replaced by the ast2600-evb machine with appropriate fmc-model and I2C device configuration via command line. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Link: https://lore.kernel.org/qemu-devel/20260510165704.2935316-3-clg@redha= t.com Signed-off-by: C=C3=A9dric Le Goater --- docs/about/deprecated.rst | 10 --- docs/about/removed-features.rst | 10 +++ docs/system/arm/aspeed.rst | 6 +- hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c | 55 ---------------- hw/arm/aspeed_ast2600_qcom-firework.c | 91 -------------------------- hw/arm/meson.build | 2 - 6 files changed, 12 insertions(+), 162 deletions(-) delete mode 100644 hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c delete mode 100644 hw/arm/aspeed_ast2600_qcom-firework.c diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index cc75afe55d95..bbb4a9886fbc 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -250,16 +250,6 @@ deprecated; use the new name ``dtb-randomness`` instea= d. The new name better reflects the way this property affects all random data within the device tree blob, not just the ``kaslr-seed`` node. =20 -Arm ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` machine (since 10.2) -''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' - -The ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` represent lab -servers that never entered production. Since they do not rely on any -specific device models, they can be replaced by the ``ast2600-evb`` -machine using the ``fmc-model`` option to specify the flash type. The -I2C devices connected to the board can be defined via the QEMU command -line. - Arm ``fp5280g2-bmc`` machine (since 10.2) ''''''''''''''''''''''''''''''''''''''''' =20 diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.= rst index 02e3c06b2988..b9e9d43dada3 100644 --- a/docs/about/removed-features.rst +++ b/docs/about/removed-features.rst @@ -1195,6 +1195,16 @@ using the ``fmc-model`` option to specify the flash = type. The I2C devices connected to the board can be defined via the QEMU command line. =20 +Arm ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` machine (removed in 1= 1.1) +''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''= '''' + +The ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` represent lab +servers that never entered production. Since they do not rely on any +specific device models, they can be replaced by the ``ast2600-evb`` +machine using the ``fmc-model`` option to specify the flash type. The +I2C devices connected to the board can be defined via the QEMU command +line. + linux-user mode CPUs -------------------- =20 diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst index 1871f31713d4..cbaab5edd65c 100644 --- a/docs/system/arm/aspeed.rst +++ b/docs/system/arm/aspeed.rst @@ -1,5 +1,5 @@ -Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``,= ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-b= mc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``qu= anta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``supermicrox11-bmc``, `= `supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemite= v2-bmc``) -=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D +Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``,= ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-b= mc``, ``palmetto-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc= ``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``w= itherspoon-bmc``, ``yosemitev2-bmc``) +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and Aspeed evaluation boards. They are based on different releases of the @@ -35,8 +35,6 @@ AST2600 SoC based machines : - ``bletchley-bmc`` Facebook Bletchley BMC - ``fby35-bmc`` Facebook fby35 BMC - ``gb200nvl-bmc`` Nvidia GB200nvl BMC -- ``qcom-dc-scm-v1-bmc`` Qualcomm DC-SCM V1 BMC -- ``qcom-firework-bmc`` Qualcomm Firework BMC =20 Supported devices ----------------- diff --git a/hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c b/hw/arm/aspeed_ast2600= _qcom-dc-scm-v1.c deleted file mode 100644 index bbdeb6023686..000000000000 --- a/hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c +++ /dev/null @@ -1,55 +0,0 @@ -/* - * Qualcomm DC-SCM V1 - * - * Copyright 2016 IBM Corp. - * - * SPDX-License-Identifier: GPL-2.0-or-later - */ - -#include "qemu/osdep.h" -#include "qapi/error.h" -#include "hw/arm/machines-qom.h" -#include "hw/arm/aspeed.h" -#include "hw/arm/aspeed_soc.h" - -/* Qualcomm DC-SCM hardware value */ -#define QCOM_DC_SCM_V1_BMC_HW_STRAP1 0x00000000 -#define QCOM_DC_SCM_V1_BMC_HW_STRAP2 0x00000041 - -static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc) -{ - AspeedSoCState *soc =3D bmc->soc; - - i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0= x4d); -} - -static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc, - const void *data) -{ - MachineClass *mc =3D MACHINE_CLASS(oc); - AspeedMachineClass *amc =3D ASPEED_MACHINE_CLASS(oc); - - mc->desc =3D "Qualcomm DC-SCM V1 BMC (Cortex A7)"; - mc->deprecation_reason =3D "use 'ast2600-evb' instead"; - amc->soc_name =3D "ast2600-a3"; - amc->hw_strap1 =3D QCOM_DC_SCM_V1_BMC_HW_STRAP1; - amc->hw_strap2 =3D QCOM_DC_SCM_V1_BMC_HW_STRAP2; - amc->fmc_model =3D "n25q512a"; - amc->spi_model =3D "n25q512a"; - amc->num_cs =3D 2; - amc->macs_mask =3D ASPEED_MAC2_ON | ASPEED_MAC3_ON; - amc->i2c_init =3D qcom_dc_scm_bmc_i2c_init; - mc->default_ram_size =3D 1 * GiB; - aspeed_machine_class_init_cpus_defaults(mc); -}; - -static const TypeInfo aspeed_ast2600_qcom_dc_scm_v1_types[] =3D { - { - .name =3D MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"), - .parent =3D TYPE_ASPEED_MACHINE, - .class_init =3D aspeed_machine_qcom_dc_scm_v1_class_init, - .interfaces =3D arm_machine_interfaces, - } -}; - -DEFINE_TYPES(aspeed_ast2600_qcom_dc_scm_v1_types) diff --git a/hw/arm/aspeed_ast2600_qcom-firework.c b/hw/arm/aspeed_ast2600_= qcom-firework.c deleted file mode 100644 index a4dbe6eea8ab..000000000000 --- a/hw/arm/aspeed_ast2600_qcom-firework.c +++ /dev/null @@ -1,91 +0,0 @@ -/* - * Qualcomm DC-SCM V1/Firework - * - * Copyright 2016 IBM Corp. - * - * SPDX-License-Identifier: GPL-2.0-or-later - */ - -#include "qemu/osdep.h" -#include "qapi/error.h" -#include "hw/arm/machines-qom.h" -#include "hw/arm/aspeed.h" -#include "hw/arm/aspeed_soc.h" -#include "hw/i2c/i2c_mux_pca954x.h" -#include "hw/sensor/tmp105.h" - -/* Qualcomm DC-SCM Firework hardware value */ -#define QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP1 0x00000000 -#define QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP2 0x00000041 - -#define TYPE_LM75 TYPE_TMP105 - -static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc) -{ - AspeedSoCState *soc =3D bmc->soc; - - i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0= x4d); -} - -static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc) -{ - AspeedSoCState *soc =3D bmc->soc; - I2CSlave *therm_mux, *cpuvr_mux; - - /* Create the generic DC-SCM hardware */ - qcom_dc_scm_bmc_i2c_init(bmc); - - /* Now create the Firework specific hardware */ - - /* I2C7 CPUVR MUX */ - cpuvr_mux =3D i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), - "pca9546", 0x70); - i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 0), "pca9548", = 0x72); - i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 1), "pca9548", = 0x72); - i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 2), "pca9548", = 0x72); - i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 3), "pca9548", = 0x72); - - /* I2C8 Thermal Diodes*/ - therm_mux =3D i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8), - "pca9548", 0x70); - i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 0), TYPE_LM75, = 0x4C); - i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 1), TYPE_LM75, = 0x4C); - i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 2), TYPE_LM75, = 0x48); - i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 3), TYPE_LM75, = 0x48); - i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 4), TYPE_LM75, = 0x48); - - /* I2C9 Fan Controller (MAX31785) */ - i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", = 0x52); - i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", = 0x54); -} - -static void aspeed_machine_qcom_firework_class_init(ObjectClass *oc, - const void *data) -{ - MachineClass *mc =3D MACHINE_CLASS(oc); - AspeedMachineClass *amc =3D ASPEED_MACHINE_CLASS(oc); - - mc->desc =3D "Qualcomm DC-SCM V1/Firework BMC (Cortex A7)"; - mc->deprecation_reason =3D "use 'ast2600-evb' instead"; - amc->soc_name =3D "ast2600-a3"; - amc->hw_strap1 =3D QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP1; - amc->hw_strap2 =3D QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP2; - amc->fmc_model =3D "n25q512a"; - amc->spi_model =3D "n25q512a"; - amc->num_cs =3D 2; - amc->macs_mask =3D ASPEED_MAC2_ON | ASPEED_MAC3_ON; - amc->i2c_init =3D qcom_dc_scm_firework_i2c_init; - mc->default_ram_size =3D 1 * GiB; - aspeed_machine_class_init_cpus_defaults(mc); -}; - -static const TypeInfo aspeed_ast2600_qcom_firework_types[] =3D { - { - .name =3D MACHINE_TYPE_NAME("qcom-firework-bmc"), - .parent =3D TYPE_ASPEED_MACHINE, - .class_init =3D aspeed_machine_qcom_firework_class_init, - .interfaces =3D arm_machine_interfaces, - } -}; - -DEFINE_TYPES(aspeed_ast2600_qcom_firework_types) diff --git a/hw/arm/meson.build b/hw/arm/meson.build index 098015357ddc..2be74b575efc 100644 --- a/hw/arm/meson.build +++ b/hw/arm/meson.build @@ -61,8 +61,6 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files( 'aspeed_ast2600_fby35.c', 'aspeed_ast2600_fuji.c', 'aspeed_ast2600_gb200nvl.c', - 'aspeed_ast2600_qcom-dc-scm-v1.c', - 'aspeed_ast2600_qcom-firework.c', 'aspeed_ast2600_rainier.c', 'aspeed_ast10x0.c', 'aspeed_ast10x0_evb.c', --=20 2.54.0 From nobody Sat May 30 17:44:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778606169; cv=none; d=zohomail.com; s=zohoarc; b=gybmsZ+6DsG19tfvBUrxbzJrTDmpzfeMajWOMGWGLLGg3ROlYh/SsP1jzflvN7j3O39WaImUyCPARomnoiVcZnrbhGZrYcBQl6zYCBLrP2IpKpWXpNDlIeioBoeixYlUGnQ01yaLGicYotNNUX+jY1Q9utMl+jno+SrrYXy2SDo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778606169; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mJSWxrK/DsrWExYq5kDHhvcdyrwDNbnw2tsgw3hDlWA=; b=Cg4wYksegNp3ZJJRKyXqaAKCWB3Ep/ZooiAvmoB86Grms24G/hPClJPV3aCP2sIwoCSyWNjiB1t2SAgGbU5rQ7A2/m8Rh3Lr+2BroYadqU3p5L9bGz/gz7dhsSTsr1ECecRalZP/tdDORLKednPhjen4lSmkyXygcmXOMGxFCmA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1778606169594176.83052414062513; Tue, 12 May 2026 10:16:09 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wMqhm-0007tU-6O; Tue, 12 May 2026 13:15:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgb-0006nk-ML for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:27 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgV-00010q-Dx for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:22 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-451-_q_2rmsvPiqF_DPl4-keCQ-1; Tue, 12 May 2026 13:14:15 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5F19E180034E; Tue, 12 May 2026 17:14:14 +0000 (UTC) Received: from corto.redhat.com (unknown [10.44.49.156]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id B00D61955D84; Tue, 12 May 2026 17:14:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778606058; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mJSWxrK/DsrWExYq5kDHhvcdyrwDNbnw2tsgw3hDlWA=; b=NU2P/Z45vWSD/sTVv04FaqwwhebCVDa6VMqukjZu4VO+9auHQfAvOOmmm+Yd9uNsIlrXx5 hc/LRAOr6utq4VHbtl4fAJmCPzMiDtH0tffEp4XYbfy1PsPKwV+htUBghPA020x/WFpx/v 39rzyeWmYdeaEcoyrPRSVmF8AYPd6DU= X-MC-Unique: _q_2rmsvPiqF_DPl4-keCQ-1 X-Mimecast-MFC-AGG-ID: _q_2rmsvPiqF_DPl4-keCQ_1778606054 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Cc: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [PULL 7/9] hw/arm: Remove fp5280g2-bmc machine Date: Tue, 12 May 2026 19:13:52 +0200 Message-ID: <20260512171354.4183887-8-clg@redhat.com> In-Reply-To: <20260512171354.4183887-1-clg@redhat.com> References: <20260512171354.4183887-1-clg@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=clg@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778606171039158500 The fp5280g2-bmc machine was deprecated in QEMU 10.2 and is now removed in QEMU 11.1. This Inspur FP5280G2 BMC board does not rely on specific device models and can be replaced by the ast2500-evb machine with appropriate fmc-model and I2C device configuration via command line. Reviewed-by: Philippe Mathieu-Daud=C3=A9 Link: https://lore.kernel.org/qemu-devel/20260510165704.2935316-4-clg@redha= t.com Signed-off-by: C=C3=A9dric Le Goater --- docs/about/deprecated.rst | 8 --- docs/about/removed-features.rst | 8 +++ docs/system/arm/aspeed.rst | 5 +- hw/arm/aspeed_ast2500_fp5280g2.c | 88 -------------------------------- hw/arm/meson.build | 1 - 5 files changed, 10 insertions(+), 100 deletions(-) delete mode 100644 hw/arm/aspeed_ast2500_fp5280g2.c diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index bbb4a9886fbc..e416f3d8a74b 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -250,14 +250,6 @@ deprecated; use the new name ``dtb-randomness`` instea= d. The new name better reflects the way this property affects all random data within the device tree blob, not just the ``kaslr-seed`` node. =20 -Arm ``fp5280g2-bmc`` machine (since 10.2) -''''''''''''''''''''''''''''''''''''''''' - -The ``fp5280g2-bmc`` machine does not rely on any specific device -models, it can be replaced by the ``ast2500-evb`` machine using the -``fmc-model`` option to specify the flash type. The I2C devices -connected to the board can be defined via the QEMU command line. - Arm ``fby35`` machine (since 10.2) '''''''''''''''''''''''''''''''''' =20 diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.= rst index b9e9d43dada3..2da8283d0e1e 100644 --- a/docs/about/removed-features.rst +++ b/docs/about/removed-features.rst @@ -1205,6 +1205,14 @@ machine using the ``fmc-model`` option to specify th= e flash type. The I2C devices connected to the board can be defined via the QEMU command line. =20 +Arm ``fp5280g2-bmc`` machine (removed in 11.1) +'''''''''''''''''''''''''''''''''''''''''''''' + +The ``fp5280g2-bmc`` machine does not rely on any specific device +models, it can be replaced by the ``ast2500-evb`` machine using the +``fmc-model`` option to specify the flash type. The I2C devices +connected to the board can be defined via the QEMU command line. + linux-user mode CPUs -------------------- =20 diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst index cbaab5edd65c..df2f539b0257 100644 --- a/docs/system/arm/aspeed.rst +++ b/docs/system/arm/aspeed.rst @@ -1,5 +1,5 @@ -Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``,= ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-b= mc``, ``palmetto-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc= ``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``w= itherspoon-bmc``, ``yosemitev2-bmc``) -=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D +Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``,= ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``g220a-bmc``, ``palmetto-b= mc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``supermicrox1= 1-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, = ``yosemitev2-bmc``) +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and Aspeed evaluation boards. They are based on different releases of the @@ -22,7 +22,6 @@ AST2500 SoC based machines : - ``ast2500-evb`` Aspeed AST2500 Evaluation board - ``romulus-bmc`` OpenPOWER Romulus POWER9 BMC - ``witherspoon-bmc`` OpenPOWER Witherspoon POWER9 BMC -- ``fp5280g2-bmc`` Inspur FP5280G2 BMC - ``g220a-bmc`` Bytedance G220A BMC - ``yosemitev2-bmc`` Facebook YosemiteV2 BMC - ``tiogapass-bmc`` Facebook Tiogapass BMC diff --git a/hw/arm/aspeed_ast2500_fp5280g2.c b/hw/arm/aspeed_ast2500_fp528= 0g2.c deleted file mode 100644 index 858e0388714b..000000000000 --- a/hw/arm/aspeed_ast2500_fp5280g2.c +++ /dev/null @@ -1,88 +0,0 @@ -/* - * Inspur FP5280G2 - * - * Copyright 2016 IBM Corp. - * - * SPDX-License-Identifier: GPL-2.0-or-later - */ - -#include "qemu/osdep.h" -#include "qapi/error.h" -#include "hw/arm/machines-qom.h" -#include "hw/arm/aspeed.h" -#include "hw/arm/aspeed_soc.h" -#include "hw/nvram/eeprom_at24c.h" -#include "hw/i2c/i2c_mux_pca954x.h" -#include "hw/sensor/tmp105.h" - -/* FP5280G2 hardware value: 0XF100D286 */ -#define FP5280G2_BMC_HW_STRAP1 ( \ - SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE | \ - SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE | \ - SCU_AST2500_HW_STRAP_UART_DEBUG | \ - SCU_AST2500_HW_STRAP_RESERVED28 | \ - SCU_AST2500_HW_STRAP_DDR4_ENABLE | \ - SCU_HW_STRAP_VGA_CLASS_CODE | \ - SCU_HW_STRAP_LPC_RESET_PIN | \ - SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER) | \ - SCU_AST2500_HW_STRAP_SET_AXI_AHB_RATIO(AXI_AHB_RATIO_2_1) | \ - SCU_HW_STRAP_MAC1_RGMII | \ - SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) | \ - SCU_AST2500_HW_STRAP_RESERVED1) - -static void fp5280g2_bmc_i2c_init(AspeedMachineState *bmc) -{ - AspeedSoCState *soc =3D bmc->soc; - I2CSlave *i2c_mux; - - /* The at24c256 */ - at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 1), 0x50, 32768); - - /* The fp5280g2 expects a TMP112 but a TMP105 is compatible */ - i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), TYPE_TMP105, - 0x48); - i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), TYPE_TMP105, - 0x49); - - i2c_mux =3D i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), - "pca9546", 0x70); - /* It expects a TMP112 but a TMP105 is compatible */ - i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 0), TYPE_TMP105, - 0x4a); - - /* It expects a ds3232 but a ds1338 is good enough */ - i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), "ds1338", 0x= 68); - - /* It expects a pca9555 but a pca9552 is compatible */ - aspeed_create_pca9552(soc, 8, 0x30); -} - -static void aspeed_machine_fp5280g2_class_init(ObjectClass *oc, - const void *data) -{ - MachineClass *mc =3D MACHINE_CLASS(oc); - AspeedMachineClass *amc =3D ASPEED_MACHINE_CLASS(oc); - - mc->desc =3D "Inspur FP5280G2 BMC (ARM1176)"; - mc->deprecation_reason =3D "use 'ast2500-evb' instead"; - amc->soc_name =3D "ast2500-a1"; - amc->hw_strap1 =3D FP5280G2_BMC_HW_STRAP1; - amc->fmc_model =3D "n25q512a"; - amc->spi_model =3D "mx25l25635e"; - amc->num_cs =3D 2; - amc->macs_mask =3D ASPEED_MAC0_ON | ASPEED_MAC1_ON; - amc->i2c_init =3D fp5280g2_bmc_i2c_init; - mc->default_ram_size =3D 512 * MiB; - aspeed_machine_class_init_cpus_defaults(mc); -}; - -static const TypeInfo aspeed_ast2500_fp5280g2_types[] =3D { - { - .name =3D MACHINE_TYPE_NAME("fp5280g2-bmc"), - .parent =3D TYPE_ASPEED_MACHINE, - .class_init =3D aspeed_machine_fp5280g2_class_init, - .interfaces =3D arm_machine_interfaces, - } -}; - -DEFINE_TYPES(aspeed_ast2500_fp5280g2_types) diff --git a/hw/arm/meson.build b/hw/arm/meson.build index 2be74b575efc..063abf2cf654 100644 --- a/hw/arm/meson.build +++ b/hw/arm/meson.build @@ -47,7 +47,6 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files( 'aspeed_ast2400_quanta-q71l.c', 'aspeed_ast2400_supermicrox11.c', 'aspeed_ast2500_evb.c', - 'aspeed_ast2500_fp5280g2.c', 'aspeed_ast2500_g220a.c', 'aspeed_ast2500_romulus.c', 'aspeed_ast2500_supermicro-x11spi.c', --=20 2.54.0 From nobody Sat May 30 17:44:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778606175; cv=none; d=zohomail.com; s=zohoarc; b=e78qncYjlgc4sr2VGxeXFTLCMnNu4uThG5F4+Sr7wISvFgtNZZFV1CpgcaxxU7CGJtvmild/vaGUA05+HYAaTC+lO1WNk/PhTLvKPXFILE6krCljOhmwoYQUnKTI1yfhYEMHSQoUrR7X9/+gFt1Ij7bycT5nBaUop8XSWoamEzg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778606175; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=aFnWtS7fHX6DQP30aCJnQ/b6Ebdav+Ca95dFN+mixKE=; b=UcwRcV+X97rT3VrdYv3UVZkm2ZALubiPJd35sVVD7+5bU03SE7D8q1RHaBYIw79awypXUJp/ui+7LZteAQEEKG6Jt51gOo8VlVdcBWdBJt7aajmEXaKNiAlQkFPTVg61jQ0TR3ND+iXUVs5EMRRKsDuq4/UCsNroc4qW0NV5UYw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 177860617582825.956710287031683; Tue, 12 May 2026 10:16:15 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wMqhl-0007jp-7U; Tue, 12 May 2026 13:15:37 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgd-0006oP-JX for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:30 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgZ-00011W-6d for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:27 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-385-RPBEWfg3OvW6ZSpJwCv_8A-1; Tue, 12 May 2026 13:14:17 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 9242519560A1; Tue, 12 May 2026 17:14:16 +0000 (UTC) Received: from corto.redhat.com (unknown [10.44.49.156]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D1DAC1955D84; Tue, 12 May 2026 17:14:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778606060; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aFnWtS7fHX6DQP30aCJnQ/b6Ebdav+Ca95dFN+mixKE=; b=ElpQz+gNb9xwE0L3OxaIraTLKTqfwN0LJFqC9QxP8qVpAWGQIGF4Zczg70MVVFlwpAvDHP ku4928nm/h+3FXr0Tde3zJQVIXqsdBGbmVUTNxaADKq6iEP+jWWIavY8+LhQlEN7S66ffp iJSAmeskbaFNrPR/nmiScNjWtkCGWxQ= X-MC-Unique: RPBEWfg3OvW6ZSpJwCv_8A-1 X-Mimecast-MFC-AGG-ID: RPBEWfg3OvW6ZSpJwCv_8A_1778606056 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Cc: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= , Peter Delevoryas Subject: [PULL 8/9] hw/arm: Remove fby35 machine Date: Tue, 12 May 2026 19:13:53 +0200 Message-ID: <20260512171354.4183887-9-clg@redhat.com> In-Reply-To: <20260512171354.4183887-1-clg@redhat.com> References: <20260512171354.4183887-1-clg@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=clg@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778606177803154100 The fby35 machine was deprecated in QEMU 10.2 and is now removed in QEMU 11.1. This multi-SoC machine was added as an example of heterogeneous systems, but the models never evolved and no public firmware is available to boot it. Users needing multi-SoC emulation should use the ast2700fc machine instead, which is based on newer AST2700 SoCs with better support. Link: https://lore.kernel.org/qemu-devel/20260510165704.2935316-5-clg@redha= t.com Acked-by: Peter Delevoryas Signed-off-by: C=C3=A9dric Le Goater --- MAINTAINERS | 2 - docs/about/deprecated.rst | 10 -- docs/about/removed-features.rst | 10 ++ docs/system/arm/fby35.rst | 52 -------- docs/system/target-arm.rst | 1 - hw/arm/fby35.c | 203 -------------------------------- hw/arm/meson.build | 3 +- 7 files changed, 11 insertions(+), 270 deletions(-) delete mode 100644 docs/system/arm/fby35.rst delete mode 100644 hw/arm/fby35.c diff --git a/MAINTAINERS b/MAINTAINERS index 93a1e4e4822e..06788fde5acd 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -1276,12 +1276,10 @@ F: include/hw/*/*aspeed* F: hw/net/ftgmac100.c F: include/hw/net/ftgmac100.h F: docs/system/arm/aspeed.rst -F: docs/system/arm/fby35.rst F: docs/specs/aspeed* F: tests/functional/*/*aspeed* F: tests/*/*aspeed* F: tests/*/*ast2700* -F: hw/arm/fby35.c F: pc-bios/ast27x0_bootrom.bin F: roms/vbootrom =20 diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index e416f3d8a74b..bf6182d61c6e 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -250,16 +250,6 @@ deprecated; use the new name ``dtb-randomness`` instea= d. The new name better reflects the way this property affects all random data within the device tree blob, not just the ``kaslr-seed`` node. =20 -Arm ``fby35`` machine (since 10.2) -'''''''''''''''''''''''''''''''''' - -The ``fby35`` machine was originally added as an example of a -multi-SoC system, with the expectation the models would evolve over -time in an heterogeneous system. This hasn't happened and no public -firmware is available to boot it. It can be replaced by the -``ast2700fc``, another multi-SoC machine based on the newer AST2700 -SoCs which are excepted to receive better support in the future. - =20 RISC-V default machine option (since 10.0) '''''''''''''''''''''''''''''''''''''''''' diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.= rst index 2da8283d0e1e..9bd83b183f46 100644 --- a/docs/about/removed-features.rst +++ b/docs/about/removed-features.rst @@ -1213,6 +1213,16 @@ models, it can be replaced by the ``ast2500-evb`` ma= chine using the ``fmc-model`` option to specify the flash type. The I2C devices connected to the board can be defined via the QEMU command line. =20 +Arm ``fby35`` machine (removed in 11.1) +''''''''''''''''''''''''''''''''''''''' + +The ``fby35`` machine was originally added as an example of a +multi-SoC system, with the expectation the models would evolve over +time in an heterogeneous system. This hasn't happened and no public +firmware is available to boot it. It can be replaced by the +``ast2700fc``, another multi-SoC machine based on the newer AST2700 +SoCs which are excepted to receive better support in the future. + linux-user mode CPUs -------------------- =20 diff --git a/docs/system/arm/fby35.rst b/docs/system/arm/fby35.rst deleted file mode 100644 index e19274e75c81..000000000000 --- a/docs/system/arm/fby35.rst +++ /dev/null @@ -1,52 +0,0 @@ -Facebook Yosemite v3.5 Platform and CraterLake Server (``fby35``) -=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D - -Facebook has a series of multi-node compute server designs named -Yosemite. The most recent version released was -`Yosemite v3 `__. - -Yosemite v3.5 is an iteration on this design, and is very similar: there's= a -baseboard with a BMC, and 4 server slots. The new server board design term= ed -"CraterLake" includes a Bridge IC (BIC), with room for expansion boards to -include various compute accelerators (video, inferencing, etc). At the mom= ent, -only the first server slot's BIC is included. - -Yosemite v3.5 is itself a sled which fits into a 40U chassis, and 3 sleds -can be fit into a chassis. See `here `__ -for an example. - -In this generation, the BMC is an AST2600 and each BIC is an AST1030. The = BMC -runs `OpenBMC `__, and the BIC runs -`OpenBIC `__. - -Firmware images can be retrieved from the Github releases or built from the -source code, see the README's for instructions on that. This image uses the -"fby35" machine recipe from OpenBMC, and the "yv35-cl" target from OpenBIC. -Some reference images can also be found here: - -.. code-block:: bash - - $ wget https://github.com/facebook/openbmc/releases/download/openbmc-e= 2294ff5d31d/fby35.mtd - $ wget https://github.com/peterdelevoryas/OpenBIC/releases/download/ob= y35-cl-2022.13.01/Y35BCL.elf - -Since this machine has multiple SoC's, each with their own serial console,= the -recommended way to run it is to allocate a pseudoterminal for each serial -console and let the monitor use stdio. Also, starting in a paused state is -useful because it allows you to attach to the pseudoterminals before the b= oot -process starts. - -.. code-block:: bash - - $ qemu-system-arm -machine fby35 \ - -drive file=3Dfby35.mtd,format=3Draw,if=3Dmtd \ - -device loader,file=3DY35BCL.elf,addr=3D0,cpu-num=3D2 \ - -serial pty -serial pty -serial mon:stdio \ - -display none -S - $ screen /dev/tty0 # In a separate TMUX pane, terminal window, etc. - $ screen /dev/tty1 - $ (qemu) c # Start the boot process once screen is setup. - -This machine model supports emulation of the boot from the CE0 flash devic= e by -setting option ``execute-in-place``. When using this option, the CPU fetch= es -instructions to execute by reading CE0 and not from a preloaded ROM -initialized at machine init time. As a result, execution will be slower. diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst index c57102a4149f..e34492402f0a 100644 --- a/docs/system/target-arm.rst +++ b/docs/system/target-arm.rst @@ -87,7 +87,6 @@ Board-specific documentation arm/cubieboard arm/emcraft-sf2 arm/exynos - arm/fby35 arm/musicpal arm/kzm arm/nrf diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c deleted file mode 100644 index d3bfd2c7d26a..000000000000 --- a/hw/arm/fby35.c +++ /dev/null @@ -1,203 +0,0 @@ -/* - * Copyright (c) Meta Platforms, Inc. and affiliates. (http://www.meta.com) - * - * This code is licensed under the GPL version 2 or later. See the COPYING - * file in the top-level directory. - */ - -#include "qemu/osdep.h" -#include "qemu/units.h" -#include "qapi/error.h" -#include "system/system.h" -#include "system/block-backend.h" -#include "hw/core/boards.h" -#include "hw/core/qdev-clock.h" -#include "hw/arm/aspeed_soc.h" -#include "hw/arm/boot.h" -#include "hw/arm/machines-qom.h" - -#define TYPE_FBY35 MACHINE_TYPE_NAME("fby35") -OBJECT_DECLARE_SIMPLE_TYPE(Fby35State, FBY35); - -struct Fby35State { - MachineState parent_obj; - - MemoryRegion bmc_memory; - MemoryRegion bmc_dram; - MemoryRegion bmc_boot_rom; - MemoryRegion bic_memory; - Clock *bic_sysclk; - - Aspeed2600SoCState bmc; - Aspeed10x0SoCState bic; - - bool mmio_exec; -}; - -#define FBY35_BMC_RAM_SIZE (2 * GiB) -#define FBY35_BMC_FIRMWARE_ADDR 0x0 - -static void fby35_bmc_write_boot_rom(DriveInfo *dinfo, MemoryRegion *mr, - hwaddr offset, size_t rom_size, - Error **errp) -{ - BlockBackend *blk =3D blk_by_legacy_dinfo(dinfo); - g_autofree void *storage =3D NULL; - int64_t size; - - /* - * The block backend size should have already been 'validated' by - * the creation of the m25p80 object. - */ - size =3D blk_getlength(blk); - if (size <=3D 0) { - error_setg(errp, "failed to get flash size"); - return; - } - - if (rom_size > size) { - rom_size =3D size; - } - - storage =3D g_malloc0(rom_size); - if (blk_pread(blk, 0, rom_size, storage, 0) < 0) { - error_setg(errp, "failed to read the initial flash content"); - return; - } - - /* TODO: find a better way to install the ROM */ - memcpy(memory_region_get_ram_ptr(mr) + offset, storage, rom_size); -} - -static void fby35_bmc_init(Fby35State *s) -{ - AspeedSoCState *soc; - AspeedSoCClass *sc; - - object_initialize_child(OBJECT(s), "bmc", &s->bmc, "ast2600-a3"); - soc =3D ASPEED_SOC(&s->bmc); - sc =3D ASPEED_SOC_GET_CLASS(soc); - - memory_region_init(&s->bmc_memory, OBJECT(&s->bmc), "bmc-memory", - UINT64_MAX); - memory_region_add_subregion(get_system_memory(), 0, &s->bmc_memory); - memory_region_init_ram(&s->bmc_dram, OBJECT(&s->bmc), "bmc-dram", - FBY35_BMC_RAM_SIZE, &error_abort); - - object_property_set_int(OBJECT(&s->bmc), "ram-size", FBY35_BMC_RAM_SIZ= E, - &error_abort); - object_property_set_link(OBJECT(&s->bmc), "memory", OBJECT(&s->bmc_mem= ory), - &error_abort); - object_property_set_link(OBJECT(&s->bmc), "dram", OBJECT(&s->bmc_dram), - &error_abort); - object_property_set_int(OBJECT(&s->bmc), "hw-strap1", 0x000000C0, - &error_abort); - object_property_set_int(OBJECT(&s->bmc), "hw-strap2", 0x00000003, - &error_abort); - aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART5, sc->uarts_base, - sc->uarts_num, serial_hd(0)); - qdev_realize(DEVICE(&s->bmc), NULL, &error_abort); - - aspeed_board_init_flashes(&soc->fmc, "n25q00", 2, 0); - - /* Install first FMC flash content as a boot rom. */ - if (!s->mmio_exec) { - DriveInfo *mtd0 =3D drive_get(IF_MTD, 0, 0); - - if (mtd0) { - uint64_t rom_size =3D memory_region_size(&soc->spi_boot); - - memory_region_init_rom(&s->bmc_boot_rom, NULL, "aspeed.boot_ro= m", - rom_size, &error_abort); - memory_region_add_subregion_overlap(&soc->spi_boot_container, = 0, - &s->bmc_boot_rom, 1); - - fby35_bmc_write_boot_rom(mtd0, &s->bmc_boot_rom, - FBY35_BMC_FIRMWARE_ADDR, - rom_size, &error_abort); - } - } -} - -static void fby35_bic_init(Fby35State *s) -{ - AspeedSoCState *soc; - AspeedSoCClass *sc; - - s->bic_sysclk =3D clock_new(OBJECT(s), "SYSCLK"); - clock_set_hz(s->bic_sysclk, 200000000ULL); - - object_initialize_child(OBJECT(s), "bic", &s->bic, "ast1030-a1"); - soc =3D ASPEED_SOC(&s->bic); - sc =3D ASPEED_SOC_GET_CLASS(soc); - - memory_region_init(&s->bic_memory, OBJECT(&s->bic), "bic-memory", - UINT64_MAX); - - qdev_connect_clock_in(DEVICE(&s->bic), "sysclk", s->bic_sysclk); - object_property_set_link(OBJECT(&s->bic), "memory", OBJECT(&s->bic_mem= ory), - &error_abort); - aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART5, sc->uarts_base, - sc->uarts_num, serial_hd(1)); - qdev_realize(DEVICE(&s->bic), NULL, &error_abort); - - aspeed_board_init_flashes(&soc->fmc, "sst25vf032b", 2, 2); - aspeed_board_init_flashes(&soc->spi[0], "sst25vf032b", 2, 4); - aspeed_board_init_flashes(&soc->spi[1], "sst25vf032b", 2, 6); -} - -static void fby35_init(MachineState *machine) -{ - Fby35State *s =3D FBY35(machine); - - fby35_bmc_init(s); - fby35_bic_init(s); -} - - -static bool fby35_get_mmio_exec(Object *obj, Error **errp) -{ - return FBY35(obj)->mmio_exec; -} - -static void fby35_set_mmio_exec(Object *obj, bool value, Error **errp) -{ - FBY35(obj)->mmio_exec =3D value; -} - -static void fby35_instance_init(Object *obj) -{ - FBY35(obj)->mmio_exec =3D false; -} - -static void fby35_class_init(ObjectClass *oc, const void *data) -{ - MachineClass *mc =3D MACHINE_CLASS(oc); - - mc->desc =3D "Meta Platforms fby35"; - mc->deprecation_reason =3D "For a multi-soc machine, use 'ast2700fc' i= nstead"; - mc->init =3D fby35_init; - mc->no_floppy =3D 1; - mc->no_cdrom =3D 1; - mc->auto_create_sdcard =3D true; - mc->min_cpus =3D mc->max_cpus =3D mc->default_cpus =3D 3; - - object_class_property_add_bool(oc, "execute-in-place", - fby35_get_mmio_exec, - fby35_set_mmio_exec); - object_class_property_set_description(oc, "execute-in-place", - "boot directly from CE0 flash device"); -} - -static const TypeInfo fby35_types[] =3D { - { - .name =3D MACHINE_TYPE_NAME("fby35"), - .parent =3D TYPE_MACHINE, - .class_init =3D fby35_class_init, - .instance_size =3D sizeof(Fby35State), - .instance_init =3D fby35_instance_init, - .interfaces =3D arm_machine_interfaces, - }, -}; - -DEFINE_TYPES(fby35_types); diff --git a/hw/arm/meson.build b/hw/arm/meson.build index 063abf2cf654..80068f70bb9c 100644 --- a/hw/arm/meson.build +++ b/hw/arm/meson.build @@ -62,8 +62,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files( 'aspeed_ast2600_gb200nvl.c', 'aspeed_ast2600_rainier.c', 'aspeed_ast10x0.c', - 'aspeed_ast10x0_evb.c', - 'fby35.c')) + 'aspeed_ast10x0_evb.c')) arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: = files( 'aspeed_ast1700.c', 'aspeed_ast27x0.c', --=20 2.54.0 From nobody Sat May 30 17:44:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778606199; cv=none; d=zohomail.com; s=zohoarc; b=c2Z2ygFmyDtJoc3qZ+GLlyEt1Y1M4pnubiXuA+NzqBSBJZ7I7NdVEmhSApK8mlQDy9n04YahF0it+Cj7Umv7fSqn4EZGFNh/rDwAQDIDjSLJKBa+7IBI7gNj4t9+bWFXhVHj6noLP/JcZVS27HW24H+gT1bCNhL5trULD+MBPGg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778606199; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=v9ykP7jfFb11PT8krRVFcMmjBsX/sC3umQNq9cH46G0=; b=iyt6rOxivEPsXk3U+X+8w2Ce5VIGvJgjTeg/zPSH4SAy8VqvLCFyiOxPqeJ//HEqr1Dp1Q7BYQHvnv5OlEGeTut5ausdHCqlBuFuXrg+Q9TJPmNQTgnwXjOIwCOzfnqjiB48uSNZD7dTJY/gdEKW5+1q/w6gmOfJW69uDv4OO7I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1778606199362524.2017309501045; Tue, 12 May 2026 10:16:39 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wMqhm-0007xj-M7; Tue, 12 May 2026 13:15:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgf-0006p9-JY for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:30 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wMqgb-00011r-Kf for qemu-devel@nongnu.org; Tue, 12 May 2026 13:14:28 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-424-dWQR3lZfNZK9B3ybnmSuTA-1; Tue, 12 May 2026 13:14:20 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B5A441800451; Tue, 12 May 2026 17:14:18 +0000 (UTC) Received: from corto.redhat.com (unknown [10.44.49.156]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id ED2271953947; Tue, 12 May 2026 17:14:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778606063; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=v9ykP7jfFb11PT8krRVFcMmjBsX/sC3umQNq9cH46G0=; b=B05chAaCPWpWUHdl/JrhlcgmZxtMboCizPbYCs6dzLUWG907GIbpKY+uK1+HuG9DiOIfUF SgJ5li+Fc0wMO81ThHu+Lwoxsa51ZQnWOQaPtJIY0Pv7USg+/vScNhhgq1zdV1M4qLN67c rPYsDilKnADLmqdb8ta0tA2iZ1lk128= X-MC-Unique: dWQR3lZfNZK9B3ybnmSuTA-1 X-Mimecast-MFC-AGG-ID: dWQR3lZfNZK9B3ybnmSuTA_1778606058 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= To: qemu-arm@nongnu.org, qemu-devel@nongnu.org Cc: Ashish Anand , Jamin Lin , =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= Subject: [PULL 9/9] hw/i3c/dw-i3c: Fix BCR/DCR extraction and PID assembly during ENTDAA Date: Tue, 12 May 2026 19:13:54 +0200 Message-ID: <20260512171354.4183887-10-clg@redhat.com> In-Reply-To: <20260512171354.4183887-1-clg@redhat.com> References: <20260512171354.4183887-1-clg@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=clg@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778606202082154100 From: Ashish Anand The target_info union in dw_i3c_addr_assign_cmd() declares pid, bcr, and dcr as separate union members, causing them to all alias b[0] rather than their correct positions in the ENTDAA response buffer. This results in dw_i3c_update_char_table() being called with BCR and DCR both read from b[0] instead of b[6] and b[7] respectively, corrupting the device characteristics table on every ENTDAA operation. Fix by replacing the broken members with uint64_t d and extracting fields per the I3C spec ENTDAA wire format. Additionally, dw_i3c_update_char_table() incorrectly splits PID across LOC1 and LOC2 at bit 32. Per the Linux kernel HCI driver (drivers/i3c/master/mipi-i3c-hci/dct_v1.c), the DCT layout requires LOC1 to hold pid[47:16] and LOC2 to hold pid[15:0]. Fix the split accordingly. Signed-off-by: Ashish Anand Reviewed-by: Jamin Lin Link: https://lore.kernel.org/qemu-devel/20260505134002.509037-1-ashish.a6@= samsung.com Signed-off-by: C=C3=A9dric Le Goater --- include/hw/i3c/i3c.h | 7 +++++++ hw/i3c/dw-i3c.c | 16 +++++++--------- 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/include/hw/i3c/i3c.h b/include/hw/i3c/i3c.h index 6ba90793ad01..dcf8d9b1435b 100644 --- a/include/hw/i3c/i3c.h +++ b/include/hw/i3c/i3c.h @@ -138,6 +138,13 @@ struct I3CTarget { uint8_t static_address; uint8_t dcr; uint8_t bcr; + /* + * Provisioned ID. Since core.c sends this LSB-first during ENTDAA + * via (pid >> (offset * 8)) & 0xff, targets must store it + * pre-reversed so that pid[47:40] goes on the wire first, as + * required by the I3C spec. + * e.g. for a device with pid 0xAABBCCDDEEFF, store 0xFFEEDDCCBBAA. + */ uint64_t pid; =20 /* CCC State tracking. */ diff --git a/hw/i3c/dw-i3c.c b/hw/i3c/dw-i3c.c index d87d42be8914..17ff484c5df1 100644 --- a/hw/i3c/dw-i3c.c +++ b/hw/i3c/dw-i3c.c @@ -1459,11 +1459,10 @@ static void dw_i3c_update_char_table(DWI3C *s, uint= 8_t offset, uint64_t pid, P_DEV_CHAR_TABLE_START_ADDR) / sizeof(uint32_t)) + (offset * sizeof(uint32_t)); - s->regs[dev_index] =3D pid & 0xffffffff; - pid >>=3D 32; + s->regs[dev_index] =3D (pid >> 16) & 0xffffffff; s->regs[dev_index + 1] =3D FIELD_DP32(s->regs[dev_index + 1], DEVICE_CHARACTERISTIC_TABLE_LOC2, - MSB_PID, pid); + MSB_PID, pid & 0xffff); s->regs[dev_index + 2] =3D FIELD_DP32(s->regs[dev_index + 2], DEVICE_CHARACTERISTIC_TABLE_LOC3, = DCR, dcr); @@ -1507,10 +1506,9 @@ static void dw_i3c_addr_assign_cmd(DWI3C *s, DWI3CAd= drAssignCmd cmd) for (i =3D 0; i < cmd.dev_count; i++) { uint8_t addr =3D dw_i3c_target_addr(s, cmd.dev_index + i); union { - uint64_t pid:48; - uint8_t bcr; - uint8_t dcr; + uint64_t d; uint32_t w[2]; + /* Per I3C spec: b[0]=3DPID MSB, b[5]=3DPID LSB, b[6]=3DBCR, b= [7]=3DDCR */ uint8_t b[8]; } target_info; =20 @@ -1544,9 +1542,9 @@ static void dw_i3c_addr_assign_cmd(DWI3C *s, DWI3CAdd= rAssignCmd cmd) err =3D DW_I3C_RESP_QUEUE_ERR_DAA_NACK; break; } - dw_i3c_update_char_table(s, cmd.dev_index + i, - target_info.pid, target_info.b= cr, - target_info.dcr, addr); + uint64_t pid =3D be64_to_cpu(target_info.d) >> 16; + dw_i3c_update_char_table(s, cmd.dev_index + i, pid, target_info.b[= 6], + target_info.b[7], addr); =20 /* Push the PID, BCR, and DCR to the RX queue. */ dw_i3c_push_rx(s, target_info.w[0]); --=20 2.54.0